Why don't we use the Voyager/Pioneer etc space probes to measure stellar parallax?

Question: With Earth based telescopes you get a max distance of 2 au between measurements.
While we have multiple space probes well over 100 AU away from us, that's a 2 OoM difference.
Comment: They don't have telescopes for resolution or precision pointing.
Comment: actuallty this https://astronomy.stackexchange.com/questions/34076/why-is-gaia-operating-around-earth-orbit-why-not-send-it-to-neptunes-orbit?rq=1
Comment: See https://astronomy.stackexchange.com/questions/39427/can-new-horizons-be-used-to-measure-the-distance-to-betelgeuse-despite-its-fick
Answer: The basic reason is that Voyager and friends have cameras optimised for imaging planets, not for doing very precise astronometry.
So why not send a telescope, like that on Gaia, into interplanetary space?  There are a number of practical reasons.  Gaia produces masses of data, and all this data needs be downloaded to Earth. Since it is close to Earth, it is practical to have a broadband link.  But interplanetary probes have very slow download rates.  For example, New Horizons took months to download all the data it recorded during its encounter with Pluto.  Gaia is powered by solar panels,  and these don't work well in the outer solar system, so you'd need an RTG, an this comes with its own set of engineering problems.
And ideally you want to record the apparent position of the each star at multiple different times and from different locations.  This helps separate the parallax motion of the star from its actual "proper" motion.  You also want to image it with the same equipment since at the ultra-precise imaging that is done by Gaia small differences in the telescope might upset the measurement. This is achieved by taking images of the stars on alternate sides of the Earth's orbit.  If you place a probe at at 10 AU (to get a order of magnitude improvement in resolution) you need to wait 16 years for the probe to get to the other side of the sun.
It's also pretty hard to get into such a wide orbit.  Escape trajectories are actually easier, but then stars that are "in front" of the probe won't show any parallax at all.
Now these are all practical issues, and at some point in the future it might be judged worth placing an astrometric telescope (or three) in a wide orbit or even having it on an escape trajectory. But the problems are not worth it at the moment.
Answer: Spacecraft such as Pioneer, Voyager or New Horizons are designed to study planets, and their cameras and telescopes to obtain good images of them, not to perform precision astrometry.
Anyway, as a "technology demonstration project" in 2020 NASA executed "The New Horizons Parallax Program", in which the New Horizons spacecraft photographed 2 stars, Proxima Centauri and Wolf-359.
Observatories and amateur astronomers around the world were asked to record both stars with their cameras at the same time as New Horizons did.
The subsequent superimposition of the image taken by New Horizons on the image taken from Earth would then allow the parallactic displacement of the observed stars to be detected, relative to the background of distant stars.
Again, this was a demonstration project intended to popularise astronomy and astronautics; the New Horizons telescope is not designed to measure parallaxes accurately, so this activity has no scientific value.
But it was demonstrated that it was possible, in the future, to design a spacecraft and place it in orbit far away from the Earth to specifically measure parallaxes by recording the same star from the spacecraft and from the Earth at the same time.
In this image below, the comparison between the image of Proxima Centauri recorded by New Horizons and the one recorded from Las Cumbres Observatory, Siding Spring, (0.4 m telescope), Australia.

And this other image is of Wolf 359 from New Horizons and from the Manner 0.6 Meter Remote/Robotic Telescope at the University of Louisville, Arizona USA.

More information can be found at:
The New Horizons Parallax Program
Seeing Stars in 3D: The New Horizons Parallax Program
New Horizons Parallax Images. Images and Formats
Note that if a spacecraft specifically dedicated to precision astrometry were launched into space, it would not be necessary to wait for it to image the same star twice at two different positions to obtain a parallactic angle. It would be sufficient to have another precision telescope on the ground recording the same star at the same time. Similar to what has been done in "The New Horizons Parallax Program".

In an instant we would have as data the distance "$r$" to the spacecraft and the angles "$A$" and "$P$". Basic trigonometry would allow us to calculate the distance to the star "$d$" immediately.
$$d=\dfrac{r \ \sin (A+P)}{\sin P}$$
If the distance "$r$" between the Earth and the spacecraft were much larger than 2 AU, the accuracy of stellar distance measurements "$d$" would be much higher than what is currently obtained from satellites like GAIA located at Lagrange-L2 Sun-Earth. In short, higher accuracy could be obtained in less time.
Best regards.
Comment: As long as the spacecraft were not heading towards the star in question.
Answer: GAIA is a very precisely spin-stabilized observatory (see wikipedia and  Gaia's scanning law) which assures that it visits every point in the sky multiple times over a year, while staying at exactly 45 degrees inclined towards the sun (to avoid light being scattered into the cameras, and it initially still had a stray light problem).
You couldn't keep your station and orientation on a interplanetary voyage without large fuel consumption - and as other answers have pointed out, the farther out you go, the longer you need the mission to be, as when you can measure the parallax is tied to your orbital period.
Without the orientation and station-keeping, Voyager-type missions can measure the parallaxes of just a few stars - not worth the effort.
Comment: Station-keeping (remaining on a specific orbit or trajectory) is not really important; as long as the spacecraft's position is *measurable.* Since parallax measurements are referenced to nearby stars in the same image and not to the absolute pointing direction, all you need for attitude control is a way to avoid blur; either by having a slow enough rate of spin relative to the frame rate, or a rate of spin matched to the clocking rate of the CCD ([à la GAIA](http://dx.doi.org/10.1051/0004-6361/201629272))
Comment: GAIA's scanning law may be important for an *all sky* survey by a spacecraft that orbits the Sun at 1 AU, but for a deep-space spacecraft like New Horizons (see  [this answer](https://astronomy.stackexchange.com/a/54043/7982) especially one on an escape trajectory with no periodic motion, you just need a measurement *every so often* (as you get further and further from the Sun), no scanning laws would be required. And of course objects anywhere near your direction of motion (or the opposite) will have low sensitivity.
Comment: @AtmosphericPrisonEscape, for long-baseline parallax measurements, you *don't* want all-sky measurements: stars in the direction of travel will have negligible parallax, so there's no point in measuring them.  You want to optimize for measuring stars perpendicular to the line of travel, where the signal is the greatest.  (To get full-sky coverage, you'd send out spacecraft in multiple directions.)
Comment: @uhoh As usual, your comments miss the point: If you go through the effort of doing parallactic measurements with an interplanetary spacecraft, you don't just want a few stars to be measured precisely. You'd want all-sky, multiple measurements to keep the error bars as low as possible.


GarageBand, iPhoto re-install?

Question: I had to have my 2011 MacBook Pro wiped out and re-installed because of malware. I noticed that my previous package--iMovie, GarageBand, and iPhoto--is not longer installed. I checked online forums and Q&A, and I was able to find iMovie under my purchases in the Apple account. However, GarageBand and iPhoto are not there/ available. I don't understand why one would be associated with my account, and the rest would not. That's odd. I'd like to see what possibility is there to have GarageBand, and iPhoto reinstalled.
Comment: What OS? Garageband went through a 'have to buy it again' point [split at the DVD/App Store boundary] & iPhoto is no longer supported, replaced by Photos.
Answer: Once you do a reinstallation wipe of a Mac all data, including apps (even Apple ones) are deleted. So, unfortunately it seems like you'll have to buy GarageBand (it came with your Mac the first time, right? You didn't buy it separately, did you?). It sounds like you can redownload iMovie, and iPhoto was replaced by Photos (free from Mac App Store).

GarageBand, iPhoto re-install?


Interpretation of negative density of states and fourth type Van Hove singularity?

Question: If I have the energy of a free electron gas in three dimensions centered at energy $E_0$,
$$E_n(k)=E_0+\frac{\hbar^2}{2}\left(\frac{k_x^2}{m_x}+\frac{k_y^2}{m_y}+\frac{k_z^2}{m_z}\right),$$
I can prove that the density of states in the Fermi level is
$$d_n(E_F)=\frac{3}{2}\frac{n}{E_F-E_0},$$
where $n$ is the number of electrons per unit volume. Now, if all the $m_i$ are negative, I would have $E_F<E_0$ and a negative density of states? Is that right? I've read that is called a van Hove singularity of the fourth type. Can anyone help me with a physical interpretation of the phenomenon?
Answer: I think you have a sign error; your numerator should be $(E_{0}-E_{F})$. Be careful in the derivation to keep track of the sign of $m$ and treating the $\delta$-function function composition rules carefully.
Then, for $E_{F} < E_{0}$, the density of states is finite and positive. For $E_{F} = E_{0}$, the DOS is infinite because of the van Hove singularity. For $E_{F} > E_{0}$ the DOS is actually zero at the Fermi energy, because the Fermi energy lies above the band (which is sloping downwards because of the negative $m$'s), and the formula no longer applies.


Relying Party - Unique Signing certificate condition in ADFS 2.1

Question: I was trying to add two RP's (Relying Party ) in ADFS 2.1 for the same customer. They use the same signing certificate in both the applications. But while updating in Windows Server 2012 / ADFS 2.1  I am receiving the below error.

