Docker and securing passwords

Question: I've been experimenting with Docker recently on building some services to play around with and one thing that keeps nagging me has been putting passwords in a Dockerfile. I'm a developer so storing passwords in source feels like a punch in the face. Should this even be a concern? Are there any good conventions on how to handle passwords in Dockerfiles?
Comment: There is an open issue on Github requesting for best practices regarding Docker and secrets, the issue is here: https://github.com/docker/docker/issues/13490
Answer: Definitely it is a concern. Dockerfiles are commonly checked in to repositories and shared with other people. An alternative is to provide any credentials (usernames, passwords, tokens, anything sensitive) as environment variables at runtime. This is possible via the -e argument (for individual vars on the CLI) or --env-file argument (for multiple variables in a file) to docker run. Read this for using environmental with docker-compose.
Using --env-file is definitely a safer option since this protects against the secrets showing up in ps or in logs if one uses set -x.
However, env vars are not particularly secure either. They are visible via docker inspect, and hence they are available to any user that can run docker commands. (Of course, any user that has access to docker on the host also has root anyway.)
My preferred pattern is to use a wrapper script as the ENTRYPOINT or CMD. The wrapper script can first import secrets from an outside location in to the container at run time, then execute the application, providing the secrets. The exact mechanics of this vary based on your run time environment. In AWS, you can use a combination of IAM roles, the Key Management Service, and S3 to store encrypted secrets in an S3 bucket. Something like HashiCorp Vault or credstash is another option.
AFAIK there is no optimal pattern for using sensitive data as part of the build process. In fact, I have an SO question on this topic. You can use docker-squash to remove layers from an image. But there's no native functionality in Docker for this purpose.
You may find shykes comments on config in containers useful.
Comment: @GrandOpener That only applies to the situation where there is an attacker using your system. If I push a docker image to a repository, and it's pulled by someone else, I don't care if they have sudo on their own system but I definitely care if they see secrets in env that are no longer supposed to be there.
Comment: I'm concerned that if your password is an env variable, it appears in `docker inspect`.
Comment: Isnt one of the problems with environment params that they intrinsically get copied to all descendent's, including grand-child processes? Thus a script or a plugin used in your docker container would have access to these passwords by accident?
Comment: Yer, env variables seems the best way to go. I've been looking at this in the context of TDDing Dockerfile development.
Comment: As noted in other comments there will be 2 layers (after ADD and after first RUN) that contain `.config` file.
Comment: A default installation of docker (on linux) requires sudoer privileges to run `docker inspect`.  If the attacker can already sudo, snatching your password out of docker inspect is probably pretty low on your list of things that can now go wrong.  This particular detail seems like acceptable risk to me.
Comment: If we use vault then where to store the vault secret id and role id which is used by the application to fetch credentialsmemory. How can we pass that into docker?
Answer: Our team avoids putting credentials in repositories, so that means they're not allowed in Dockerfile.  Our best practice within applications is to use creds from environment variables.
We solve for this using docker-compose.
Within docker-compose.yml, you can specify a file that contains the environment variables for the container:
 env_file:
- .env

Make sure to add .env to .gitignore, then set the credentials within the .env file like:
SOME_USERNAME=myUser
SOME_PWD_VAR=myPwd

Store the .env file locally or in a secure location where the rest of the team can grab it.
See: https://docs.docker.com/compose/environment-variables/#/the-env-file
Comment: You can also do this without a .env file, if you wish. Just use the [environment property](https://docs.docker.com/compose/compose-file/#environment) in your docker-compose.yml file . _"Environment variables with only a key are resolved to their values on the machine Compose is running on, which can be helpful for secret or host-specific values."_
Comment: Using environment variables is discouraged by the Docker team itself, as env var can be seen through /proc//environ and docker inspect. It only obfuscate the way to get the credentials for an attacker who has gained root access. Of course credentials should never be tracked by the CVS. I guess the only way to prevent a root-user to get cred is to read the credentials from within the web app (hoping that it does not update its proc environ file) from an encrypted file, the decryption process securely asking for a password. I think I'm gonna try with a tomb: https://github.com/dyne/Tomb
Comment: @theUtherSide it would be great if you can give us any examples or links of the "ways/tools" you meant.
Comment: give this man a cookie ! :) yep this is really good practice  I just want to add that https://docs.docker.com/compose/env-file/  this should work automatically but in docker compose version 2 it seems you need to declare it as described in this answer.
Comment: `.gitignore` so that the `.env` file with sensitive information does not get checked-in to GitHub.   I'm pretty sure this won't work if you add it `.dockerignore`
Comment: hi @theUtherSide, thanks for your answer, I had a question, when i dont checkin the `.env` file and I do a deployment to a server on premise, do you suggest to create the `.env` file again on server manually?
Comment: I would not recommend manually creating a `.env` file on a server...or doing anything manually on  server for that matter.  There are many ways/tools for this type of thing.
Answer: Docker now (version 1.13 or 17.06 and higher) has support for managing secret information. Here's an overview and more detailed documentation
Similar feature exists in kubernetes and DCOS
Comment: Not sure this can be the accepted answer if it only works with swarms. Many people aren't using swarms, but still need to pass secrets.
Comment: This is a good start on an answer, but needs much more information from that which is linked to appear in the answer itself.
Comment: Yes, you need to set up a swarm to use Docker secrets
Comment: Some useful commands from above links: `docker secret create` : create a secret  `docker secret inspect` : display detailed information about a secret   `docker secret ls`: view all secrets   `docker secret rm` : remove a specific secret   `--secret` flag for `docker service create`: create a secret during service creation   `--secret-add` and `--secret-rm` flags for `docker service update`: update the value of a secret or remove a secret during service update task. Docker secrets are protected at rest on manager nodes and provisioned to worker nodes when during container startup.
Comment: Docker Compose can manage secrets without a swarm. See [this answer](https://stackoverflow.com/a/48460539/5096199).
Comment: This is not very helpful as most of the out-of-the-box images expect passwords to be passed with environment variables
Answer: You should never add credentials to a container unless you're OK broadcasting the creds to whomever can download the image. In particular, doing and ADD creds and later RUN rm creds is not secure because the creds file remains in the final image in an intermediate filesystem layer. It's easy for anyone with access to the image to extract it.
The typical solution I've seen when you need creds to checkout dependencies and such is to use one container to build another. I.e., typically you have some build environment in your base container and you need to invoke that to build your app container. So the simple solution is to add your app source and then RUN the build commands. This is insecure if you need creds in that RUN. Instead what you do is put your source into a local directory, run (as in docker run) the container to perform the build step with the local source directory mounted as volume and the creds either injected or mounted as another volume. Once the build step is complete you build your final container by simply ADDing the local source directory which now contains the built artifacts.
I'm hoping Docker adds some features to simplify all this!
Update: looks like the method going forward will be to have nested builds. In short, the dockerfile would describe a first container that is used to build the run-time environment and then a second nested container build that can assemble all the pieces into the final container. This way the build-time stuff isn't in the second container. This of a Java app where you need the JDK for building the app but only the JRE for running it. There are a number of proposals being discussed, best to start from https://github.com/docker/docker/issues/7115 and follow some of the links for alternate proposals.
Answer: An alternative to using environment variables, which can get messy if you have a lot of them, is to use volumes to make a directory on the host accessible in the container.
If you put all your credentials as files in that folder, then the container can read the files and use them as it pleases.
For example:
$ echo "secret" > /root/configs/password.txt
$ docker run -v /root/configs:/cfg ...

In the Docker container:

# echo Password is `cat /cfg/password.txt`
Password is secret

Many programs can read their credentials from a separate file, so this way you can just point the program to one of the files.
Comment: This is a bad idea. especially typing in passwords into bash. All your secrets get stored into bash_history.
Comment: Yes that's true, but I was only using it as an example of what the file contents should look like.  You can use a text editor or other program to create the file.  However if you are running on a system where your `.bash_history` could be compromised, you shouldn't be putting your passwords in at all, whether in files, environment variables or on the command line.  Use a secure system when dealing with passwords like this.
Answer: run-time only solution
docker-compose also provides a non-swarm mode solution (since v1.11:
Secrets using bind mounts).
The secrets are mounted as files below /run/secrets/ by docker-compose. This solves the problem at run-time (running the container), but not at build-time (building the image), because /run/secrets/ is not mounted at build-time. Furthermore this behavior depends on running the container with docker-compose.

Example:
Dockerfile
FROM alpine
CMD cat /run/secrets/password

docker-compose.yml
version: '3.1'
services:
  app:
    build: .
    secrets:
      - password

secrets:
  password:
    file: password.txt

To build, execute:
docker-compose up -d

Further reading:

mikesir87's blog - Using Docker Secrets during Development
Comment: "but not at build-time (building the image)," and then your example is for build-time! If you would use the mounted secret-file in the CMD pragma, then it would make sense.
Comment: @lnksz Thanks, I adapted the example
Comment: This only worked with a prefix like this: `DOCKER_BUILDKIT=1 docker-compose up -d`
Answer: My approach seems to work, but is probably naive. Tell me why it is wrong.
ARGs set during docker build are exposed by the history subcommand, so no go there. However, when running a container, environment variables given in the run command are available to the container, but are not part of the image.
So, in the Dockerfile, do setup that does not involve secret data. Set a CMD of something like /root/finish.sh. In the run command, use environmental variables to send secret data into the container. finish.sh uses the variables essentially to finish build tasks.
To make managing the secret data easier, put it into a file that is loaded by docker run with the --env-file switch. Of course, keep the file secret. .gitignore and such.
For me, finish.sh runs a Python program. It checks to make sure it hasn't run before, then finishes the setup (e.g., copies the database name into Django's settings.py).
Answer: There is a new docker command for "secrets" management. But that only works for swarm clusters.
docker service create
--name my-iis
--publish target=8000,port=8000
--secret src=homepage,target="\inetpub\wwwroot\index.html"
microsoft/iis:nanoserver

Answer: The issue 13490 "Secrets: write-up best practices, do's and don'ts, roadmap" just got a new update in Sept. 2020, from Sebastiaan van Stijn:

Build time secrets are now possible when using buildkit as builder; see the blog post "Build secrets and SSH forwarding in Docker 18.09", Nov. 2018, from Tõnis Tiigi.

The documentation is updated: "Build images with BuildKit"

The RUN --mount option used for secrets will graduate to the default (stable) Dockerfile syntax soon.