MSIS7613: The signing certificate of the relying party trust is not
  unique across all relying party trusts in AD FS configuration

This was a condition imposed on ADFS 2.0 and Rollup 3 fixed (rather subdued ) this issue. I thought ADFS 2.1 included the updates in Rollup 3. But surprisingly it did not.
This post (written in Portuguese) suggests a work around which looks a bit intricate. Is there any easier way to get around this error ?
Comment: Did you find any solution for this issue?
Answer: We had the same problem. Was solved by applying this hotfix:
http://support.microsoft.com/kb/2877424


Difference between Hindu Yoga and Buddhist meditation

Question: What are difference between the Yoga practiced in Hinduism and Meditation practiced by Buddhism? Does they differ by principles and practice, or they are same?
Answer: There are many kinds of Hindu meditation methods and many kinds of Buddhist meditations too.
Tibetan Buddhism has tantric meditation with a lot of similarity to Hindu Yoga meditation, and perhaps it even borrowed from it.
So, let me restrict myself to meditation in the Theravada tradition, based on the Pali Canon.
There are two main types of techniques. One is samatha or tranquility meditation. The other is vipassana or insight. Of course, there are also other minor meditation techniques like metta bhavana and body scanning.
For samatha, it's either based on breath or kasinas. The objective is to develop deep concentration and reach jhana levels. This would be quite similar to techniques found in Hinduism. Hindu yogis have achieved this.
For vipassana, this is said to be the unique method discovered by the Buddha for understanding the relationship between mind and body, as well as understanding the nature of the mind, without the need for atman. The four noble truths and dependent origination can be realized this way. This is not in Hinduism, as far as I know.
Both samatha and vipassana are required to achieve the Buddhist liberation of Nirvana.
If you want to look at distant planets and stars, you need to adjust the telescope settings and parameters, and point it at the right direction in the sky. Samatha is like the adjustment of the telescope settings, to calibrate its zoom, focus and to make it steady. Vipassana is like the pointing of the telescope to the right subject of observation. Both are needed.
On the other hand, Hindu yoga meditation has more tantric elements like meditation on the chakras and kundalini awakening. These are not found in Theravada, but it may be found in Tibetan Buddhism/ Vajrayana.
That said, you should keep in mind that liberation in Hinduism and Buddhism mean different things.
Comment: I am surprised to your answer. You have given a clear insight to others. It's cool to see answers like this. Thanks. As a theravada buddhist, I think this should be the accepted answer.
Answer: We may all be travelling on roads (and cross each other's paths) but our goals determine where we will end up eventually. I believe it is the same for meditation practices whether it is Hindu, Taoist, Native American Indian, Catholic, Shinto or Buddhist.
So, what is the goal of Yoga practice? Is it Kaivalya or Moksha? Are they the same? Even Moksha seems to have slightly different meanings in various schools of Hinduism. Is it union with Brahman? Liberation from life and death i.e. rebirth? A state of perfection?
I am not a Hindu so I am not familiar with the concept of Moksha other than what I had read on the Internet. For Buddhists, the goal of meditation can be answered by following the Buddha's own struggles and experiences in meditation. He started by learning meditation from Alara Kalama then Uddaka Rāmaputta but left both teachers because he could not find what he was searching for. Eventually, he came upon the meditation practice that would allow him to attain liberation from suffering i.e. Nirvana.

I recall once, when my father the Sakyan was working, and I was sitting in the cool shade of a rose-apple tree, then—quite secluded from sensuality, secluded from unskillful qualities—I entered & remained in the first jhāna: rapture & pleasure born of seclusion, accompanied by directed thought & evaluation. Could that be the path to awakening?

So, if your goal as a yogi is the same as the Buddha, then the meditation principle and practice would be the same.
Comment: We could try to find a new road that leads to the same place where the Buddha discovered. Alternatively, we could simply follow the path taken by the Buddha. ;-)


Normal Cuda Vs CuBLAS?

Question: Just of curiosity. CuBLAS is a library for basic matrix computations. But these computations, in general, can also be written in normal Cuda code easily, without using CuBLAS. So what is the major difference between the CuBLAS library and your own Cuda program for the matrix computations?
Comment: Is it similar to the relationship between normal C code and the BLAS library on CPU, which does the compiler level optimization? But GPU is intrinsically multi-threaded, so the situation may not quite like those on CPU. Say a matrix addition.
Answer: We highly recommend developers use cuBLAS (or cuFFT, cuRAND, cuSPARSE, thrust, NPP) when suitable for many reasons:

We validate correctness across every supported hardware platform, including those which we know are coming up but which maybe haven't been released yet.  For complex routines, it is entirely possible to have bugs which show up on one architecture (or even one chip) but not on others.  This can even happen with changes to the compiler, the runtime, etc.
We test our libraries for performance regressions across the same wide range of platforms.
We can fix bugs in our code if you find them.  Hard for us to do this with your code :)
We are always looking for which reusable and useful bits of functionality can be pulled into a library - this saves you a ton of development time, and makes your code easier to read by coding to a higher level API.

Honestly, at this point, I can probably count on one hand the number of developers out there who actually implement their own dense linear algebra routines rather than calling cuBLAS.  It's a good exercise when you're learning CUDA, but for production code it's usually best to use a library.
(Disclosure: I run the CUDA Library team)
Comment: Then please provide the source code or else it is very time-consuming if something goes wrong due to a bug in cuBLAS
Comment: Also, cuBLAS functions are no longer launchanble from kernels (starting from cuda 10.0)? It's a lot less useful then. [link to forum post](https://devtalk.nvidia.com/default/topic/1046849/cuda-programming-and-performance/cublas-call-from-kernel-in-cuda-10-0/)
Comment: According to a talk on GTC Spring 2021 https://www.nvidia.com/en-us/on-demand/session/gtcspring21-s31754/ (free access, but account registration required), cuBLASDx, a cuBLAS version which can be fused with custom kernels is upcoming in the future. There are already respective releases for cuFFT und cuSOLVER.
Comment: What are you afraid about ? Open source the code and keep the copyright. That's what would move the usage forward. Any serious competitor can easily reverse engineer it anyway, so why not make the proper step and provide it open and not closed.
Comment: @John that's not open source, that's source-available which is nowhere near the same thing
Answer: There's several reasons you'd chose to use a library instead of writing your own implementation. Three, off the top of my head:

You don't have to write it. Why do work when somebody else has done it for you?
It will be optimised. NVIDIA supported libraries such as cuBLAS are likely to be optimised for all current GPU generations, and later releases will be optimised for later generations. While most BLAS operations may seem fairly simple to implement, to get peak performance you have to optimise for hardware (this is not unique to GPUs). A simple implementation of SGEMM, for example, may be many times slower than an optimised version.
They tend to work. There's probably less chance you'll run up against a bug in a library then you'll create a bug in your own implementation which bites you when you change some parameter or other in the future.

The above isn't just relevent to cuBLAS: if you have a method that's in a well supported library you'll probably save a lot of time and gain a lot of performance using it relative to using your own implementation.
Comment: +1, but as for point 3, hunting down bugs in libraries can turn out pretty ugly and it happens... occasionally. Also may be worth mentioning that in case of somehow specific problems you can always write some "custom tailored" code which will perform better in your case.

Normal Cuda Vs CuBLAS?


Overwrite Abstract class

Question: I am not able to overwrite the reorder.php file which is an abstract class. Anyone can help whether I have use di.xml or any other method.
Answer: As per The architecture followed by Magento, We can not rewrite any Abstract class.
Rewriting a class means, instantiate the new class instead of old class. Since an abstract class is never instantiated, it can never be rewritten.
To solve this issue, you can check for the actual class that is extending the abstract class. Rewrite the child class and override any property in your newly created class.
For example, suppose a class named A extends an abstract class B and defined any function/property here in A. you can rewrite the class A with C and override function/property in your class C.
This is how you can achieve your goal.
Answer: By design you can't overwrite an abstract class. Abstract classes are loaded because they are extended from by the classes themselves and not handled through the Magento DI handler.
Overwrite the classes that extend from the abstract class instead.
Because I was curious if my statement above was 100% correct I went and took a look at the code. Near as I can tell Magento makes it impossible to load a file from anywhere besides the defined directories. It looks at generated/code/ first, then vendor/ and then finally app/code/.
If you really want to do this:
in app/bootstrap.php find:
// Sets default autoload mappings, may be overridden in Bootstrap::create
\Magento\Framework\App\Bootstrap::populateAutoloader(BP, []);

Right after it, add this:
// custom autoloader to prepend the regular autoloading for local overrides
spl_autoload_register(function($class) {

    $localCodePool = BP.'/app/code/';
    $file = str_replace('\\', '/', $class);
    $path = $localCodePool.$file.'.php';

    if (file_exists($path)) {
        require_once $path;
    }

}, true, true);

That adds a custom autoloader that gets called before the existing autoloaders and will look for a local version of the file in app/code/. Again, I believe this to be a bad idea.
If the bootstrap file is ever updated, you lose the autoloader and you need to keep the local versions of the classes up to date with updates done through composer.
Comment: Hi, Thank you for your replay. I want to know how to overwrite abstract class. One small example

Overwrite Abstract class


How to better structure a big scrum team?