That last part is new (Sept. 2020)

New Docker Build secret information
The new --secret flag for docker build allows the user to pass secret information to be used in the Dockerfile for building docker images in a safe way that will not end up stored in the final image.
id is the identifier to pass into the docker build --secret.
This identifier is associated with the RUN --mount identifier to use in the Dockerfile.
Docker does not use the filename of where the secret is kept outside of the Dockerfile, since this may be sensitive information.
dst renames the secret file to a specific file in the Dockerfile RUN command to use.
For example, with a secret piece of information stored in a text file:
$ echo 'WARMACHINEROX' > mysecret.txt

And with a Dockerfile that specifies use of a BuildKit frontend docker/dockerfile:1.0-experimental, the secret can be accessed.
For example:

# syntax = docker/dockerfile:1.0-experimental
FROM alpine

# shows secret from default secret location:
RUN --mount=type=secret,id=mysecret cat /run/secrets/mysecret

# shows secret from custom secret location:
RUN --mount=type=secret,id=mysecret,dst=/foobar cat /foobar

This Dockerfile is only to demonstrate that the secret can be accessed. As you can see the secret printed in the build output. The final image built will not have the secret file:

$ docker build --no-cache --progress=plain --secret id=mysecret,src=mysecret.txt .
...
#8 [2/3] RUN --mount=type=secret,id=mysecret cat /run/secrets/mysecret
#8       digest: sha256:5d8cbaeb66183993700828632bfbde246cae8feded11aad40e524f54ce7438d6
#8         name: "[2/3] RUN --mount=type=secret,id=mysecret cat /run/secrets/mysecret"
#8      started: 2018-08-31 21:03:30.703550864 +0000 UTC
#8 1.081 WARMACHINEROX
#8    completed: 2018-08-31 21:03:32.051053831 +0000 UTC
#8     duration: 1.347502967s

#9 [3/3] RUN --mount=type=secret,id=mysecret,dst=/foobar cat /foobar
#9       digest: sha256:6c7ebda4599ec6acb40358017e51ccb4c5471dc434573b9b7188143757459efa
#9         name: "[3/3] RUN --mount=type=secret,id=mysecret,dst=/foobar cat /foobar"
#9      started: 2018-08-31 21:03:32.052880985 +0000 UTC
#9 1.216 WARMACHINEROX
#9    completed: 2018-08-31 21:03:33.523282118 +0000 UTC
#9     duration: 1.470401133s
...

Answer: The 12-Factor app methodology tells, that any configuration should be stored in environment variables.
Docker compose could do variable substitution in configuration, so that could be used to pass passwords from host to docker.
Comment: I appreciate the reference to the bible.
Answer: Starting from Version 20.10, besides using secret-file, you could also provide secrets directly with env.

buildkit: secrets: allow providing secrets with env moby/moby#41234 docker/cli#2656 moby/buildkit#1534

Support --secret id=foo,env=MY_ENV as an alternative for storing a secret value to a file.
--secret id=GIT_AUTH_TOKEN will load env if it exists and the file does not.

secret-file:
THIS IS SECRET

Dockerfile:
# syntax = docker/dockerfile:1.3
FROM python:3.8-slim-buster
COPY build-script.sh .
RUN --mount=type=secret,id=mysecret ./build-script.sh

build-script.sh:
cat /run/secrets/mysecret

Execution:
$ export MYSECRET=theverysecretpassword
$ export DOCKER_BUILDKIT=1
$ docker build --progress=plain --secret id=mysecret,env=MYSECRET -t abc:1 . --no-cache
......
#9 [stage-0 3/3] RUN --mount=type=secret,id=mysecret ./build-script.sh
#9 sha256:e32137e3eeb0fe2e4b515862f4cd6df4b73019567ae0f49eb5896a10e3f7c94e
#9 0.931 theverysecretpassword#9 DONE 1.5s
......

Answer: With Docker v1.9 you can use the ARG instruction to fetch arguments passed by command line to the image on build action. Simply use the --build-arg flag. So you can avoid to keep explicit password (or other sensible information) on the Dockerfile and pass them on the fly.
source: https://docs.docker.com/engine/reference/commandline/build/ http://docs.docker.com/engine/reference/builder/#arg
Example:
Dockerfile
FROM busybox
ARG user
RUN echo "user is $user"

build image command
docker build --build-arg user=capuccino -t test_arguments -f path/to/dockerfile .

during the build it print
$ docker build --build-arg user=capuccino -t test_arguments -f ./test_args.Dockerfile .

Sending build context to Docker daemon 2.048 kB
Step 1 : FROM busybox
 ---> c51f86c28340
Step 2 : ARG user
 ---> Running in 43a4aa0e421d
 ---> f0359070fc8f
Removing intermediate container 43a4aa0e421d
Step 3 : RUN echo "user is $user"
 ---> Running in 4360fb10d46a
**user is capuccino**
 ---> 1408147c1cb9
Removing intermediate container 4360fb10d46a
Successfully built 1408147c1cb9

Hope it helps! Bye.
Comment: According to [Docker's ARG docs](https://docs.docker.com/engine/reference/builder/#arg): "It is not recommended to use build-time variables for passing secrets like github keys, user credentials etc"
Comment: I imagine the reason it is not recommended is because `docker history` exposes `build-arg`/`ARG` variables. One can pull any image, inspect it and see any secrets passed during build as a `build-arg`/`ARG` parameter.
Comment: Do not use this method! It will leak sensitive information on docker history
Comment: Just wondering why Docker disrecommends to use `--build-arg var=secret` for passing a SSH private key into an image, there is no rationale documented. Can anyone explain it?
Comment: @HenkWiersema Process information, logs and command history are insecure.  Process information is available publicly and that includes all command line parameters.  Frequently these calls end up in logs which can be public also.  It's not uncommon for an attacker to inspect information on running processes and trawl public logfiles for secrets.  Even when it's not public, it could be stored in your command history which would make it easy for someone to get secrets through a non-administrative account.
Comment: What is the recommended way to supply credentials that are needed at build time? For example, an image that needs aws s3 access to fetch a large data set that will reside inside the image?
Answer: Something simply like this will work I guess if it is bash shell.
read -sp "db_password:" password | docker run -itd --name <container_name> --build-arg mysql_db_password=$db_password alpine /bin/bash
Simply read it silently and pass as argument in Docker image. You need to accept the variable as ARG in Dockerfile.
Answer: While I totally agree there is no simple solution. There continues to be a single point of failure. Either the dockerfile, etcd, and so on. Apcera has a plan that looks like sidekick - dual authentication. In other words two container cannot talk unless there is a Apcera configuration rule. In their demo the uid/pwd was in the clear and could not be reused until the admin configured the linkage.  For this to work, however, it probably meant patching Docker or at least the network plugin (if there is such a thing).

Docker and securing passwords


Ruby: how to uninstall Devise?

Question: I have installed Devise and now want to remove it, including all the files it has generated. How do I do that?
Comment: I believe you need to run a generator for Devise to create any files in your directory to begin with. Hence you should be able to run e.g. `rails destroy devise:views` . Have you tried that already?
Comment: I know realize I should branch it in git
Answer: I'm looking at solving the same problem today and since this is not answered, giving it a go =)
Models
Devise generates a User model if you installed by default.
Remove the lines under devise. This is how mine looks like.
devise :database_authenticatable, :registerable,
         :recoverable, :rememberable, :trackable, :validatable

In attr_accessible, you may remove email, :password, password_confirmation and remember_me if you no longer need them.
Views
A default Devise install doesn't generate views in your app folder. If you generated overriding views for Devise, you may remove them by running rails destroy devise:views (Rails 3).
Generally, all the views are stored in app/views/devise.
Controllers
By default, Devise doesn't generate any controllers too. If you did any overrides, they are most likely known as registrations_controller. Search your project for controllers that inherit Devise::RegistrationsController class.
Also, if you followed Devise's wiki and monkey-ed around to add redirect methods etc, look out for methods such as after_sign_in_path_for, store_location etc that are for redirecting users.
Migrations
If you installed Devise via its generators, look out for a migration create_users. If you don't need it anymore, use drop_table :users in a migration to get rid of it.
I'll assume most people would want to keep their User model. If you're using Devise < 2.0, the migrations are done by helpers. Once you remove Devise from the Gemfile, Rails will not understand the helpers below and throw errors, for instance, when you're trying to rerun these migrations on another box. These helpers are:
t.database_authenticatable
t.recoverable
t.rememberable
t.trackable

t.encryptable
t.confirmable
t.lockable
t.token_authenticatable # => becomes t.string :authentication_token

For the exact columns, the below is reference to the columns generated by Devise.
https://github.com/plataformatec/devise/wiki/How-To:-Upgrade-to-Devise-2.0-migration-schema-style
The guide above lists the fields generated by Devise using the helpers. You should be able to look through the list and your model (e.g. calling User in console), generate a migration that removes those columns.
BUT...
It's a little unfortunate that for consistency, we have to convert the migration to not use helpers using the guide above then generate a migration to remove them. This is for migration history consistency, otherwise anyone running the migrations might try to call the non-existent helpers. Also, your migration to remove the fields will also expect the fields to be present.
Alternatively, it might be a good time to squash the migrations and rely on schema.rb / structure.sql for the schema's to-date state. Even after deleting migrations, you can always recreate your development DB anytime using rake db:schema:load.
Initializers and Locale
Remove devise.rb in config/initializers and devise.en.yml in config/locales.
Routes
Remove any devise_for lines. These will raise errors after the removal of the gem.
Gem File
Yaay. All dome, remove the line gem 'devise' from your gemfile.
Comment: The only thing I don't agree is the removal of the fields from the original migration. Migrations exist as a kind of version control of your database, that you can run or rollback. Because of this, I think it's better to create another migration in which you remove these fields from the model.
Comment: Thank you SO much! It's over 3 years later and this solution still worked perfectly to undo my attempt at using devise with Rails 5.0.0.alpha.
Comment: @nunopolonia You're totally right. Thanks for pointing out. It was pretty noobish. To keep the migrations consistent, we have to change them the original ones to normal Rails format and then removing them in another migration? Any suggestions for this?
Answer: Use the generator to remove configuration files as well (step 2), so the whole process would be (referencing previous answers):