Question: I have joined a start up company as a PM/ scrum master which had 3 scrum teams with different domain specialty 1-FW/cloud, 2- machine learning, and 3- front end( UX/ UI/ dev/QA) on one backlog. The scrum teams where shaped based on their specialty not cross functionally. Each team has 6 to 9 member means the total of people on these scrum teams are 20. We can't have a one scrum team with 20 people. All these people are working on one product. I have set up the sprint planning with all 20 people together and that solved part of cross dependencies I also set up a product meeting weekly with the leads of each team to review our product milestones. During the sprint teams seem to work separately.
How could I solve this issue? I am thinking about scrum of scrum meeting but it means more and more meeting for teams that are already executing an aggressive schedule. Any suggestion?
Comment: Excuse me, but why *can't* you have a Scrum team of 20? Is it larger than normal or recommended, but that doesn't mean it's not the logical place to start.
Comment: Are they working from a single backlog, and then integrating? How is the work related between teams?
Comment: @RubberDuck Communication channels with recommended Scrum team size: 42. Channels with a team of 20 is 380! Even discounting real-life complexity, information theory, and queueing theory, that's at least 89% less efficient even on the face of it.
Comment: Yeah yeah. I get that @CodeGnome. I really do, honest. My point here is that it might be a good idea to make them one big team at first just to break down the silos and create an actual cross functional team. It would be easier to transition to small cross functional teams from the giant cross functional team.
Comment: This matrix comparison may be useful: http://www.agilescaling.org/ask-matrix.html
Answer: It's a big question with a complex answer space. My favorite framework for working in multiple teams is LeSS. Their signature book, Large Scale Scrum, is the best book about Scrum (at any scale) that I've come across.
Basically: cross-functional teams, single product backlog, single Product Owner, separate sprint backlogs, and planning and retrospective at both the single-team and overall level.
Comment: You can also check out Nexus on Scrum.org or SAFe.
Answer: Why do you want to do a single scrum with the three teams together?
Let them do their separate scrums, and afterwards do a scrum of scrums. Each team delegates one (or max 2) people for the scrum of scrums and they can discuss impediments between the teams for example. Do it also daily and it should last only 15 minutes extra
Answer: Based on what you said, I'm guessing you all experience at least a few of the following the problems:

Trouble integrating each team's work on a Sprint basis
Integration related defects
Communication lag between Scrum teams
High work in progress

The first rule of scaling Scrum is try not to scale if you don't have to. If you do start scaling development with Scrum, it's important to perform safe fail experiments. This implies you know how to measure the success or failure of whatever you try. Consider before you begin which behaviors, outcomes, or measures might be affected by whatever you try. I would start with the following:

Cycle time (Todo -> "Done")(I'm considering "Done" to mean potentially releasable)
Defects produced by new work
Scrum team member happiness
Work dependencies found
Work dependencies mitigated / eliminated

For more great info on how to manage a system based on evidence, check out Evidence Based Management from Scrum.org as well.
I really like Scrum.org's Nexus exoskeleton for scaling, but LeSS appeals to me as well; both have similar systems but Nexus has a few extra constructs I find useful. Caveat, I have been a Professional Scrum Trainer with Scrum.org.

The advantage with Nexus is the concept of a Nexus integration team which is responsible for ensuring a potentially releasable increment of the Product is fully integrated each Sprint. That said, there are some really great tools and practices you can read about in the LeSS handbook.


To teach English at the college level, is there an advantage to having a masters in English vs Education?

Question: I'm currently in my second year of teaching English at the secondary level, and I'm wondering if it's better to pursue a Master's  in English (I have a Bachelor's in English Lit.) or Education. Is there a strong advantage to one or the other in terms of professional development for teachers? I also see myself teaching at the college level someday.
Comment: A master's in education is a bogus degree, not worthy of any respect. The best reason to get one is if you're already a teacher and want a pay raise; all you have to do is sit through a bunch of zero-content graduate courses in education.
Answer: Assuming you are in the U.S., a master's degree in English may qualify you to teach at a community college (but there are enough unemployed Ph.D.s in English that the competition is tough for those with only a master's degree).  It would definitely not be enough for a regular faculty position at a four-year college, but it could be a step towards earning a Ph.D.
A master's degree in education could be a valuable credential in secondary education, depending on how your school system handles it, but it counts for nothing if you'd like to teach English at the college level.  (Furthermore, it doesn't qualify you to teach in a department of education, which would require a doctorate.)
Comment: Anonymous Mathematician is correct. If you want to teach at the university level, you're most likely going to need a PhD in English. The academic job market is extremely tough, and it's very unlikely that a master's degree will get you an interview, much less a job.
Answer: In general, college-level instructors are expected to have much more in-depth knowledge of their subject areas than someone teaching at previous levels of education. Therefore, it would seem imperative to have the strongest possible degree in the field in which one wants to teach (or a closely allied field). So, in this particular case, a degree in English would be more useful than education.
If "secondary" means "high school," the calculus changes quite a bit, as what is expected often will vary from state to state or even school district to school district. You should see if an education degree is required, or if a lower level of proficiency (such as some form of certification) is sufficient.
Answer: With regard to your professional goals, I would hazard the following:
A master of education can offer state teacher certification,  allowing one to teach in public schools and abroad.  This qualification is of utmost importance to public schools but of comparatively limited importance to private or independent schools. Nearly all public schools will consider the credentials equivalent for the purpose of pay increases, so long as both masters are regionally accredited.
In private or independent schools,  a master in discipline will generally be given substantially more weight by hiring authorities than a master of education,  unless the latter was earned at Harvard, Columbia,  or other similarly prestigious institutions.
Teaching at university (and increasingly at community college) will de - facto require a PhD,  unless you possess truly extraordinary, publicly acclaimed research or teaching experience,  or you know the hiring authorities personally and they are disposed to offer you a position typically granted to PhD recipients.
A U.S. master in English will likely not be available by distance learning and may be extremely costly to pursue without a TA, which at programs of distinction would very likely be offered to PhD students. Certain DL options from the UK exist (I reference in particular Birmingham and Wales Trinity Saint David), but unless backed by a PhD from a leading university would be unlikely to lead to university employment in the U.S. except for adjunct or non tenured roles.


modify mesh of existing model

Question: I am trying to modify an existing simple mesh but am having trouble.  It is a disk amulet with a setting ring in the center (extruded and beveled) with a "Gem" setting in the center.  Right now everything is a disk with the gem being half a sphere.  I would like to turn the setting disk and the gem into an oval shape rather than the disk shape while the outside disk stays the same.  I have imported the model and have selected the  points of the mesh that represent the setting disk but do not know how to modify the shape.  Any help would be appreciated.
Comment: With what you already have selected in the image - try turning on proportional editing (hotkey - letter O) and scale on the X axis only (S + X). You can adjust the size of the edit influence by scrolling the mouse wheel. You also may end up needing to hide some parts of the mesh you don't want to affect first. There are also different edit "shapes" that can be accessed from the proportional edit menu at the top center of the viewport (next to the snapping options), but I think the default should work for you as a start.
Answer: There are a few ways to do this.  Here's an easy one.

Deselect everything.
Select the vertex at the very top of the hemisphere
use CTRL–+ to add to the selection until you've selected all of the vertices you want to include.  (Alternatively you can use circle or lasso select.)

You'll have a selection that looks like this, roughly:

scale in the X direction to fix the X axis of the oval (shortcut SX)

scale in the Y direction to fix the Y axis of the oval (shortcut SY)

Of course, you may need to scale in only one direction to get the shape you want.

modify mesh of existing model


Can I sign in with one Apple ID for the App Store and a different ID for Apple Music?

Question: I basically want to sign in with a US Apple ID for the App Store and an Indian ID for Apple Music.
Is it possible to do that without losing all the music saved using Apple Music?
Please let me know
Answer: The "Mac App Store" accessed through "App Store.app" uses a totally seperate login system from iTunes.app, so you can use different AppleIDs for the two of them.
Within iTunes.app, I use multiple different AppleIDs to purchase iOS apps in different regions, which means I sometimes need to sign out of one AppleID and sign into a different one when switching regions and purchaseing or updating iOS apps. I have not encountered any issues when pushing these apps to my iOS devices or when running them on the iOS devices.
The Apple Music part is trickier.  According to http://www.idownloadblog.com/2015/10/04/apple-music-foreign-japan-account-in-usa/ you cannot easily have multiple regions using multiple iCloud Music Libraries, swithching AppleIDs for this purpose is limited.
As I understand things: if you want to use a different AppleID to buy some iOS apps, this should not be a problem - your current setup will not be impacted. If you want to use a different AppleID to sign into Apple Music then you will loose access to your current AppleID Apple Music stuff until you switch back.
Answer: No, Apple does not allow us to use different apple ids separately for app store and apple music, however you can use different apple ids for iCloud and app store.


Does it make sense to say a computer needs core 5 to display video from a camera (Cannon SX720HS) correctly?

Question: The video on our computer stutters or flickers. Cannon help and a computer tech told my wife that it is because our computer is 3 cores  and you need 5 cores really core i5 which is quite different of course- most core i5 are 4 cores and low ends are 3 or 2 cores. Does that make sense- why isn't it just you need more computer power or graphics power? What is requirements to show directly from the camera- wife is so cryptic?
Answer: No. That really doesn't make sense.

Faster is better, yes, but often the bottleneck is disk io.
More cores should also be better as well, to prevent other applications causing stuttering.
Faster core speed is better too.

But running video from a camera can be done on much older machines so the tech is talking nonsense.
Comment: "But running video from a camera can be done on much older machines..." not to mention the camera itself, which probably doesn't have a multicore processor.


How do I recreate this halftone gradient border?

Question: I am having an issue with figuring out how to make the halftone border on this image:

Does anyone have any idea how to do this? I'm trying to get it done for screen printing and am on a tight deadline. Please help!
Answer: (I'm pretty sure your example isn't a halftone but a texture over a gradient that looks a bit like a halftone; the image quality isn't great though and if you need this for screen printing then you do need a halftone...)
The following steps are essentially exactly the same in Illustrator & Photoshop.
Create your inner shadow as you normally would (it doesn't really matter how; I used an Inner Glow effect set to black with no blending). Importantly though, use a single ink color (i.e. for black, use 100k), otherwise you'll get a different halftone screen for each ink.

Effect → Pixelate → Color Halftone...
Comment: Thank you for your help! When I halftone in Illustrator, all the dots look like blocks. Any way to fix that because it is important that they are dots. Thank you again!
Comment: Hmm not sure, they should be dots! Maybe a resolution issue? Try increasing the effects resolution (Effect → Document Raster Effect Settings...)
Answer: This needs 3 layers + the background. Bottom layer (not the Background) is color and text. Text can be a little blurred and then have an unsharp mask to avoid too clinical outlook

In the middle layer there's texture. It's fully desaturated greyshade, masked off in the middle with a gradient and combined as hard ligt. The texture can be a real photo of canvas - not exactly clinically uniform, like the effects. I haven't it, so I inserted some skething brushstrokes from the filter gallery
On the top is the shade. Again BW and hard light. Glow effect was not satisfactory because the effect is deeper in left and right. This is a black fill from where a piece was cutted off to have a black elliptical ring that is little thicker at left and right. That ring was blurred and then deleted the exessive parts of the blur outside the plate area. The edge seems too round without sharpening. An unsharp mask corrects the roundness.
Answer: Although it is possible to visually create the actual half-tone dots in the artwork file itself for screen printing, as posted in the answer from @Cai. It is seriously frowned upon and not recommended.  The screen printing company must follow a certain formula for producing and printing half tones successfully. The main reason it is done this way is because the screen mesh used for the screen-printing... The thread count of the screen mesh (threads per inch) can interfere with the half tone pattern and create something what is called a moire pattern.  In this image, you will see a moire pattern on the left side which is what the half tone printed with that undesirable pattern would look like and the right side of the image is what you would want the printed halftone to look like on the shirts.

There is only one way to avoid this Moire pattern in the final screen-print.  The screen printing company must take the thread count of the mash (and just for an example we will use 156 mesh) and divide that number by 4.5 (personally I prefer 4.73 but the number 4.5 is a good starting point), which will then give us the number 34.6.  That number 34.6 will be the value for the lpi frequency (lines per inch) which needs to be set up in the separation set up in the output sub menu of the print dialog window in Illustrator.  In other words, it is the process of printing the actual separations for the screens, that will produce how large or small the halftone will print on the shirts.
So basically, to create halftones for screen printing in Illustrator, all colors should be created in the document as spot colors and what ever is meant to be half toned will be given just a percentage of what the solid spot color would be.  In this next image the left rectangle is color 100% red and the right rectangle would be 50% half tone of red


How to restrict access of a file from python

Question: So I made a python phonebook program which allows the user to add contacts, change contact info, delete contacts, etc. and write this data to a text file which I can read from every time the program is opened again and get existing contact data. However, in my program, I write to the text file in a very specific manner so I know what the format is and I can set it up to be read very easily. Since it is all formatted in a very specific manner, I want to prevent the user from opening the file and accidentally messing the data up with even just a simple space. How can I do this?
Comment: Or, you could document the file format so the user could edit the file intelligently.
Comment: In which way the user would open the file? You have to know how your "enemy" would break in, before you can take measure to prevent it.
Answer:
I want to prevent the user from opening the file and accidentally messing the data up...

I will advise you not to prevent users from accessing their own files. Messing with file permissions might result in some rogue files that the user won't be able to get rid of. Trust your user. If they delete or edit a sensitive file, it is their fault. Think of it this way - you have plenty of software installed on your own computer, but how often do you open them in an editor and make some damaging changes? Even if you do edit these files, does the application developer prevent you from doing so?
If you do intent to allow users to change/modify that file give them a good documentation on how to do it. This is the most apt thing to do. Also, make a backup file during run-time (see tempfile below) as an added layer of safety. Backups are almost always a good idea.
However, you can take some precautions to hide that data, so that users can't accidentally open them in an editor by double-clicking on it. There are plenty of options to do this including

Creating a binary file in a custom format
Zipping the text file using zipfile module.
Using tempfile module to create a temporary file, and zipping it using the previous option. (easy to discard if no changes needs to be saved)
Encryption

Everything from here on is not about preventing access, but about hiding the contents of your file

Note that all the above options doesn't have to be mutually exclusive. The advantages of using a zip file is that it will save some space, and it is not easy to read and edit in a text editor (binary data). It can be easily manipulated in your Python Script:
with ZipFile('spam.zip') as myzip:
    with myzip.open('eggs.txt') as myfile:
        print(myfile.read())

It is as simple as that! A temp file on the other hand, is a volatile (delete=True/False) file and can be discarded once you are done with it. You can easily copy its contents to another file or zip it before you close it as mentioned above.
with open tempfile.NamedTemporaryFile() as temp:
    temp.write(b"Binary Data")

Again, another easy process. However, you must zip or encrypt it to achieve the final result. Now, moving on to encryption. The easiest way is an XOR cipher. Since we are simply trying to prevent 'readability' and not concerned about security, you can do the following:
recommended solution (XOR cipher):
from itertools import cycle

def xorcize(data, key):
    """Return a string of xor mutated data."""
    return "".join(chr(ord(a)^ord(b)) for a, b in zip(data, cycle(key)))

data = "Something came in the mail today"
key = "Deez Nuts"

encdata = xorcize(data, key)
decdata = xorcize(encdata, key)

print(data, encdata, decdata, sep="\n")

Notice how small that function is? It is quite convenient to include it in any of your scripts. All your data can be encrypted before writing them to a file, and save it using a file extension such as ".dat" or ".contacts" or any custom name you choose. Make sure it is not opened in an editor by default (such as ".txt", ".nfo").
Answer: It is difficult to prevent user access to your data storage completely. However, you can either make it more difficult for the user to access your data or actually make it easier not to break it. In the second case, your intention would be to make it clear to the user what the rules are hope that not destroying the data is in the user's own best interest. Some examples:

Using a well established, human-readable serialization format, e.g. JSON. This is often the best solution as it actually allows an experienced user to easily inspect the data, or even modify it. Inexperienced users are unlikely to mess with the data anyways, and an experienced user knowing the format will follow the rules. At the same time, your parser will detect inconsistencies in the file structure.
Using a non-human readable, binary format, such as Pickle. Those files are likely to be left alone by the user as it is pretty clear that they are not meant to be modified outside the program.
Using a database, such as MySQL. Databases provide special protocols for data access which can be used to ensure data consistency and also make it easier to prevent unwanted access.
Answer: I think the best thing to do in your case is just to choose a new file extension for your format.
It obviously doesn't prevent editing, but it clearly states for user that it has some specific format and probably shouldn't be edited manually. And GUI won't open it by default probably (it will ask what to edit it with).
And that would be enough for any case I can imagine if what you're worrying about is user messing up their own data. I don't think you can win with user who actively tries to mess up their data. Also I doubt any program does anything more. The usual "contract" is that user's data is, well, user's so it can be destroyed by the user.
If you actually won't to prevent editing you could change permissions to forbid editing with os.chmod for example. User would still be able to lift them manually and there will be some time window when you are actually writing, so it will be neither clean nor significantly more effective. And I would expect more trouble than benefit from such a solution.
If you want to actually make it impossible for a user to read/edit a file you can run your process from a different user (or use some heavier like SELinux or other MAC mechanism) and so you could make it really impossible to damage the data (with user's permissions). But it is not worth the effort if it is only about protecting the user from the not-so-catastophic effects of being careless.
Answer: Assuming that you file format has a comment character, or can be modified to have one, add these lines to the top of your text file:
# Do not edit this file. This file was automatically generated.
# Any change, no matter how slight, may corrupt this file beyond repair.

The contact file belongs to your user, not to you. The best you can do is to inform the user. The best you can hope for is that the user will make intelligent use of your product.


Calling an Excel Add-In method from C# application or vice versa

Question: I have an Excel VBA add-in with a public method in a bas file.  This method currently creates a VB6 COM object, which exists in a running VB6 exe/vbp.  The VB6 app loads in data and then the Excel add-in method can call methods on the VB6 COM object to load the data into an existing Excel xls.  This is all currently working.
We have since converted our VB6 app to C#.
My question is:  What is the best/easiest way to mimic this behavior with the C#/.NET app?
I'm thinking I may not be able to pull the data from the .NET app into Excel from the add-in method since the .Net app needs to be running with data loaded (so no using a stand-alone C# class library).  Maybe we can, instead, push the data from .NET to Excel by accessing the VBA add-in method from the C# code?
The following is the existing VBA method accessing the VB6 app:
<code>Public Sub UpdateInDataFromApp()
   Dim wkbInData As Workbook
   Dim oFPW As Object
   Dim nMaxCols As Integer
   Dim nMaxRows As Integer
   Dim j As Integer
   Dim sName As String
   Dim nCol As Integer
   Dim nRow As Integer
   Dim sheetCnt As Integer
   Dim nDepth As Integer
   Dim sPath As String
   Dim vData As Variant
   Dim SheetRange As Range

   Set wkbInData = wkbOpen("InData.xls")

   sPath = g_sPathXLSfiles & "\"

   'Note:  the following will bring up fpw app if not already running
   Set oFPW = CreateObject("FPW.CProfilesData")