Remove the table: rake db:rollback VERSION=<insert the version number of the migration>
Remove the configuration: rails destroy devise:install
Remove your User model: rails destroy devise User (replace 'User' with the name of your model)
Remove references to devise in your routes.rb, gemfile, controller files, and view files like the following, if you used them (once again replacing 'user' with your model name):

devise_for                        (routes.rb)
gem 'devise'                      (gemfile)
before_action :authenticate_user! (controllers)
user_signed_in?                   (controllers, views)
current_user                      (controllers, views)
user_session                      (controllers, views)
Answer: In my case I had two models User and Admin and I am sticking with Devise, but I had a name collision issue with ActiveAdmin that requires me to remove the Admin model. But because there were so many references to Admin in devise, I had to take the steps below. I think it answers the original question above as well, though. I believe the correct way to do this is:
1.Find the devise migration for the user model and roll it back [IMPORTANT: IF you DON'T want to remove the user table associated with Devise, then SKIP THIS STEP]:
rake db:rollback VERSION=<insert the version number of the migration>
example:
rake db:rollback VERSION:20110430031806
2.Run this command to remove Devise and associated files.
rails destroy devise Admin (if Admin is the name of the model with user accounts).
This produces this output:
invoke  active_record
  remove    db/migrate/20110430031806_devise_create_admins.rb
  remove    app/models/admin.rb
  invoke    test_unit
  remove      test/unit/admin_test.rb
  remove      test/fixtures/admins.yml
   route  devise_for :admins

3.To completely remove Devise, you need to remove all references to it in your models, controllers and views. This is manual work. The answer above provides good details for finding this cruft, but was incomplete for my purposes. I hope this helps someone else.
Answer: I found daemonsy's reply to be very helpful. Here are a few other things to consider as you do this.
Replacing Devise

If you are going to replace Devise with your own authentication, I recommend this Railscast: Authentication from Scratch (revised) (subscription required, but it's the best $9/mo you can spend).
And this Railscast (no subscription required) can help with a forgot password link and "remember me" option (things Devise offers out of the box, but that you can build pretty easily yourself): Remember Me & Reset Password

Tests

Before you do this, I recommend running all your tests to make sure they're passing.
After you remove Devise, your authentication-dependent tests will probably fail, so plan to spend some time fixing failing tests. This is a good thing because it will help you see what stuff "broke" when you removed Devise.
Make sure you check your test helpers as well. Most of my helpers were in /spec/spec_helper.rb. In fact, most of my failing tests began passing once I updated the methods in spec_helper.rb (eg, "login_user").
Answer: This worked for me!

1:  rails d devise  User  This deletes the model and the routes.
2:  rails d  devise:install , This destroys devise.rb and
  devise.en.yml files.
3:  create a migration eg:  rails g migration drop_user_table. I
  used  drop_table :users , force: :cascade, force: :cascade; takes
  care of
PG::DependentObjectsStillExist: ERROR:
that occurs if other tables depend on the user table.

Ruby: how to uninstall Devise?


Want to upgrade python for django

Question: I would like to upgrade python for django. Currently I have python 2.4.3 on my Red Hat server. I have installed python 2.7.1, but the default python is still 2.4.3 (It didn't upgrade python, but installed python 2.7 separately). Django python version is also still 2.4.3 as well. I want to make a change so Django runs with 2.7. How do I overcome this problem?
Answer: RedHat has many tools that depend on Python 2.4 (yum is an example of this) so make sure you don't overwrite the standard Python binary.
Depending on how you installed it, you may be able to get to it with the command python27 or python2.7. So instead of running
python ./djangoapp.py
run
python2.7 ./djangoapp.py
If that doesn't work, you might need to reference the Python binary directly as it might not be in the system path. From memory, it should be something like /installpath/bin/python. You might want to symlink that into /usr/bin or something so it's available in your system path, just make sure to name it python2.7 or python27 not just Python.
Comment: @samarudge Sorry to ask you this noob question, but when you run `python2.7 ./djangoapp.py`, do you use this step in the configure process?  If I past this line in my terminal and run it I get `python2.7: can't open file './djangoapp.py': [Errno 2] No such file or directory`
Comment: @Shehzad009 No that's nothing to do with setting it up, when you run `python2.7 --version` does it print back the correct version number? If so, everything is working, but when you launch your django app instead of using the `python` command use the `python2.7` command
Comment: @samarudge Running this `python2.7 --version` works. Typing `python2.7 ./djangoapp.py` does not work. `python2.7: can't open file './djangoapp.py': [Errno 2] No such file or directory`
Comment: @Shehzad009 I was using ./djangoapp.py as an example, you should replace it with the path to your django application's main file. That means you have Python 2.7 working correctly you just need to run your application with it
Comment: @samarudge  so if my project folder is c2duo_mms, and my inside this folder I have an mmc folder which holds my forms/views/models - etc. So I should replace  djangoapp.py with mmc? EDIT: I get this error. `/usr/local/bin/python2.7: can't find '__main__' module in './mmc'`
Comment: I have figured out the answer. You must install mod_wsgi again for python 2.7 (at least in my case). You will also need to install any other dependencies/libraries for python 2.7 as well if you have done so for python 2.4
Answer: You should really consider running virtualenv, located on PyPi. It sets up a virtual environment for running different versions of Python, which allows you to avoid interfering with the system's Python 2.4.
I have the same problem on my CentOS VPS, and found virtualenv as the solution. It's not quite as simple as everyone says (when you build third-party packages that aren't Python-based, say that compile in C, you have to make sure they point to the right Python libraries for compilation). But it generally works nicely.

Want to upgrade python for django


What is the closest scientific branch to cognitive science?

Question: I was thinking about studying this awesome science but, unfortunately, it's not being taught anywhere in my country (Czechia). What is the closest scientific branch to cognitive sciences?
Answer: As @Lucianopaz said in his answer, this question is very broad and depends on what area of Cognitive Science you are interested in.
Cognitive Science is an "umbrella term" or a "collective term" for many different sciences.
As the link I provided says, there are 6 main sciences within the collection;

Philosophy
Linguistics
Anthropology
Neuroscience
AI (Artificial Intelligence)
Psychology

but within those sciences there are branches.
Take Psychology for example, and you could specialise in Social Psychology, Behavioural Psychology, Criminal Psychology... the list goes on.
You need to work out what interests you within this collection of sciences to work out what you want to study in college and university.
Comment: Thanks. Don't you know about any alternative names for Neuroscience? I have heard that not all neuroscientists have a neurology degree but there's again, no chance to study that in my home country
Comment: @Probably - Have a look at [this](https://en.wikipedia.org/wiki/Neuroscience)
Comment: Is AI a branch of cognitive science?
Answer: I think it depends on what you find particularly interesting in cognitive sciences.
I think that if you are drawn to learn about human behaviour, emotion, learning, and other aspects of human cognition on an abstract level, then Psychology may be the best branch for you.
If you are interested in the neural-side of the matter, i.e. how a bunch of cells can organize and give rise to function, then you have a broad set of branches to look at. Biology is the most thematically related, and it studies the brain at several scales, from molecular biology that aims to understand gene-expression/regulation, the involvement of different proteins, neurotransmitors or other compounds in brain function, to ethology that studies how living organisms behave.
There are also other scientific branches that are becoming more involved in neuroscience such as computer-science, mathematics and physics, however the core of these branches is farther away from cognitive science than Biology and Psychology. Again, your question is mainly opinion based and it strongly depends on your particular inclinations.


How can I invert part of a photo?

Question: Is there an easy way to invert part of a photo in software? Is there a good image viewer that does that?
Comment: Welcome to Photo.Stackexchange! Could you provide a bit more detail to your question, such as what Operating System (Windows, a Linux, OS X, ...) you use, and any photo-editing software you have/use, as this will help us provide better answers.
Answer: Yes, pretty much all image editing applications include Invert as a standard adjustment and will automatically apply it to the active selection (if there is one). Here are a couple of examples.
Windows: Paint.NET
Paint.NET is a great free image editor for Windows.

Make a selection
From the menu, pick Adjustments > Invert Colors

Linux/Mac OS: Gimp
Much the same process:

Make a selection
From the menu, pick Colours > Invert
Comment: + for mentioning Paint.Net... It's really under appreciated.
Comment: Agreed, and it keeps getting better. Thanks for the upvote!
Answer: Most photo editing software (though generally not raw processors like Lightroom) has the ability to select parts of an image and to perform operations on that selection, and most software has the ability to make a photo negative.
If you want something freely available I suggest GIMP. Photoshop and Photoshop Elements will also do it but they cost money.
Answer: One program I like a lot is Irfanview. It's small and fast, and it will even run from a flash drive, without installing it on a PC. Among its many features is the ability to invert a selected areas. It's a free download.

How can I invert part of a photo?


Can longitudinal data be seen as complying with 1st normal form?

Question: This is probably a sloppy way to see it, but I wonder if the idea of longitudinal datasets (to be used in ggplot2, for instance), can be exlpained as complying with the criteria of data in a 1st normal form. I know the latter comes from the relational database field, but I would see entities within a db that is 1st normal as longitudinal dataframes. Does it make sense?
Comment: I mean that "1st normal form," etc. are only meaningful in a relational database context.  1st normal form is generally the *starting point* in any such conversation, i.e. *denormalized data.*
Comment: Unless you plan on storing this data in a database, it doesn't matter.
Comment: @RobertHarvey you mean because a set of longitudinal datasets wouldn't necessarily lead to a 1st normal form, but the reverse it true?
Answer: Wide/fat/short and long/skinny/tall are both valid representations of multiply sampled data, each having their strengths and weaknesses.  Both of these representations are valid longitudinal data sets in R as well as tables in relational databases.
Some argue that one form or the other violates database normalization concepts, but I don't see it.  For example, some argue that the long/tall form repeats or duplicates keys (a violation of 1NF), but I would argue that the true row key in the long form is really a larger composite key (i.e. that includes another column), and thus not in violation of 1st normal form as composite keys don't violate normalization.  In wide format, what is logically one constraint over sampled data has to be replicated across multiple columns, which is a duplication of sorts, though not a violation of 1st normal form.
In short, we can see both wide and long representation in databases without violating 1st normal form.
Comment: Just to make sure I'm understanding you, what you're saying is (using the example in OP's link) `country_long` has a key of (`country`, `year`) while `country_wide` has a key of `country`?
Comment: @AndrewPiliser, yes, with the composite key, country_long is not violating 1NF.


Proper way to pronounce "Pyrzqxgl!"