   If oFPW Is Nothing Then
      MsgBox "Unable to reference " & sApp
   Else
          .
          .
          .
      sheetCnt = wkbInData.Sheets.Count 'get number of sheets in indata workbook
      For j = 2 To sheetCnt 'set counter to loop over all sheets except the first one which is not input data fields
          With wkbInData.Worksheets(j)
             Set SheetRange = .UsedRange
          End With
          With SheetRange
             nMaxRows = .Rows.Count    'get range of sheet(j)
             nMaxCols = .Columns.Count 'get range of sheet(j)
             Range(.Cells(2, 2), .Cells(nMaxRows, nMaxCols)).ClearContents 'Clears data from data range (51 Columns)
             Range(.Cells(2, 2), .Cells(nMaxRows, nMaxCols)).ClearComments
          End With
          With oFPW 'vb6 object
             For nRow = 2 To nMaxRows ' loop through rows
                sName = SheetRange.Cells(nRow, 1) 'Field name
                vData = .vntGetSymbol(sName, 0)   'Check if vb6 app identifies the name

                nDepth = .GetInputTableDepth(sName) 'Get number of data items for this field name from vb6 app
                nMaxCols = nDepth + 2 'nDepth=0, is single data item
                For nCol = 2 To nMaxCols 'loop over deep screen fields
                   nDepth = nCol - 2     'current depth
                   vData = .vntGetSymbol(sName, nDepth) 'Get Data from vb6 app
                   If LenB(vData) > 0 And IsNumeric(vData) Then  'Check if data returned
                      SheetRange.Cells(nRow, nCol) = vData   'Poke the data in
                   Else
                      SheetRange.Cells(nRow, nCol) = vData   'Poke a zero in
                   End If

                Next 'nCol
             Next 'nRow
          End With
          Set SheetRange = Nothing
      Next 'j

  End If

  Set wkbInData = Nothing
  Set oFPW = Nothing
Exit Sub
    .
    .
    .
End Sub
</code>
Any help would be appreciated.
Answer: http://blogs.msdn.com/eric_carter/archive/2004/12/01/273127.aspx


Is Michelson-Morley experiment useless?

Question: Do you agree that any experiment  with  two-way there-and-back journeys will never show any discrepancy? Aren't all differences going to be counterbalanced, levelled in the journey back?.
Comment: I'm voting to close this question because it is not a question but a provocative statement looking for validation.
Comment: If there were an absolute reference frame for the speed of light, then the two-way round-trip times do get affected by the orientation of the MM interferometer. This is mathematically shown [here](https://en.wikipedia.org/wiki/Michelson%E2%80%93Morley_experiment#Light_path_analysis_and_consequences). The counterbalance for the backward motion doesn't completely cancel out the extra time for the forward motion. If the equations in the link aren't clear, you should consider a numerical example.
Comment: @MaximalIdeal, right, now suppose there is an aether, what would the experiment show?
Comment: Just like sound travel at different speed for upwind and downwind, they want to do the same thing for light in ether but they are surprised the result don't match the model so the only conclusion is what we know today ;D
Answer:
All differences are going to be counterbalanced, levelled in the journey back.

I think you have misunderstood the Michelson-Morley experiment. It does not attempt to measure the time that light takes to travel along one arm of the interferometer and back. Instead it shows that the difference in travel time along the two perpendicular arms of the interferometer is the same for all orientations of the interferometer. And the only way this can happen is if the speed of the aether (if it exists) relative to the experimental apparatus is zero.
This could happen to be true (by coincidence) on one day in the year. But Michelson and Morley repeated their experiment over a period of over three months. In this period, the Earth's motion in its orbit should have caused a non-zero speed relative to aether at some point in these three months. But no movement of the interference lines was observed.
Comment: Yes of course. Have you not seen the Doppeler formulae for moving sound source *and* moving air?
Comment: your example doesn't fit, because you are fighting against a force, which is alien to our issue, I suggest you consider examples of motions inside a train going at constant speed. If the aether existed such an  experiment would not show it.
Comment: @user157860 Assuming the existence of the aether, would the orbit and rotation of the Earth not mean that we are accelerating with respect to said aether?
Comment: now suppose there is an aether, what would the experiment show?
Comment: air is the aether for sound, if we send a sound from an ambulance in the direction of motion and in a normal direction and back, would the experiment show any difference in speed?
Comment: @user157860 I have amended my answer to try to make my explanation clearer. Your train analogy only holds if you carry out experiments not in a closed carriage but on an open platform that does not carry the air/aether along with it. In that case you could detect any motion of the train relative to the air. And to rule out the possibility of a wind blowing at exactly the same speed as the train, put the train on a circular track ...
Comment: Thanks, but please explain: we are on a platform and send a sound and a light in both directions, air and aether are running against us, why should the speed of light change and the the speed of sound not change?
Comment: @user157860, because the medium of sound is not aether, it is air, and that air too (assuming activities take place inside a sealed a train carriage) is moving relative to the aether.
Answer: The Michelson-Morley experiment wasn't designed to rule out aether.
It was designed to establish it, according to the terms of how the aether was then conceived. What it showed instead was that the aether could not have the properties ascribed to it at the time.
Einstein later showed that for the purpose of his theory of special relativity, it was not necessary to ascribe any properties at all to free space to explain the situation, and that it could instead be explained purely by movement in time (within a conceptual framework of spacetime).
With his theory of general relativity however, Einstein did concede a return to the postulation that free space has properties, at least concerning gravitational potential. But here gravity is conceived as causing warps in time and space itself, as part of a fundamental relation between matter and spacetime. It doesn't overturn the conceptual model of SR, but extends it further.
By that time, the main proponents of aether theory - of which HA Lorentz is regarded as the foremost - had modified their conception of the aether so as to be wholly compatible with the same evidence as was Einsteinian theory and to make the same predictions.
However, Lorentzian theory was by that time suffering a number of ideological challenges.
The first was that the Lorentzians were seen to be staggering from hypothesis to hypothesis to explain new evidence as it arose - "adjusting the auxiliary belts around the hardcore", to employ Lakatosian language. Einstein's approach had already made predictions ahead of evidence being found to support it, and was somewhat simpler to reason about (which is probably why certain implications were easier to see).
The second was that, in its final incarnation, Lorentzian theory conceded that the aether was not independently measurable, except through the effects it was postulated to explain - the same effects that Einstein did not postulate any aether at all to explain. This was a problem in an era when science was attempting to define itself purely in terms of what it can measure.
The third problem was that the Lorentzians lacked any theory to explain the full welter of relativistic effects in terms of specific mechanical interactions with the aether, which Einstein explained quite straightforwardly in terms of the relativity of time, and in terms of a fundamental link between the geometry of spacetime and gravity. The whole point of the aether in Lorentzian theory was to explain the situation in mechanical terms, so in this sense its proponents were failing even on their own terms.
In summary, Lorentzian theory suffered serious problems of credibility amongst scientists, at a crucial time when an alternative theory - Einstein's - was suffering no credibility problems at all. The Lorentzian theory was never falsified, but work on it was largely discontinued due to the philosophical objections to the unmeasurable aether, and the difficulty of seeing how it should be extended even by those who did not object to it in principle. HA Lorentz himself died in 1928, and most similar advocates of aether were of the same generation as Lorentz.
Developments in subsequent decades showed that the philosophical objections to aether had not been justified, but by that time the Lorentzian approach had already failed to reproduce committed interest amongst professional scientists, whose familiarity with it in recent times often doesn't extend far beyond believing it to be wrong.

Is Michelson-Morley experiment useless?


Is a rand from /dev/urandom secure for a login key?