Question: In my youth, my father used to read me The Magic of Oz by L. Frank Baum.
The magic word that was used to transform, Pyrzqxgl,  was very difficult to pronounce. Are there any guidelines on pronouncing it?  Where would the accent be, if any?
Comment: Just as it's written, obviously.
Comment: This is really too narrow to be germane to the discussions here. Voting to close.
Comment: "purrz - **quicks** - gull" Note that the "u" in "gull" at the end must be **very** short, almost a schwa. Also, the "quicks" in the middle must be hit **very** hard.
Comment: I voted to close, too, but I just can't help upvoting the question...
Answer: The literary in-joke of Pyrzqxgl is that nobody would know how to pronounce it correctly lest they cause people to transform. There is a page here dedicated to the joke, writing:

No, I mean, what is the correct pronunciation of Pyrzqxgl?
This is a deep secret known to only a few magic users today, and disclosing the exact pronunciation of the word is a deep offense in most planes of existence. Use of the word by irresponsible people could result in a cosmos-wide calamity (hence this convenient Web tool).
"Pyrzqxgl" is the common (unpronounceable) transliteration. Of course, the word would not ever be written in such a fashion to easily convey the true sound of the word - the danger would be far too great.
Even when the correct pronunciation is known, Pyrzqxgl is a very difficult word to say. However, the pronunciation must be perfect. Some people who are missing teeth or who have unusually large or small mouths may not even be able to pronounce it properly. There have been a few cases in which such obstacles in students were overcome, however they are rare. Ancient cultists were known to physically alter their tongues (through magic or brute cutting) in order to more easily pronounce the potent word.

The "correct" pronunciation is unknown, and the only way to know it was "right" would be that the magic occurred. So, you can pronounce it any way you want. The letters are combined in such a way that there aren't other words which a pronunciation can be based on.
My guess at how to pronounce it (which is only opinion) is Peer-zuh-kex-gul.
Comment: @Chaos We'll know if it's right when someone transforms.
Comment: Whats more deadly? Pyrzqxgl or Avada Kedavra? :)
Comment: @simchona  This explains it well. I must be one of those whose mouth is too small to pronounce it right.
Comment: In my opinion, I would pronouce it as Peerz-ques-gul.

Proper way to pronounce "Pyrzqxgl!"


How to make Achilles and the Tortoise argument map?

Question: I need to make an argument map for Achilles and the Tortoise with the conclusion at the top and premises and undisclosed premises coming out of it 5-10nodes. Im stuck and dont know how to go about it if anyone can help it would mean alot. This is an example of how I have to do it.
https://maps.simoncullen.org/basics/biv
Comment: Regarding your example: anyone who talks about brain-in-a-vat without mentioning the burden of proof, explanatory power or parsimony (Occam's razor) is not someone I'd trust when it comes to philosophy. Those are the main reasons people reject brain-in-a-vat. Most people (with some philosophy exposure) would trivially agree that we have no evidence against it, so it's questionable to focus on that instead of focusing on why we shouldn't reject things we don't have evidence for (but for an Intro to Philosophy exercise, that focus might make sense).
Answer: WHAT I HAVE RN BUT I FEEL IS WRONG 1. Premise 1: Achilles and the Tortoise engage in a race.
2. Premise 2: The Tortoise is given a head start.
3. Reason (Green Bracket): The Tortoise covers a fraction of the distance Achilles must run.
- Claim: The Tortoise covers 1/10th of the distance.
- Claim: Achilles is faster and covers the remaining 9/10th of the distance.
4. Objection (Red Bracket): Achilles must cover an infinite number of smaller distances to reach the Tortoise.
- Claim: Before Achilles reaches the Tortoise, he must cover half of the remaining distance.
- Claim: This process repeats infinitely, making it impossible for Achilles to overtake the Tortoise.
5. Implicit Premise: The infinite division of distance leads to an infinite series.
- Claim: An infinite series cannot be completed.
6. Conclusion: The paradox challenges the possibility of completing an infinite number of tasks.
Answer: Here is how to proceed.
Prepare a chart with horizontal distance travelled on the x (horizontal) axis and elapsed time on the y (vertical) axis. Mark the tortoise's position with little dots and the hare's position with little crosses.
The tortoise starts at the starting line which is at the intersection of the x and y axies. The finish line point is a vertical line somewhere to his right. He travels at a small speed and so his world line is an almost vertical line which does not cross over the finish line for a long time.
The hare doesn't start until the tortoise has had a chance to get a head start. He doesn't leave the starting line (vertical line through the x, y origin point) until sometime after the tortoise did. So the hare's world line departs from the origin line somewhere up the time axis, but since he is traveling faster (farther per unit time) than the tortoise his his world line is flatter on the chart and these two world lines will inevitably cross, at which point the hare will overtake the tortoise.
If the hare is fast enough and the tortoise's head start is brief enough, the hare will overtake the tortoise before the finish line and win the race.
The inevitability of the crossing point is a simple fact of geometry and no infinite series is needed to establish that fact!


Change parental controls on windows 7

Question: I installed parental controls on Windows 7 under Administrator,instead of user, now everything is blocked and I'm unable to go 3 seconds without confirming a password again. I go to Control Panel, then User Accounts and Family Safety, then Parental Controls. I click and see Computer Administrator (Password Protected) and two other users, but cannot find anywhere at Admin to enter a password to undo this. I have the password, just can't find a spot to enter. PLEASE, this is agony.
Comment: Can you get in using standard user account-using admin password when asked or you can setup a new admin account[without controls] you should be able to get into the controls to do the changes you need.
Comment: See this  http://superuser.com/questions/20714/windows-7-parental-controls-how-to-disable
Comment: And this...http://social.answers.microsoft.com/Forums/en-US/w7security/thread/25fd2b1a-58e3-4648-b6a7-90fff12027c2
Answer: How to Setup (and disable) and Use Parental Controls in Vista. I know it says Vista, but it should nearly the same steps. You might, also, be able to turn it off from the Services Management Console.
Stopping the Parental Controls service:
- Click Start
- Type in Services
- Select the option label just Services
- Scroll down the list to Parental Controls
- [Right Click] Parental Controls
- Select Stop
Might be prompt by UAC. Enter your password when prompted

Change parental controls on windows 7


How to create an updatable Postgres view with rules that allows `INSERT` with `ON CONFLICT` queries?

Question: I've created a postgres view (called metrics) that serves as a proxy for two underlying tables (static_metrics and live_metrics). I've also created a set of rules to allow clients to interact with that view as if it were just a normal table, and without having to know anything about the tables underneath it. My intention is that select statements on the view return data from the two underlying tables, but that inserts, updates, and deletes will change the data in just one of the underlying tables (static_metrics). The exact table/view set up is included below.
My problem is that with this arrangement, I get errors when trying to use "upsert" statements in the form INSERT INTO metrics ... ON CONFLICT ...;. For example, this query:
INSERT INTO metrics (segment_type, segment_id, metric_a, metric_b)
VALUES (1, 12345, 0.5, 0.75)
ON CONFLICT (segment_type, segment_id)
DO UPDATE SET (metric_a, metric_b) = (excluded.metric_a, excluded.metric_b);

I get the following error message:

ERROR: INSERT with ON CONFLICT clause cannot be used with table that has INSERT or UPDATE rules

So finally my question: Is there some way I can rewrite my rules to handle this use case? If not, is there some other way that I can restructure my database so that clients can continue interacting with the metrics object but have all reads return data from two distinct tables? The underlying motivation here is that I don't have control over all clients, so I want this to all work seamlessly without any changes needed on their end.
Here are the exact table, view, and rule definitions:
CREATE TABLE static_metrics (
    id serial PRIMARY KEY,
    segment_type int NOT NULL,
    segment_id int NOT NULL,
    metric_a float,
    metric_b float,
);
CREATE INDEX static_metrics_idx ON static_metrics (segment_type, segment_id);

CREATE TABLE live_metrics (
    id int PRIMARY KEY DEFAULT nextval('static_metrics_id_seq'::regclass),
    segment_type int NOT NULL,
    segment_id int NOT NULL,
    metric_a float,
    metric_b float,
);
CREATE INDEX live_metrics_idx ON live_metrics (segment_type, segment_id);

CREATE VIEW metrics AS
    SELECT * FROM static_metrics
    UNION ALL
    SELECT * FROM live_metrics;

CREATE OR REPLACE RULE metrics_INS AS INSERT TO metrics
    DO INSTEAD
    INSERT INTO static_metrics VALUES (
        CASE WHEN NEW.id is null THEN nextval('static_metrics_id_seq') ELSE NEW.id END,
        NEW.segment_type,
        NEW.segment_id,
        NEW.metric_a,
        NEW.metric_b
    );

CREATE OR REPLACE RULE metrics_UPD AS ON UPDATE TO metrics
    DO INSTEAD
    UPDATE static_metrics
        SET
            id = NEW.id,
            segment_type = NEW.segment_type,
            segment_id = NEW.segment_id,
            metric_a = NEW.metric_a,
            metric_b = NEW.metric_b
        WHERE id = OLD.id;

CREATE OR REPLACE RULE metrics_DEL AS ON DELETE TO metrics
    DO INSTEAD
    DELETE FROM static_metrics WHERE id = OLD.id;

Answer: Don't use a rule; it is likely to work different from how you believe it does, at least in certain cases. Use an INSTEAD OF trigger. Well, you have been warned.
Anyway, there is no way to have INSERT ... ON CONFLICT with a view, as a view cannot have constraints. Instead, just use simple INSERT and write the INSTEAD OF INSERT trigger to that it performs INSERT ... ON CONFLICT on the underlying table.


Hardening a perimeter router

Question: What are some of the steps that could be taken to harden a perimeter (internet facing) router from attacks by potentially malicious users?
Answer: Basically you would need to prevent any packet from internet reaching switch CPU, except for the allowed hosts, so basically this can be done with policy, which works on the hardware level, before reaching the switch. Such policy would work the way, that you need to collect the public ip numbers of the switch, let's say 192.168.0.1/30 VLAN 10 connects you to the internet and 10.0.0.0/24 VLAN 20 is with servers, so this way you can apply the following policy. Best is to deny everything, and allow only specific hosts you need, than you will be seriously stable and secure.
This is simplified policy with one chain for ingress and egress:
<code># 192.168.0.2/30 - other router (VLAN10)
# 192.168.0.1/30 - your router  (VLAN10)
# 10.0.0.0/24    - servers      (VLAN20)
# 10.0.0.10/24   - you          (VLAN20)

#Allow Broadcast only on VLAN20, so you dont have malicious broadcast from other router
From Any To ff:ff:ff:ff:ff:ff VLAN 20 Permit

#Allow Multicast only on VLAN20, if you need it for VRRP you can add the rule for VLAN10
From Any To 184.108.40.206/4 VLAN 20 Permit

#Anti-spoofing rules for your servers
From 10.0.0.0/24 to 0.0.0.0/0 VLAN20 Permit
From 0.0.0.0/0 to 10.0.0.0/24 VLAN20 Permit

#Allow accessing (e.g. pinging the other router) for your admin
From 10.0.0.10/32 to 192.168.0.0/30 Permit
From 192.168.0.0/30 to 10.0.0.10/32 Permit

#Block any other VLAN to VLAN communication
From 10.0.0.0/8 to 10.0.0.0/8 Deny
From 192.168.0.0/16 to 192.168.0.0/16 Deny
From 10.0.0.0/8 to 192.168.0.0/16 Deny
From 192.168.0.0/16 to 10.0.0.0/8 Deny

#Allow internet for 10.0.0.0/24, this allows packets from and to internet go thru VLAN10
From 10.0.0.0/24 to 0.0.0.0/0 Permit
From 0.0.0.0/0 to 10.0.0.0/24 Permit

#Deny them all, this includes access to VLAN10
From 0.0.0.0/0 to 0.0.0.0/0 Deny
</code>
With this, others wont be able to tranceroute or ping your switch. But at the same time, you are way much better protected with potential denial of services, as your Switch OS is isolated. This is good in some scenarios.
Also, some switches do have hardware counters, so they allow only limited number of packets from specified host to reach the CPU. This way the rule could be to count ALL packets reaching from Internet (except your admin machine) and to limit them ALL (from any host) to e.g. 10 packets per second. This would be useful for ICMP, so you can still traceroute.
<code>From Any to 192.168.0.1/32 Protocol ICMP Limit 10 packets / second
From Any to 192.168.0.1/32 Protocol ICMP Allow
From 192.168.0.1/32 to Any Protocol ICMP Allow
</code>
Comment: Doesn't such functions border on firewall-like? Is there any purpose in doing such filtering on the router, and not a firewall?

Are there any router-specific configurations that could be made to better secure the network?
Comment: Well you do normally connect to the e.g. internet backbone with router, and to router you connect firewall, and to the firewall desktops, so you need policy on router to filter out packets coming directly to it from internet. Good idea is to setup Router management via separate LAN or interface on e.g. back of it, so it's impossible to load admin page of router, as well SNMP etc. Also 2 firewalls are better than 1.
Comment: ps. And any firewall or router needs a "Deny All" rule on the bottom to prevent any unauthorized access, in this case, packets reaching the switch CPU. If you are using some router protocols, you can add them on the top, so e.g. VRRP, EAPS would work as normal.
Comment: Thank you for your detailed answers, shall let this run for a few more days before choosing an accepted answer.
Comment: Sure I'll review it and will also try to put this on my own router to see how it works.
Answer: There are three useful things to do when hardening a perimeter router.

Update the firmware on the router regularly. Routers are no different from any other devices with software running on them. They are susceptible to vulnerabilities. The firmware running on routers should be updated if there are any updates.
Drop unnecessary packets. Routers can be susceptible to DDoS attacks if they receive more packets then they can handle. Complex processing rules like deep-packet inspection may worsen this. Drop any packets attempting to reach disallowed IP addresses or ports before performing complex inspection on them.

Hardening a perimeter router


Unable to access Redis (cluster mode enabled) Cluster's Endpoints

Question: I have 1 VPC - under that 1 EC2 instance ( amazon ami ) and 1 Redis (cluster mode enabled) Cluster with Auth ( password) and with Security Group Open to all IP:Port ( only for testing sake ) - so very simple setup.
telnet works at port 6379 from my EC2 Instance
- Configuration EndPoint
- Shard>eachNode EndPoint
Not able to connect to Redis Server using Redis CLI - doesnt matter endpoint either Config or Node endpoint; Using Redis CLI of v.5.0.4 ;
Please Note - AWS ElastiCache Redis Cluster ( Cluster disabled ) or Single Server Node, provides Primary Endpoint, which works fine. Only when Cluster is enabled and get ConfigEndpoint/NodeEndPoints - then having problem.
Config EndPoint:
<code>[root@ip-xx-xx-xx-xx src]# ./redis-cli -h clustercfg.xxxx.xxxxx.use1.cache.amazonaws.com  -p 6379
</code>
Node EndPoint:
<code>[root@ip-xx-xx-xx-xx src]# ./redis-cli -h xxxx-0001-0-01.xxxx.xxxxx.use1.cache.amazonaws.com  -p 6379
</code>
Any help is appreciated!
thanks
Answer: After spending few days on this issue, I was able to find the solution - we need stunnel or any other equivalent that creates SSL tunnel, redis-cli doesn't support ssl or tls.

To access data from ElastiCache for Redis nodes enabled with in-transit encryption, you use clients that work with Secure Socket Layer (SSL). However, redis-cli doesn't support SSL or Transport Layer Security (TLS).
  To work around this, you can use the stunnel command to create an SSL tunnel to the redis nodes. You then use redis-cli to connect to the tunnel to access data from encrypted Redis nodes.

https://docs.aws.amazon.com/AmazonElastiCache/latest/red-ug/in-transit-encryption.html
Comment: It seems your solution relates to applying encryption to your cluster, not to enabling cluster-mode.


Make transparent 3d object with collision detection

Question: I am newbie in unity3d, I just want to make a square area which will should be transparent and when a object enter into that square area or touch that area then I should let know that some object enter or touch area. Kindly let me know or suggest me how can i do this task. This will be great for me. Thanks in advance.
Answer: Box collider will work and if you just want to know when they enter click is trigger then in your script have the OnTriggerEnter function to handle your logic
here is a link for unity's colliders
http://docs.unity3d.com/Documentation/ScriptReference/Collider.html


Can judges impute income in debt cases?

Question: I have a money judgment against a stripper  for a few thousand  dollars. All her income is in cash and she reports nothing on  her 1099. Can I ask the judge to impute her 10-20k monthly that she actually makes on the job and get a court order for the police or club to seize her cash? I know this can be done in alimony cases but not sure about debt.
Answer: No. You can not impute income when collecting on a judgment.
Imputation of income in alimony cases is done to determine the amount of the debt owed, and not with regard to the collection of an already determined debt.
In a debt collection case, the debt is already determined.
This said, wage garnishment is not the only way to collect a debt.
A writ of execution issued based upon a money judgment can authorize the sheriff to seize any tangible personal property not subject to an exemption from creditors (which cash earned in self-employment would generally be). A writ of execution might also be used to seize motor vehicles, jewelry or other property.
The club is only subject to garnishment of cash earned by an independent contractor at the club if it is in the club's possession, which I understand, is not the customary practice.
Debtor's interrogatories can be served upon a debtor asking the debtor where the debtor's assets are located which can facilitate collection of those debts.
Debts transferred to third-parties (e.g. family and friends) without substantially equivalent value can be recovered from the transferees in a fraudulent transfer action.
But, if the sheriff is not nimble enough to seize significant cash from the person of the debtor, the money isn't put in financial accounts, and all of the money is spent on exempt or instantly consumed assets, it may be impracticable to collect the money judgment. Many people are "judgment proof."
Comment: @Dan Income cannot be imputed in proceedings to enforce a money judgment. Period. Full stop. The first three paragraphs of the answer make that clear.
Comment: @Dan The tax consequences of income have nothing to do with garnishment. Garnishment is based solely upon what a person owes to the judgment debtor with no further analysis. The 1099 has nothing to do with what can and cannot be garnished.
Comment: This doesnt answer. What if the contractor uses tax writeoffs for the income in the clubs possesion but has cash for rest? Cant the cash be imputed to ignore the writeoffs?
Comment: But this is about tax writeoffs and not imputing income per se. So a debtor can simply commit tax fraud and anything not on the 1099 is ignored? Or can the written off income in fact be garnished?
Comment: The internet seems to mention disposable income being garnishable, implying business writeoffs are ignored

Can judges impute income in debt cases?


What is more important: Making a שלום בית or doing the right Judaism thing?

Question: Ex: I went to a restaurant with my family and I decided to get the chicken because that was the most kosher thing on the menu. However, my mom told me to get the steak which was not as kosher as the chicken. Should I get the chicken because it is more kosher than the steak or should I get the steak because I don't want to cause an argument with my mom?
Comment: What does "more kosher" mean? I'm not sure the term sholom bais is used for a mother. Maybe kibud eim?
Comment: I don't know if the term "shalom bayis" applies to mother son relationship. More appropriate is kibbud av veeim.
Comment: I like your questioning style @Yehuda1983 +1!
Comment: Can I suggest that you generalize this question to making it a "kashrut level" debate between a son and his parents? This is a very relevant practical question esp. with kids that "suddenly" become "more religious" than their parents and begin demanding different kashrut standards in their home, when there was nothing wrong with them, beforehand. In many cases, this causes major family problems. I know of no rav that has given a definitive solution.
Answer: The Torah writes in Parsha Kedoshim (19:3)

You shall each revere his mother and his father, and keep My sabbaths:
  I the Lord am your God.

From the juxtaposition of the two we learn that if parents ask us to transgress Torah commandments, we have to follow the Torah as an exception to the law of honoring our parents. Rashi on the spot writes

Scripture places the commandment of observing the Sabbath immediately
  after that of fearing one's father in order to suggest the following:
  "Although I admonish you regarding the fear due to your father, yet if
  he bids you: "Desecrate the Sabbath", do not listen to him" — and the
  same is the case with any of the other commandments.