Question: Lets say I want to create a cookie for a user. Would simply generating a 1024 bit string by using /dev/urandom, and checking if it already exists (looping until I get a unique one) suffice?
Should I be generating the key based on something else? Is this prone to an exploit somehow?
Comment: All this seems academic. The probability of randomly generating two identical 1024 bit messages is so absurdly low that it doesn't even bear consideration.
Comment: @DampeS8N You're assuming that repeatedly retrieving a timestamp yields a monotonically increasing value. This is far from true: the timestamp can remain constant during a fast sequence of operations, and can go backwards because the clock is reset for some reason. (Recommended reading: [Cryptography Engineering](http://www.schneier.com/book-ce.html) ch. 16.) A counter is a reliable (and fast) way of ensuring uniqueness, if you can store it in non-volatile memory. A crypto-quality (P)RNG does ensure (crypto-quality) uniqueness, no additional technique is needed.
Comment: @DampeS8N If `/dev/urandom` gives you repeats, you have a security problem that merely appending a counter won't fix. As our conversation is wandering away from the question, I suggest that we take any continuation to [chat](chat.stackexchange.com/rooms/info/151).
Comment: @Pacerier If we're the only intelligent beings in the universe, then each failure to check incurs an average of 6e9 / 2^512 = 4.5e-145 deaths. There's not even an SI suffix for a number that small. We should focus on higher risk activities, like being struck by lightning from a clear sky while skydiving on the day you win the lottery.
Comment: Checking for uniqueness is slow. A better choice is to ensure uniqueness. Append the time stamp to the string, down as far as you can. This will ensure that no two strings are ever the same, even if somehow the randomness is the same.
Comment: @Pacerier It's statistically valid to extrapolate the probability to an expected value, particularly for statistical purposes like this. If you were to hand me a revolver with 4.5e145 chambers and one bullet and offer me $1 per pull, I'd take you up on it any day.
Comment: @Gilles: Agreed. A counter is always a better choice. But it should be known that we are talking about the VERY rare time when both the randomness and the timestamp are the same. And with dev/urandom/ we are talking a once in a universe event.
Comment: @NickJohnson run the following command on any linux machine:  `cat /dev/urandom | rngtest -c 1000` several times.  IF its a vm (as many server environments are now) you'll fail FIPS compliance about every other run.
Comment: @NickJohnson, That depends on the **consequence** of a non-unique clash. If the consequence is End-Of-Universe, then yes it makes sense to check for uniqueness.
Comment: @NickJohnson, You are confusing the probability to win with the expected value. The expectation will be  4.5e-145, which is the average over many runs. But each run could well end up somewhere else, in this case: 0 * consequence or 1 * consequence. Some random people getting struck by lightning from a clear sky is less than insignificant compared to End-Of-Universe.
Comment: @NickJohnson, Not if you would live forever. You would take up the offer only and only because there's a fixed amount of time that you could live anyway and thus that life has a **limited** value. End-Of-Universe here is however assumed equal to an **unlimited** / infinite value.
Comment: @Gilles, NickJohnson, Re "academic"; Yea but not all cookies are 1024 bits. Some are only  36^16 ones. And it essentially depends fully on how many cookies he's generating.  If he's generating 700*6b*9t cookies per microsecond, and still getting exponentially *faster* with each passing microsecond, sooner or later there would be a hit.
Comment: @Pacerier Even if the consequences are end-of-universe, it doesn't make sense to check for uniqueness. It is overwhelmingly more likely that all life on Earth is destroyed by a meteor than a unique value is ever released.
Answer: The short answer is yes. The long answer is also yes. /dev/urandom yields data which is indistinguishable from true randomness, given existing technology. Getting "better" randomness than what /dev/urandom provides is meaningless, unless you are using one of the few "information theoretic" cryptographic algorithm, which is not your case (you would know it).
The man page for urandom is somewhat misleading, arguably downright wrong, when it suggests that /dev/urandom may "run out of entropy" and /dev/random should be preferred; the only instant where /dev/urandom might imply a security issue due to low entropy is during the first moments of a fresh, automated OS install; if the machine booted up to a point where it has begun having some network activity then it has gathered enough physical randomness to provide randomness of high enough quality for all practical usages (I am talking about Linux here; on FreeBSD, that momentary instant of slight weakness does not occur at all). On the other hand, /dev/random has a tendency of blocking at inopportune times, leading to very real and irksome usability issues. Or, to say it in less words: use /dev/urandom and be happy; use /dev/random and be sorry.
(Edit: this Web page explains the differences between /dev/random and /dev/urandom quite clearly.)
For the purpose of producing a "cookie": such a cookie should be such that no two users share the same cookie, and that it is computationally infeasible for anybody to "guess" the value of an existing cookie. A sequence of random bytes does that well, provided that it uses randomness of adequate quality (/dev/urandom is fine) and that it is long enough. As a rule of thumb, if you have less than 2n users (n = 33 if the whole Earth population could use your system), then a sequence of n+128 bits is wide enough; you do not even have to check for a collision with existing values: you will not see it in your lifetime. 161 bits fits in 21 bytes.
There are some tricks which are doable if you want shorter cookies and still wish to avoid looking up for collisions in your database. But this should hardly be necessary for a cookie (I assume a Web-based context). Also, remember to keep your cookies confidential (i.e. use HTTPS, and set the cookie "secure" and "HttpOnly" flags).
Comment: @Bill, that is *not* correct.  The chances of seeing repetition from `/dev/urandom`, due to high use of entropy, are essentially nil.  (To be precise, by "repetition" I mean an amount of repetition that is statistically significantly higher than expected by chance.)  There is essentially no risk that `/dev/urandom` ever "runs out" within your lifetime.
Comment: There is no contradiction (also, Schneier is merely quoting an article written by other people). The research paper worries about _recovering from an internal state compromise_, an already rotten situation. If your system was utterly compromised, you should have nuked it from orbit, rather than keeping on generating keys with it; what the article says is that _if_ you do the wrong thing (keep on using the compromised machine "as is" and pray for the best) then the PRNG used in /dev/random (and urandom) won't save your skin -- but, realistically, nothing would have.
Comment: @dog Before the CSPRNG has been seeded by enough entropy, its output will always be predictable, no matter how little data you read. Once it has been seeded with enough entropy, it will never be (practically) predictable no matter how much data you read. "Running out of entropy" isn't a thing. (CSPRNGs do have theoretical limits about how much data can be generated without a reseed, but you'll never hit them unless the CSPRNG in question sucks.)
Comment: You might want to watch the talk "Fast Internet-wide Scanning and its Security Applications" given by J. Alex Halderman at 30C3.
They did a large scan for SSH keys and basically found many duplicate keys. It turns out that many devices were embedded systems (like routers) which lack good sources of entropy (mouse, keyboard, etc.) and will usually generate the SSH key right after the boot.
They determined that for /dev/urandom there is an "entropy gap" which can take 60 seconds (!) after the system startup, during which the output is actually predictable.
Comment: On the topic of urandom "running out", you're only sort of right.  On a system with a poor entropy source (such as a VM) and a high rate of entropy use (lots of SSH connections, VPN tunnels, etc), urandom will return less random data instead of blocking.  "Less random" is a loose term, but it means that you're more likely to see repetition.  Is that a problem?  Matters on your application :)  In this case, urandom is probably fine.
Comment: What it means when /dev/urandom runs out of entropy is that it produces a more predictable randomness,  by that it means that an attacker with enough processing power can theoretically do statistical analysis of your random numbers to determine the internal state of the PRNG, and therefore predict your future random output.  This is easier said than done though.
Comment: @Thomas, Why does Schneier https://www.schneier.com/blog/archives/2013/10/insecurities_in.html contradict with your answer?
Comment: Good answer, nice coverage of the whole question including the cookie aspect. Instead of checking the random value against other random values, use a chi-square test to check the output of the generator. Fourmilab has a program [ent](http://www.fourmilab.ch/random/) which test the entropy of a generator and includes the chi-square test.
Comment: @ThomasPornin, re "begun having some network activity"; What about airgapped devices?
Comment: @D.W., re "not correct"; And which OS?
Comment: @MattNordhoff, re "its output will always be predictable"; You're missing the point. the point is that if you use `urandom` **you get insecure output** as demonstrated by J. Alex Halderman above. If you instead use `random`, it would block until it is safe so the output is secure. ¶ Context and use case would determine if something is (in)secure, In short: for some cases, use `random` and be happy; use `urandom` and be sorry.
Comment: Does this answer hold true for MacOS ? I am interested in the context of cryptocurrency wallet software that relies on OS entropy for the generation of private keys.
Comment: @Scratcha, MacOS is based on FreeBSD, so unless they changed the implementation of those two devices (`/dev/random` and `/dev/urandom`) and assuming your wallet software uses them adequately, then you're good.
Answer: Yes, it's a great way.
@Thomas's explanation nails it.  And he is completely right to criticize the /dev/urandom man page.  Spot on.
But skip "checking if it already exists".  That check is pointless.  It ain't gonna happen.  (The chances of that happening are lower than the probability of being struck by lightning -- multiple times -- in the same day.)
Comment: @Pacerier, there's not enough space in this comment to give a nuanced explanation.  Suffice it to say that the practical implications of that paper for this question are extremely limited.  See e.g. https://firstname.lastname@example.com/msg13301.html (focus on the technical content).  See also https://www.mail-archive.com/cypherpunks%40cpunks.org/msg01390.html and https://www.mail-archive.com/cypherpunks%40cpunks.org/msg01365.html.  If you want to understand better, ask a separate question on Crypto.SE.  Please don't use comments to ask questions; post a new question.
Comment: So who is right, This page or https://www.schneier.com/blog/archives/2013/10/insecurities_in.html ?
Answer: Be aware of edge-cases if you're using Linux or NetBSD.
On Linux, you'd want make sure that enough entropy has been gained after boot to properly seed the CSPRNG, or use the getrandom() system call to read from /dev/urandom and only block in the rare event that sufficient post-boot initial seed entropy is unavailable.
In NetBSD, you'd want to read from /dev/random at least once before reading from /dev/urandom to ensure it has been seeded properly.
On FreeBSD and MacOS there is no difference between /dev/random and /dev/urandom.
The short answer is still to use /dev/urandom.
See When to use /dev/random vs /dev/urandom for further details.
Answer: From http://www.linuxfromscratch.org/hints/downloads/files/entropy.txt
"Generating true entropy in a computer is fairly difficult because nothing,
outside of quantum physics, is random. The Linux kernel uses keyboard, mouse,
network, and disc activities, with a cryptographic algorithm (SHA1), to
generate data for the /dev/random device. One of the problems with this is that
the input is not constant, so the kernel entropy pool can easily become empty."
"Another problem with using the keyboard, mouse, network, and disc activity is
that on idle, unmanned, and disc-less systems there is very little, or no, input
of this kind."
To me it looks real possible that /dev/urandom will run out because /dev/random feeds it.
Comment: Did you read [Thomas's answer](http://security.stackexchange.com/a/3939/5947)? If so, why do you think it's wrong?
Comment: Your recent comments almost seem to contradict your answer.
Comment: Thomas's point seems to be that `/dev/urandom` "running out of entropy" just isn't a problem. It continues to generate random bytes by other means, but in practice that doesn't affect predictability. I don't know enough about the issues to judge whether he's correct (though what he says agrees with things I've read elsewhere). Do you have specific evidence (or solid theory) that suggests draining the entropy pool is a real problem for `/dev/urandom`? Code that actually predicts the output of `/dev/urandom` with better results than chance would be good evidence.
Comment: "/dev/urandom uses small amounts of data from /dev/random to seed a secondary entropy pool. This has the effect of inflating the real entropy so it can be conserved. Using /dev/urandom can cause /dev/random's pool to become empty, but if this happens /dev/urandom will not block, and it will continue using the last available seed. This makes /dev/urandom theoretically vulnerable to outputting repeating data, depending on the limitations of the algorithm used, but this is extremely rare and to my knowledge has never actually happened.
Comment: /dev/urandom is widely considered safe for all cryptographic purposes, except by the most paranoid people."
Comment: Yes, Keith, I did read. When /dev/random is blocked cause the entropy pool depletes then /dev/urandom provides a random bites by using the same entropy for each new request. If you don't care about prediction resistance you may use /dev/urandom as the simple to use source of random bits (it always answers, no blocking). However, if you care that an each next new key generated (as example) was based on less predictable random bits than use /dev/random and feed the entropy pool by generating a system events in a case /dev/random blocks.
Comment: I agree, that when /dev/random blocks cause of not enought entropy in the pool then we may use /dev/urandom - it continues to respond. However its outputs are based on the same entropy (run through SHA-1) and are potentially predictable if an attacker collects what /dev/urandom produces or even if he/she collects what has been generated by using the entropy obtained from /dev/urandom. All of that for the case when the entropy pool has not enough data to feed /dev/random.
Comment: "Using the last available seed" does not mean the output repeats. It is still cryptographically secure output, and will be essentially forever unless someone compromises the kernel and reads the seed out of memory.
Comment: If outputs repeats how it can be cryptographically secure? FIPS140-2 communicates that clearly.