Rambam codifies this as halacha (MT Mamrim 6:12). See here for more on that topic.
Many baalei teshuva have faced difficulties explaining to their parents why they cannot follow all their instructions or depart from family practice. In most cases, explaining kindly why this is not a rejection or criticism of the family but an attempt to follow God's instructions as one understands them has proven to be a successful path.
Note however that shalom bayit is a term normally used for relations between spouses, not between a child and his parents. For conflicts between respect towards parents and shalom bayit, see e.g., here on MY.
Comment: Another questionable aspect is "..if parents ask us to transgress Torah commandments". This is questionable, here, for the same reason I just mentioned. Mom isn't suggesting eating non-kosher. Is she suggesting not to abide by son's rav's opinion not to trust the other hashgacha? If so, then, I agree that then it may fit the criteria. But, if mom just says the steak hashgacha is reliable (and, in fact, it is), but it's just not son's opinion, this is a different case. OP needs to clarify some factors. The steak situation is not so "cut and dry" :-)
Comment: "not a rejection or criticism of the family but an attempt to follow God's instructions " - This is a valid, sensible reason. See my comment below Shmuel's answer. I don't think this has that much to do with obeying G-d's command, directly, as this is probably not  a kashrut issue, per se.
Comment: @DanF interesting, I read the question differently, and somehow felt both meats were non kosher but the OP felt the chicken was less of an issue than beef. All more reasons for the OP to clarify exactly what the situation was
Answer: In this scenario, where the meat is really of doubt regarding it's kosher status, biblically or rabbinically:
Consider, that a parent cannot command a child to transgress any law, even Rabbinical, because one cannot divert from the words of Torah Sages (Aruch HaShulchan סימן רמ סעיף לד).

דבר פשוט הוא שכיבוד אב ואם אינו דוחה שום מצוה. ולא מיבעיא אם אביו
  יצוה לו לעבור על דברי תורה ב"קום ועשה" או ב"שב ואל תעשה", דאסור לשמוע
  לו. כדתניא (בבא מציעא לב א): הרי שאמר לו אביו "הטמא למת" והוא כהן, או
  אל תחזיר אבידה – יכול ישמע לו? תלמוד לומר: "איש אמו ואביו תראו... אני
  ה' אלקיכם" – כולכם חייבים בכבודי. ואפילו יצוה לו לעבור על מצוה דרבנן
  אפילו ב"שב ואל תעשה", כגון שלא להדליק נר חנוכה וכיוצא בזה, דאסור לשמוע
  לו.
ולא נחתינן בזה ל"עשה דוחה לא תעשה", או על כל פנים לדחות איסור דרבנן
  מפני מצות עשה דכיבוד, דכיון דהתורה גילתה דכל שהוא נגד התורה – אין
  לאביו רשות לצוות לבנו על זה. וממילא דגם באיסור דרבנן הוה נגד התורה,
  דהקדוש ברוך הוא צוה לבלי לסור מכל אשר חכמים יגידו.

Partially copied from my answer here, see there for additional details.
Comment: "More kosher" means it has a more reliable kosher sign
Comment: Given the vagueness of what "more kosher" means (I understand the situation, somewhat, but I'd like OP to clarify), it's questionable if these rules apply. People who rely on one hashgacha over another does not necessarily halachically render something non-kosher. I know that many people disagree with that theory, but, in numerous cases, as we know, hashgachot are "politically" based, and it sometimes gets "nasty". My point, here, is that someone telling you not to rely on a specific hashgacha may be just their own bias that does not necessarily invalidate your own hashgacha reliance.
Comment: @Yehuda1983, I would strongly encourage you to edit your question to say something like "the beef didn't have as reliable a hashgasha as the chicken did"
Comment: @Yehuda1983 That was pretty much my assumption. That makes it based on a debate between mom and son as to who is correct. It doesn't appear to be an issue of kosher vs. non-kosher. In which case, I stand by my previous comment.
Comment: Both you and mbloch seem to overlook a major vagueness, here. OP needs to clarify some things. See my comments to mbloch for details. I agree with your general ruling and support source. However, it's really questionable, here, if kashrut debates fall into the category that would fit not following a rabbi's decree. BTW, this is a very relevant practical issue that severely affects numerous families esp. after a child returns from Israel yeshiva and starts "dictating" kashrut rules in his / her parent's home. It seems that no rav I know has given a definitive solution.
Comment: "More kosher" means better certified by a more reliable kosher sign
Comment: Like the OU is more reliable than the Star K


Which site answers questions on Google services?

Question: Which SE site should I ask questions about Google services, especially Gmail?
Comment: Nowadays Google services are too many. There are services for consumers, for groups, busines, enterprises, developers. Documentation entry point are diverse too: https://support.google.com, https://developers.google.com, https://cloud.google.com, just to mention some of them. Related: [Where can I ask general questions about a multi-platform app?](https://meta.stackexchange.com/q/373040/289691)
Comment: Related: [Where can I ask questions about Google (search) ranking/list order?](https://meta.stackexchange.com/q/22112/289691)
Answer: If you're asking about the Web application aspect of a Google service, most likely you're going to want Web Applications. See, for instance, questions tagged [gmail].
There are some exceptions, however.

Google Analytics is better on Webmasters ([google-analytics])
Search Engine Optimization also belongs on Webmasters ([seo])
Google Drive file sync goes on Super User ([google-drive])
Google also has a smattering of native (non-Web) apps, like Picasa. Questions about them would also go on Super User (e.g., [picasa])
Smartphone apps go on their respective sites: Android Enthusiasts, Ask Different (Apple), Windows Phone
Comment: According to the tag excerpt of [google-drive](https://superuser.com/questions/tagged/google-drive) in Super User, this tag is for a deprecated desktop client:`For questions specifically about the now-depreciated computer client for the file synchronization and cloud storage service from Google. This tag should not be used if your question is about Google Backup and Sync or Google Drive File Stream.`. For further details see [What to do with \[google-drive\] and \[google-drive-file-stream\]](https://meta.superuser.com/q/14902/152004). The Windows Phone site was archived.
Comment: Gmail is a complex service. For one side is an email service offering IMAP /POP3 / SMTP protocols, it is a cross-platform app, its a service for email administratrors, can be used by programmers / developers, etc. Questions about using the Web app *might* be on-topic in [webapps.se].


Weighted heatmap analysis- density of points, vs density of weight variable

Question: Was just wondering if anyone could help me with a problem. I'm trying to map wellbeing scores (out of 10), using locations from a survey of 15,000 households, using the HEatmap command in QGIS. It's an unclustered sample, but obviously the density of points is dependent on the population density of the area. I'm using wellbeing score as a weight in the heatmap, but unfortunately every map I produce is effectively a map of population density. I have tried multiple ways of weighting the wellbeing score to factor in the differing densities of points (so scores in areas with only a few data points are weighted, up and scores in dense areas are weighted down), but the heatmap looks effectively the same every time.
Is there any sensible way of doing this?
Thanks.
Answer: Please read How to build effective heat-maps?
It seems like you are looking for Distributions of attribute values rather than Concentration of points. Therefore, the QGIS heatmap plugin is the wrong tool for the job since it only does concentration of points.
Try Raster | Analysis | Grid (Interpolation) instead.
Another solution could be to first generate a vector grid - could be a hex grid if you like it fancy - and then calculate e.g. the average wellbeing score for each cell and map that.
Comment: For at least QGIS 3.10 and above, this command is now in the Processing Toolbox, under `Interpolation`, and is named `IDW Interpolation`.
Comment: Although, for reference, this might take a while. I have a point layer that takes about five minutes to render (normally, using the layer symbology setting) as a heatmap. The above-mentioned IDW Interpolation algorithm got 5% of the way through (with the default resolution settings) in around an hour.
Answer: I realize this post is a year old, but I came across it when looking up information on kernel density estimations with QGIS.  I've not tried this yet, but it appears from the QGIS documentation that the Heatmap Plugin can make use of the attributes of the original points via the "Use weight from field" option.
(would love to hear back from anyone with experience with this)
Comment: Welcome to GIS@SE. It appears that you are asking a question in an answer to another question? You are much more likely to get a positive response if you framed your own question specifically, or changed you answer to actually answer the original question asked with some more relevant information and examples. You could have added you response as a Comment, however, rather than an answer to see if you could get any more information.
Comment: welcome to GIS@SE. This should really be a new question or a comment.


how to convert alpha channel of the image to white color using opencv python?

Question: I want to convert PNG and GIF images to JPEG using openCV, the alpha channel should be converted to white color. is there any way to achive this ?
Comment: Your question is not clear. The alpha channel is used for the transparancy. For example, if you have (255,0,0,0), this means that the pixel is red, but totally transparent. If you have (255,0,0,255), the pixel is red and fully visible. What do you want to obtain in both case ?
Comment: note, that opencv won't support gif
Answer: in RGBA images, alpha channel represent how background will effect in image. so you have an equation (not code) like this:
out = (bg * (1 - alpha)) + (image * alpha)

where out is final image and image is R,G and B channel of our RGBA image and bg is background image. here we have 0 <= alpha <= 1.
for your case, you want your background to be a plane white image so the calculation is very simple from this point.
you can do something like this:
B, G, R, A = cv2.split(image)
alpha = A / 255

R = (255 * (1 - alpha) + R * alpha).astype(np.uint8)
G = (255 * (1 - alpha) + G * alpha).astype(np.uint8)
B = (255 * (1 - alpha) + B * alpha).astype(np.uint8)

image = cv2.merge((B, G, R))

and if you don't like this split and merge stuff (like me) you can use this implimentation:
bg = np.array([255, 255, 255])
alpha = (image[:, :, 3] / 255).reshape(image.shape[:2] + (1,))
image = ((bg * (1 - alpha)) + (image[:, :, :3] * alpha)).astype(np.uint8)

in first line i make background image, in second line i compute the alpha value between 0 and 1 and reshape it to make it 3-D array (it is necessary for multiplication) and the last line is the formula of alpha.
Answer: Using Open CV, you can open the image in RGB format, i.e, when you are doing an cv2.imread give the second parameter as 1 instead of -1. -1 opens the image in whatever be the original format of the image , i.e, it would retain the transparency. Keeping that parameter as 1 you can open it in RGB format. After that you can do an cv2.imwrite to save the RGB image without transparency. You can mention the file format as .jpg
Comment: This is not the answer to the question. The question is SPECIFICALLY asking how to do it in OpenCV.
Comment: If you see, there is a solution in Open CV too


How much Pag oil should be added after recharging refrigerant?

Question: I have a 2003 Citroen c5 which I bought last year, the A/c system has been empty for refrigerant since before I bought it. I have purchased the necessary equipment to vacuum, and recharge the system. in the manual, it says that the system takes 135ml of compressor oil. I assume most of this is still in the compressor.
how much oil should be added when adding refrigerant?
I am also changing the receiver drier.
Answer: It depends. If the refrigerant was lost with a slow leak, then most of the oil may still be in the system ("most" because you would have lost some changing the components out). If the leak was larger, some oil may have escaped.
Without fully draining and recharging the system, it's going to be a guess.
That said, unless there's evidence of refrigerant oil that leaked out, I normally will assume that the oil is still in the system and just top it off based on the components removed. Sometimes it's not practical to fully drain a system, especially an older one where a lot of connections would need to be disturbed. If you don't add enough oil, the system is obviously at risk. If you add too much within a reasonable amount the oil normally just collects in the accumulator. However, any extra oil displaces usable refrigerant, so it would reduce the cooling capacity of the system.
Answer: You should evacuate the system, then establish a depression on it and leave it to find any leaks.
If there are no leaks then the manufacturer will state the amount of refrigerant and oil to be added.
You stated in your question that it requires 135ml, so remove any oil still in the system then add that amount.
The systems used by both my garages (one in UK, the other in CH) will control all parameters, oil, refrigerant and test accordingly.
Comment: i was planning to put a vacuum on it and let it sit for 30 minutes or so to see if it keeps the vacuum. if there isn't any leaks is it then neccessary to add compressor oil when recharging ?
Comment: removing all the oil would mean I have to remove the compressor to drain and fill it.. that seems a little unnecessary if you ask me.
Comment: When the vacuum is pulled the oil vaporises so it gets extracted, well that is what happens with the proper gear as used by both my garages, and the system reports the volumes of refrigerant and oil removed. So when I last had my system checked and tested I received a printout if the amounts removed and the amounts refilled - paid for any extra needed to bring it up to spec. So since you say you bought the proper gear you should be ok.
Comment: i am pretty sure the oil in the compressor won't evaporate just by pulling a vacuum on the high and low side, som might get pulled out that is in the hoses but the majority will still be in the compressor, at least that is my understanding. I have read around a bit and think that only a small amount lost in refrigerant should be added.


What is the difference between a combinator and function chaining?

Question: So from what I've read about combinators I can't quite tell how they're different from simply chaining function calls.  I know I must be missing something but I'm not figuring out what I'm missing.  I mean would g(f(x)) (where f and g are functions) effectively be a combinator if I gave it a different name?
Comment: Very helpful explanation of combinators:  http://stackoverflow.com/a/7534575/894284
Comment: @MattFenwick as always, McCann knows this stuff *way* better than me, and can explain it more clearly as well.
Comment: I thought about checking over on StackOverflow but this seemed more a "Programmers" type of question.  Guess I should have trusted my instinct.
Comment: @OnorioCatenacci This really is a better fit here; we just have a smaller community so there's less of these questions here and as such less McCann visits here less frequently, and I don't know that I've ever seen Kmett or Don Stewart answer anything here, though they all answer tons over there. You will get better results asking these questions on SO even though they're a better fit for P.SE's scope.
Comment: http://stackoverflow.com/questions/97637/good-explanation-of-combinators-for-non-mathematicians
Answer: Function chaining is known as function composition in the functional world.
A combinator however is a completely different thing, the composition operator is simply one combinator.
I wrote a blog attempting to explain combinators here it may help.
In it I try to explain a combinator is simply a function that follows a few rules in the general case, but in the common case "combinator" is used to refer to a function which abstracts a bit of common functionality that is very basic in form.
in SKI combinator calculus there are 3 combinators:
Kxy = x
Sxyz = xz(yz)
Ix = x
These are combinators because they act only upon their terms, and they are generalized to not care what their terms are.
This seems useless but realize I can be defined in terms of S and K:
SKKx = Kx(Kx) = x which is equivalent to Ix which = x, the benefit to combinators is they are fully generalized to whatever terms you pass them and therefore live at a higher level abstraction than other things.
The composition combinator is the B combinator from the B,C,K,W combinator system
Now to make combinators useful however, you have to understand when fully generalized functions like this are worth creating. Parsers are the perfect and most common example, because a parser as a concept has to deal with an extremely large number of possible inputs, therefore the ability to generalize the handling of their inputs comes in very handy.
Comment: Thanks Jimmy--will read this over when I have a bit more free time


What are requirements of Key Usage extension of parent and child certificates?

Question: This question is about validating certificates. Imagine some machine gets a leaf certificate (i.e. a certificate signed by the certificate of some CA) with specific Key Usage attributes.
Example #1: Should the machine reject the certificate if the parent certificate does not include the keyCertSign bit in Key Usage?
Example #2: Is the child Key Usage required to be a subset of parent Key Usage? Or is the child allowed to have specific Key Usage bits that are not in the parent cert?
Answer: https://www.rfc-editor.org/rfc/rfc5280.html#section-188.8.131.52 has this to say:

If the keyUsage extension is present, then the subject public key
MUST NOT be used to verify signatures on certificates or CRLs unless
the corresponding keyCertSign or cRLSign bit is set.  If the subject
public key is only to be used for verifying signatures on
certificates and/or CRLs, then the digitalSignature and
nonRepudiation bits SHOULD NOT be set.  However, the digitalSignature
and/or nonRepudiation bits MAY be set in addition to the keyCertSign
and/or cRLSign bits if the subject public key is to be used to verify
signatures on certificates and/or CRLs as well as other objects.

So the expectation is that a CA's KeyUsage will assert { keyCertSign | cRLSign } without asserting digitalSignature.  And the end-entity/leaf cert will of course want to assert digitalSignature, therefore there's no expectation of subsetting.


How do undergraduate theses affect master's application?

Question: I am an undergraduate student and have a plan to apply to a master's program.
I am about to start to work on my graduation thesis for graduation at my university.
Question: How does my graduation thesis will affect applying to master's program?
Comment: This may depend on your situation.  What country and field?
Comment: @Kimball Europe, probably Germany, math.
Answer: It has, typically, no harmful effect.
In most cases, you will declare the title of the thesis within your CV, or upon request of either potential supervisor or admission committee. Furthermore, as your current advisor would, supposedly, be among your referenvces, she might talk about it within addressing your applied effort onto the thesis progression, probablely.
As you notice, required pointers to the thesis will be taken into account, even without its completion, within your application.
Good luck


Aligning images with align_image_stack utility

Question: For a school project, I am capturing images from two cameras mounted side by side, one NIR and one RGB. Basically I want to make a simple multispectral camera so I need to align the two images on top of each other. The camera's are closely mounted but of course they have slightly different reference points so the images need alignment in post processing. Currently I am doing that using Photoshop's Edit→Auto-Align Layers function which works perfectly but I want an open source solution. I discovered the utility align_image_stack that seems to be want I need but when I run it on two images they are not very well aligned. I've tried setting the -c option higher (200) and -g option with no better luck. Does anyone have some pointers or maybe another tool I should try?
Comment: What are you capturing? That is, is your subject far away (like stars), or is your subject somewhat near (within the room)?
Answer: Depending on what you're focusing on (how close the subjects are from the cameras), you're experiencing the unavoidable effects of parallax due to capturing images from two different perspectives.
In photography, perspective is the conceptual point of view of the camera — the actual position of the entrance pupil (apparent location of the iris or aperture) of the camera's lens. By having two separate cameras side-by-side, you're creating a stereoscopic imaging system. Normally, stereoscopic imaging systems use two identical cameras side-by-side, in order to create 3-dimensional image information, much like a human or animal's two eyes create 3D image space.
In your case, one of your systems "eyes" is an RGB sensor, and the other "eye" is a NIR sensor. Let's say the RGB camera is the left "eye", and the NIR is the right "eye". In that case, imagine closing or covering your right eye. The left eye will see RGB data from its perspective or point of view. When you switch eyes and only look through the right "eye", you can only see NIR data, and only from the perspective of where the right eye is.
If your subject is very far away (i.e., several orders of magnitude further away compared to the distance between the left and right "eyes" of the imaging system), then the parallax distortion is minimal, possibly even negligible or imperceptible. For instance, it doesn't matter if you look at the night sky with both eyes or just with a single eye — the planets and stars are far enough away, that the parallax error between the human eyes (~ 2.5" / 6.5 cm) will not show a difference between the left and right eyes.
However, if the subject is close enough that no matter how you overlay the two images that you can't get them to align correctly, then you are in the parallax error regime. Hold your phone about 10 cm / 2' from your face. Without moving your head, look at it with your left eye while closing the right. Then swap eyes, closing the left eye and look with your right. Keep swapping back and forth, while focusing on the phone. Notice how the background keeps jumping each time you swap your eyes. This is parallax error in the near regime. This is the error you are seeing when using side-by-side cameras.
There is nothing you can do to "fix" parallax error, without "fudging" or editing the image data. In essence, you can massage the data to make a closest fit, but your are literally lying about the data in order to fit the system. This comes down to the fact that the entrance pupils of the lens used for each image were at different points in space. Two objects cannot occupy the same space at the same time.


Are ResNets used for something else than image recognition?

Question: ResNets are widely used for image recognition tasks.
I wonder, are there any other application areas where they proved to be also very efficient?
Answer: Resnets are neural network architecture which makes use of the Identity Connection, which helps to protect the network from vanishing gradient problem. They are used to make the deep networks more efficient. Regarding their use case, they can be used for speech recognition, audio classification, video categorisation/classification and in conjuction with other models LSTMs to solve other use cases.


Upload large file via HTML form aborts at 20 seconds on AWS EC2 (ERR_CONNECTION_ABORTED)

Question: I'm trying to use a standard HTML form with a file type input element. This form works fine on small files, but if the upload process takes longer than 20 seconds, the connection is dropped and the upload ends prematurely.
The infrastructure is as follows: 1 VPC containing 1 EC2 t2.micro instance running Amazon Linux with Apache 2.4/PHP 7.3/MySQL installed, connected to 1 EFS mount, accessible through an elastic IP.
I've spent a full day yesterday and more hours today trying to get this figured out. I thought that the EC2 -> Limits was it, as it was set to 20, but that was referring to the number of instances, not the connection time limit.
php.ini directives have been set accordingly:
max_execution_time = 900
post_max_size = 1048M
upload_max_filesize = 1024M
max_input_time = -1

And yes, the code works fine on a non-AWS server. I'm testing with the most basic HTML uploader you can make:
<?php
if ($_FILES) {
 move_uploaded_file($_FILES['wtf']['tmp_name'],
 /localpath/'.basename($_FILES['wtf']['name']));
}
?>

<form method="post" enctype="multipart/form-data">
<input type="file" name="wtf">
<input type="submit">
</form>

This returns the ERR_CONNECTION_ABORTED message. Of course, this works perfectly fine for all files that upload in under the 20 second cutoff.
I've tried installing swap memory (the default Amazon Linux AMI didn't), adding a load balancer and editing the idle_timeout to 600 seconds. I've tried files of varying sizes, but it has nothing to do with the size, it's all about the time it takes to process. Without fail, it aborts at about 20 seconds every time.
I've had issues like this in the past with AWS, and at that point, it came down to "stickiness" of the ELB (load balancer). I wasn't originally using a load balancer on the EC2 instance that I was testing the code on, so when I enabled one, it appears that the Edit Stickiness option only apply to classic load balancers. The current apparently comparable setting that the load balancer provides is idle timeout (accessible from EC2 -> Load Balancers -> [select load balancer] -> Description tab -> Attibutes).

Additional tests 12 days later:
This is still an issue. I've tried so many things, but nothing has gotten this to work.
I've tried using curl to call the basic uploader provided above. I created a blank file and attempted to submit it to the form:
dd if=/dev/zero of=testfile.txt count=502400 bs=1024
curl -k -i -X POST -H "Content-Type: multipart/form-data" /
 -F "file_field=@/var/www/html/testfile.txt" /
 https://domain.tld/test_upload.php

Again, it has nothing to do with the size of the files, it's all time related. On a slow connection, I can't upload a 25 MB file, on the server directly, I can upload a 400 MB file, but it cuts off somewhere above that. Again, it always ends after 15 to 20 seconds.
I also tried uploading through localhost, and the same issue exists, so it seems to be a server configuration issue, unless there is an unknown AWS layer at play.
curl -k -i -X POST -H "Content-Type: multipart/form-data" /
 -F "file_field=@/var/www/html/testfile.txt" /
 localhost/test_upload.php

The return from $_FILES on uploads that take longer than 15/20 seconds states:
Array
(
    [name] => testfile.txt
    [type] =>
    [tmp_name] =>
    [error] => 3
    [size] => 0
)

Error code is ERR_CONNECTION_ABORTED, which lead me to look up similar issues others have had with EC2 uploads, and nothing suggested helped.
Directives I've tried in php.ini:
post_max_size = 1048M
upload_max_filesize = 1024M
memory_limit = 512M
max_input_time = 3600
max_execution_time 900
ignore_user_abort = On
upload_tmp_dir = /var/www/custom_tmp

It's been suggested that the default tmp folder might have restrictions that cause issues, but trying to change it to a different folder didn't affect it.
The memory_limit has no bearing on any of this, as mentioned by others, but I tried it anyway.
Directives I've tried in httpd.conf:
AllowOverRide = All
TimeOut 1200
KeepAlive On / Off
KeepAliveTimeout 1200

KeepAlive is for making multiple requests over the same TCP connection, so not exactly related, but either way, on or off, it had no impact.
When uploading, I watched the file in the tmp folder being written. It would continue to grow until it hit that same timeout, then it suddenly was deleted, the html form being returned that ERR_CONNECTION_ABORTED error.
I've tried putting a copy of the php.ini in the base HTML folder, no joy. I've set the Apache directives in the .htaccess file, again no change. I've tried using an HTTP connection instead of HTTPS. Nothing helps.
This is a standard Amazon Linux AMI (HVM) t2.micro instance. I don't think that it being a micro should matter, I've set up an upload server on a t1.micro before which didn't have any issues uploading large files, some differences being it was not in a VPC and it was running on AWS Classic.
Answer: I was having a similar issue with an EBS Multi-container, NLB, .NET stack. Small files (<25M) will POST just fine. Large files (up to 350MB) failed silently. There was no response at all, the API endpoint was not invoked, Postman reported a socket hangup, and CURL reported error 52.
To solve this I switch from the Network Load Balancer (NLB) to an Application Load Balancer (ALB).  I also applied the settings from this post Increasing client_max_body_size in Nginx conf on AWS Elastic Beanstalk
, but set the max to 350M. I also adding settings to increase the timeouts and buffers.  The final content section of the proxy.conf being injected was:
    content: |
       client_max_body_size    350m;
       client_body_buffer_size 128k;
       proxy_connect_timeout   360;
       proxy_send_timeout      360;
       proxy_read_timeout      360;

Comment: For my issue, I wasn't using EBS, and I also used Apache instead of Nginx. My client also put the project on hold for now, but I still wonder what was the cause. I appreciate the contribution, hopefully it will help someone.
Comment: From what I understand the configuration being changed by the .ebextensions/
proxy.config file is for the load balancer's Nginx instance.  I'm not 100% clear on this though.
Answer: We recently had the same issue as you, adding this to httpd.conf helped us:
RequestReadTimeout header=0 body=0

Answer: Setting the xpack.security.enabled: false in elasticsearch.yml has worked for me.


Minimum eigenvalue and singular value of a square matrix

Question: How to show that the relationship $\left | \lambda_{min} \right | \geq \sigma_{min}$ holds between the minimum eigenvalue and singular value of a square matrix $A \in \mathbb{C}^{n \times n}$?
Comment: I think it is worth mentioning that you implicitly order the eigenvalues by their modulus.
Answer: On one hand, if $v$ is a unit eigenvector of $A$ corresponding to the eigenvalue $\lambda_\min$, then $v^\ast A^\ast Av=\|Av\|^2=|\lambda_\min|^2$. On the other hand, $A^\ast A$ is positive semidefinite. Hence it can be unitarily diagonalised as $U^\ast DU$, where $D$ is a nonnegative diagonal matrix. The minimum diagonal entry of $D$, i.e. the minimum eigenvalue of $A^\ast A$, is equal to $\sigma_\min^2$. Therefore
$$
|\lambda_\min|^2
=v^\ast A^\ast Av
\ge\min_{\|x\|=1}x^\ast A^\ast Ax
=\min_{\|x\|=1}(Ux)^\ast D (Ux)
=\min_{\|y\|=1}y^\ast D y
=\sigma_\min^2.
$$
Comment: I like how you always give a full and concise argument, +1.
Comment: +1, this argument is nice! and should have been accepted as an answer rather than the other bookish one :).
Answer: This is related to the so called weyl-horn theorem on the relation between eigenvalues and singular values of an arbitrary matrix $A$. Let $\lambda_1,\lambda_2,\dots,\lambda_n$ be the eigenvalues, such that $|\lambda_1|>|\lambda_2|>\dots>|\lambda_n|$ (your $\lambda_{min}=\lambda_n$) and $\sigma_1,\sigma_2,...,\sigma_n$ (your $\sigma_{min}=\sigma_n$) be the singular values. Then
\begin{align}
&\prod_{j=1}^{k}|\lambda_j|\leq \prod_{j=1}^{k}\sigma_j~~,k=1,2,...,n-1 \\
&\prod_{j=1}^{n}|\lambda_j|= \prod_{j=1}^{n}\sigma_j \\
\end{align}
Let $a=\prod_{j=1}^{n-1}|\lambda_j|$ and $b=\prod_{j=1}^{n-1}\sigma_j$, then we have $a \leq b$ and $a|\lambda_{min}|=b\sigma_{min}$ , thus $|\lambda_{min}|\geq \sigma_{min}$
Comment: These are called Weyl's inequalities. What Horn did is that he proved that such sequences always occur as eigenvalues and singular values of some complex $n\times n$ matrix. Note: your argument requires to treat the null case separately. This being said, +1.


Create a predicate matching 2 lists

Question: I have a multilist field (Product Category).
I am getting a list of Product Category from the session.
How can i write a predicate to filter all those items which has one common category without custom field
Answer: You can loop through categories from the session and check if categories from the product contain any of them:
<code>var query = PredicateBuilder.And<ProductSearchItem>();

if (categories.Any())
{
    var categoryExpression = PredicateBuilder.False<ProductSearchItem>();

    foreach (var category in categories)
    {
        categoryExpression = categoryExpression.Or(p => p.Categories.Contains(category));
    }

    query = query.And(categoryExpression);
}
</code>
Comment: foreach (var category in categories) { var normalizedID = Sitecore.ContentSearch.Utilities.IdHelper.NormalizeGuid(category.ID); predicate = predicate.Or(x => x["categotytype_sm"].ToString().Contains(normalizedID.ToString())); }                             I did this but its not coming seems while comparing with multilist getting no value

Create a predicate matching 2 lists


What to say to co worker who ignores you?

Question: I am a new employee and I have a co worker who recently started shunning me in the break room. I walk in and she acts very quiet. This is not a problem in itself. However when other employees who are friendly with me walk in, she starts to converse with them. I joke around too however the awkward silences are becoming hard to deal with. They only do this when she is around. When she leaves they start talking to me and laughing with me like normal. How should I confront her without appearing as if I am being aggressive towards her?
Comment: Hello! Your post is a bit of a rant as of now. It's unclear to me why you'd get in trouble for talking to your coworker, or why this other person is going to "tell management" about it. Can you please elaborate? I can't really tell what the question we should be addressing is.
Comment: So you are saying that you have a problem with a co-worker, but can't go to management or the co-worker directly? How do you expect us to help you with that? If you can't communicate with the only two people who could help you out of this situation, there really isn't a solution as it stands now. If this is affecting you as much as you say, then going to management is your only hope. No job is worth being personally shunned and treated poorly.
Comment: No point trying to ask for favours. She doesn't want to talk? Well, greet her politely with a "good morning" when you come and with a "good afternoon" when you leave, and apart from that, treat her as if not present, unless she asks something from you in which you courteously help if possible, with as minimal interaction as possible. Trust me, supreme indifference will likely make the trick, and if it doesn't, you are not missing much anyway.
Comment: Why in the name of all that is civilized would you want to "confront" her? What change in everyone's behavior would you like to being about?
Comment: The edit is good in general, but you have rather made it look like none of this is at all your fault, which is not what [the original](http://workplace.stackexchange.com/revisions/86421/1) says.
Answer: Be careful.  Don't mistake work for a social club.  It is not.  You're there to make the company productive, not to make friends.  Concentrate on being the best employee you can be rather than the most popular with a woman.
On the other hand, if you suspect you have an offensive behavior, seek out your manager's advice or the advice of HR.  Explain to them that you noticed that an employee is not responding to you very well.  You're concerned that you may have a personality trait that is not conducive to work.  Ask if there is anything you should be doing to get along better with your co-workers.
Women get harassed at work on a regular basis.  Be careful you're not being misinterpreted as someone that is striking up a workplace romance.  Be professional.  Avoid dating co-workers or even giving the impression that you'd like to date them.  Focus on being productive.