I love being in minus with the only right answer in the thread. NIST does not accept /dev/urandom. NIST accepts only 128 bits from /dev/random (does NIST actually still accept that much?). But smarties know better.
Comment: /dev/urandom repeats outputs when no events happen on the system. /dev/random provides no outputs in this case. Thus cryptographically /dev/random is more secure.


Changes in security measures after gaining objectively big social following in a short time period?

Question: Say you have 2-step authentications with strong and different passwords and a different email for each account and say your following goes from 1k to 500k people for example in a short period of time. Do you just roll on as before in respect to your accounts' security or do you employ changes? If the latter, what should those be?
Comment: If your security techniques are lacking, then roll out improvements. Otherwise don't. Whether or not the techniques are lacking, we can't tell you without knowing more.
Answer: Standard security risk assessment model would give a tentative yes to increasing security. standard model evaluates risk as the likelihood of an incident and the cost of the incident balanced the cost of reducing the likelihood or cost of the incidence.
An increase in exposure, as measured by an increase in followers, would indicate and increased likelihood of an incident (more people know you exist, and a greater value of your account to those who would steal it -- increased quantity and quality of potential attackers). Presumably an increase from 1 to 500K followers would indicate greater revenue as well, so the cost of an incident (interruption of revenue, lost goodwill etc.) would increase as well
So you would want to balance that out as long as that was doable in a way that doesn't cost more than you're making. What options are available will depend on the platform(s) you're using and the level of control you have.


Magento 2.4.1 Showing an Error No alive node found in you cluster while running upgrade Command

Question: When I try to run upgrade and reindex Command on terminal it's showing an error No alive node found in you cluster, I am not able to set up elasticsearch Configuration on backend showing an same error. sudo command also not working it's showing an command not found. I have attached snap of the error for you reference.
Answer: It means your elasticsearch is not running. make sure elasticsearch service is started before running command.
Comment: Thanks for you reply. I facing an error as command not found on terminal, i have run the cmd on root file.
Comment: have u installed elasticsearch?
Comment: yes i have installed elasticsearch
Comment: then your server should always enabled. this error will occur if elasticsearch is not enable on your computer/server
Answer: Check Status of Elasticsearch
service elasticsearch status

if elasticsearch is status is inactive try starting using
service elasticsearch status

if you are facing issue while starting elasticsearch
vi /var/log/elasticsearch/elasticsearch.log

Comment: Thanks for you reply, I have run the command but it's showing as error on terminal bash: service: command not found
Comment: are you using on windows?
Comment: I have running the command on cpanel using Linux terminal.
Answer: After you open your terminal then
Please Try these command to start and enable elastic search.
systemctl start elasticsearch
systemctl enable elasticsearch
systemctl status elasticsearch

bin/magento setup:upgrade
bin/magento setup:di:compile
bin/magento setup:static-content:deploy -f
chmod -R 777 var pub
bin/magento c:c
bin/magento c:f

Then refresh your browser.
Let me know if you got any issues.
Comment: Thanks for you reply, when i try to run the command it's showing as systemct1 command not found error and also i run adding php before the cmd it's showing Could not open input file  systemctl, can you help me to rectify the issue.
Comment: its not systemct1 but its systemctl  where l for lion.. Please share the screenshot of error also.


What does downforce upgrade actually do to your car?

Question: "Upgraded aerodinamics give a nice downforce effect" but this doesn't cut it for me. Does it make go quicker, similar to the gearbox effect, or does it make fly less, or something else ?
Answer: It would appear that down force helps long term acceleration and grip.
I performed a very unofficial test with 0 down force and 5 or 6 levels of down force. The outcome: with the upgrades my shadow I'm accelerating faster, compared to my shadow I was testing against. Also I finally managed to go up a certain hill, and that was all due to grip, not acceleration.
Other answers welcomed though.
Answer: It pushes you down with more force and more rapidly.
This comes in handy for instance when you participate in a race with a penalty for air time. Having your car pushed to the ground makes it easier for you not to lose time.
Another scenario where I found downforce useful is in the tarmac races with many hills. Sometimes, withouth downforce, if you jump over from one hill to just a little below the top of the one that follows you just bump on it and lose your momentum. In the other hand with downforce, you can proceed a little quicker and the downforce will push you down to the valley where you'll have plenty of road to acquire speed to climb the hill.
Answer: I am pretty sure that it makes you:

Go faster down hills meaning you have more momentum for the next hill/jump

Become not as likely to fly or bounce on small bumps, and yes, get less air time.


Could deutrium oxide be used to make organic compounds with Deutrium instead of hydrogen?

Question: I am wondering for prokaryotes if Deutrium Oxide could be made into Deutrium Glucose or other biological compounds with Deutrium.
Comment: I am sorry that this is not for biology but this is not homework. I am a Freshman in High School. I am currently learning about Meiosis and Genetics. If this is not biology then what would it be? It relates to living organisms, and it ain't physics.
Comment: Homework questions are off-topic on Biology unless you have shown your attempt at an answer. For more information see our homework policy. Moreover, this question is not really about biology.
Comment: We don't mean homework just in the literal sense. For any query that you have out of interest or as a result of your academic courses, you should make an attempt at finding out the answer yourself with whatever resources that you have and can understand. Did you try simply googling this query? Your query relates to isotope exchange which I would consider a chemistry question. If your query was more about whether organisms can survive and function properly with deuteriated biomolecules, then it may be considered a biological question.
Answer: Yes, this is possible and inter alia used to clarify biosynthetic pathways.
For example in this study. Rats were given deuterated water and the average number of D atoms incorporated in cholesterol and fatty acids was determined. Also deuterium was found in plasma glucose and liver lactate and pyruvate.


Coworkers have large pocket knives, company doesn't have policy

Question: I just started with a medium sized company in Ottawa, and I noticed a lot of engineers have one-handed pocket knives. ie: The kind you can push open with one thumb. I'm not comfortable working in an office where so many people carry weapons. Assuming no laws or company policies are being broken, how should I approach this?
Comment: Your best approach is to not work in a company that has on site engineers, or warehousing/shipping. Engineers carry knives, there is nothing you can do to stop them. They are an essential everyday tool in most fields where a person regularly interacts with physical objects.
Comment: I'm quite disappointed in the downvoting of this question and the harsh tone of the answers. If a person is bothered by something, being rude to them isn't going to help.
Comment: why do you think your colleagues are going to attack you ?
Comment: FYI, this question is ancient, further commenting is unlikely to improve it.
Comment: Comments are not for extended discussion; this conversation has been [moved to chat](http://chat.stackexchange.com/rooms/29554/discussion-on-question-by-joecool-coworkers-with-large-pocket-knives).
Comment: Should this be tagged either or both [tag:security] or [tag:safety]?
Comment: @user1450877, I was attacked in the office by a coworker, it is not an unlikely scenario.
Answer: Well, I'm going to have to first address the loaded language in your post. Many people carry pocket knives solely or primarily as tools. In the case of most of Canada, save for in the wilderness, a pocketknife MUST be solely used as a tool, no matter the circumstances, or it is categorically a weapon. You seem to be conditioned into thinking knives are strictly weapons, when they are typically used as tools. In most legal jurisdictions, a tool like a pocket knife is not a weapon until it is used as a weapon, or the owner states that it is held with the intent for use as a weapon or as a weapon of opportunity.
Second, how large a knife are we talking? There are no length restrictions in most of the country, and so long as it's not a flick blade, push knife, switch blade, or balisong/butterfly-knife, it's likely legal. I am not a lawyer (IANAL), so when in doubt, consult a lawyer on this topic. Also, you would do well to learn your local knife laws:

Regulations Prescribing Certain Firearms and other Weapons, Components and Parts of Weapons, Accessories, Cartridge Magazines, Ammunition and Projectiles as Prohibited or Restricted - SOR/98-462

It sounds like your coworkers are using either thumb-loop or thumb-stud assisted openers. Most variations of these are indeed legal. Are they waving them around or duelling with them or trowing them at walls/dart-boards? That could be grounds for HR getting involved, but not if they're just opening boxes, cutting fruit, etc with them.
Thumb loop one handed opener

Large lockback models are also fairly common:

Personally, I try to avoid anything larger than 4" since that seems to be the unofficial "rule of thumb" in my locale, at least as far as the police are concerned. Also, when travelling to the US, there are states with city-specific laws. I think Seattle is a 2.9" limit, while neighbouring areas it's 3.5" or 3.4". Kinda funny there are places where you can walk around with a concealed handgun, but a tiny pocketknife is a criminal offense.
Update: Every single answer so far points out that the problem lies with you and your being conditioned to fear tools. Your best advice across the board is to either find new work, or work on de-conditioning yourself, not necessarily in that order.
Comment: +1 for Are they waving them around or duelling with them or trowing them at walls/dart-boards?
That did caught me off-guard (no pun intended).
Comment: Pockets Knives are just tool. Same as Hammers or Cars. Until someone try to crush a skull or run someone over.
Answer: If your co-workers wished you harm, they could just as easily do so with other 'innocuous' items you're conditioned to overlook (pencil, pen, scissors) while you've been conditioned to fear knives which are admittedly just as dangerous but also just as useful (if not more so) as all the other items.
I work in an IT firm as a Biz-Alyst/Proj-Mgr where I rarely need to get my hands dirty. Still, I often carry a Leatherman C33T tool (2.6' blade) to the office. It works great as a spare utensil, box cutter, envelope opener among other uses. Some of the knee-jerk reactions I initially received were much like yours -- usually from folks that spend too much time on the couch and not enough outdoors. My knife has been a common sight for so long that my co-workers no longer react and now come to me when they need one -- for legal purpose of course.
Canada's knife legislation is more than reasonable and I'd assert that whether or not you choose to carry a knife, that you respect the rights of those that do provided that we do so:
(a) For use as a tool
(b) Not in a public meeting
(c) Not for criminal purpose
(d) Not for purpose dangerous to public peace
Reasonableness comes into play here. A pair of scissors can penetrate just as deeply and be just as deadly as a knife. A knife in the hands of a law-abiding, sane, and emotionally mature co-worker should be no different in your mind than a pen or pair of scissors.
Length also plays a role. I could certainly empathize with my co-workers feeling intimidated and fearful if I were to have a Ka-Bar or SCHF9 strapped to my hip around the office. In their mind (and even mine), why would I need such a large tool and what if I a deranged co-worker were to avail themselves of such a hefty blade? Even if I had a valid reason (perhaps a friend will be picking me up after work to go camping and I needed to bring my equip to the office), in my opinion it's a bit much. Granted my co-workers would merely look at me with little more than slightly raised eyebrows but I'd rather not set a precedent and would just leave the survival knife in my backpack and use my smaller knife as my office tool.
As for your co-workers: life is never 100% certain, safe, or secure; but unless they're carrying around over-sided blades without reason, it's possible that you may be (over-)reacting out of conditioned fear.
De-condition yourself ;)
Comment: Lol, even I would look at someone with concern if they EDC a kabar or becker :)  Thanks for pointing out the parts I missed on legislation (ie: not in public meetings, public peace, etc).
Comment: Size matter, This is a [knife](https://i.stack.imgur.com/3PQ48.jpg)
Answer: The same object may be a tool or a weapon depending on context. For example, a very sharp knife with a point would be a weapon at e.g. a rather rowdy sports event. It would be a tool, suitable for paring fruits and vegetables, if found in a working chef's knife kit.
The sort of knife you describe, carried by engineers on the job, is more likely to be a tool than a weapon. Think about what should happen if, for example, a cable tie needs to be cut. Do you really want the engineer to have to go to a tool crib to get a knife, cut the tie, and take the knife back again? That would waste a lot of time.
Your best approach is to recognize the engineers' knives as practical tools rather than weapons.
Answer:
I'm not comfortable working in an office where so many people carry
  weapons.

I think in certain rural parts of the US you'll see it too. I'm sure in Texas somewhere, or out in Montana etc..  Not much you can do, since it's cultural.
Since it seems rather endemic to the work area, your best bet is to follow Joe's advice: look for a more comfortable work.
If someone you sit nearby every day carries it around, you could politely try asking them.
Comment: This is probably true of most US areas outside of huge cities. We had an interesting conversation in my last job, someone needed a knife or something, and one of the other engineers had one - which sparked a conversation about how nearly _all_ of us had some sort of pocket knife/multitool. Unofficially, of course ;)
Comment: And remember that Sikhs carry a kirpan which has a bigger blade than a pocket knife
Comment: I'm a software developer in an industrial environment. Always have a pocket knife attached to my hip.  I don't always have wire strippers or scissors for that fact in my office. So it works in a pinch for pretty much everything. Especially when doing quick wiring to in office PLC for testing. No one ever says anything, maybe I just give off the vibe I'm not a pocket knife wielding assassin.


Ultra Low Cost Telescope Project

Question: A few years or so ago there was a project that distributed small very low cost telescopes (perhaps around US$20). What was the name of (and links to) that project?
Answer: If you're interested in a low cost, but usable telescope that provides decent performance, look into the Galileoscope.
http://galileoscope.org/
It provides 50 mm (2 in) of aperture, at a focal length of 500 mm - so it's an f/10 instrument.
The kit is very easy to assemble, and instructions are provided on the Internet in great detail. Even kids can assemble it, with some supervision.
The objective lens (the primary optics) is an achromat doublet - it's made of two actual lenses combined to reduce chromatic aberration. I was impressed by the quality of that lens, at least when compared to its price - it seems to work as well as optics in instruments that cost several times more. This is one of the main reasons why I recommend this instrument to beginners.
It uses standard 1.25" eyepieces. That means you can either use the eyepieces that come with the kit, or you could borrow any 1.25" eyepiece from another telescope and just use it. This is rare in an instrument this size.
The kit gives you the option to build either a galilean eyepiece, or a 2x barlow. My advice: don't bother with the galilean eyepiece; its field is far too narrow. Instead, build the 2x barlow.
There's another eyepiece in the kit, use it either alone or combined with the barlow.
In theory, the maximum magnification is 100x, but in practice things will get a bit difficult when you push magnification much over 50% of the max value. This is typical for many telescopes.
Important: Like any telescope used for astronomy, this scope will not work well if you just hold it with your hands. You must use some kind of mount. The scope comes with a standard mounting nut that fits any tripod used for photography or astronomy. Use the sturdiest, most rigid tripod you can find. Even a very little amount of wobble will make it very difficult for you to use the scope.
Alternatively, make and use a DIY mount such as this one (results will vary depending on skill and materials used):
https://aquillam.wordpress.com/2010/01/04/a-cheap-tripod-alternative/
At the very least, support one end of the telescope on a fixed, tall object such as a fence; this will make things a little better, but it's not a replacement for a true mount.
Comment: This was exactly the item I was trying to remember. At 6 for \$180 from that site (including shipping) or twice that amount (around \$60 each) from retailers it seems to make sense to buy them in quantity and donate or give as gifts any excess quantity. eBay is an option for purchasing them as well - prices there are all over the place, though.

Ultra Low Cost Telescope Project


How to calculate explained variance of Self Organizing Map

Question: Learning SOM recent days, but getting curious how does the explained variance of SOM is calculated. All the articles I have seen ignore this topic. Can anyone give some ideas?
Answer: This is the exact same derivation as is given for the usual derivation of linear regression $R^2$ as the proportion of variance explaind by the regression. For that reason, I can see why the derivation may be omitted, if the assumption is that readers have seen the derivation earlier in their statistics studies. This approach has the disadvantage of confusing readers like the OP who perhaps do not know this derivation.
Once the proportion of variance explained is known, that can be compared to the total variance to give the explained variance. The difference between the total and explained variance would be the unexplained variance.
Unfortunately, the proportion of variance explained outside of OLS linear regression is not straightforward. Here, I derive the "proportion of variance explained" interpretation in such a situation and explain why that is a special case. Thus, I am not sold on the idea of "explained variance" in self-organizing maps, though there seems to be a convergence toward the OLS behavior (though this is for the true loss optimum, not where the parameters are when you stop training at what might be a local but not global optimum).
Answer: See Fraction of variance unexplained on Wikipedia.
Using similar notation, first calculate the total variance of the input data set. This can be called $\text{VAR}_\text{tot}$. Next, calculate the variance which is unexplained, i.e. the variance of the set of residual vectors, where a residual vector is an input vector minus the SOM node vector of its Best Matching Unit (BMU). Call this $\text{VAR}_\text{err}$.
The Fraction of Variance Unexplained (FVU) is then
$\text{FVU} = {\text{VAR}_\text{err} \over \text{VAR}_\text{tot}}$
and the Fraction of Variance Explained (FVE) is
$\text{FVE} = 1 - \text{FVU}$.
If you want an absolute value, the Variance Explained ($\text{VAR}_\text{exp}$) is simply
$\text{VAR}_\text{exp} = \text{VAR}_\text{tot} - \text{VAR}_\text{err}$.


Difference between "advance for" and "advance by"

Question: He is advanced for his years.
The visit of viru has been advanced by two days .
Answer: This sentence, "he is advanced for his years", I think it means that he is very young. Btw, advanced in age/years means that someone is old and lived for many years.
Answer: These two have quite different meanings. "He is advanced for his years" means that he is more developed in some way (such as how much he knows, his physical development etc.) than would be expected at his age. A visit being "advanced by two days" means that someone has organized for the visit to happen two days earlier than originally planned.
So in the first sense, "advanced" means developed, whereas in the second sense it means brought forward.


Invoke Ansible Playbooks From Jenkins

Question: I'm still not figure out how to invoke Invoke Ansible Playbooks From Jenkins.
My setup:
Install Jenkin -> Install Jenkin Ansible Plugin
I found a git project: https://github.com/ricardozanini/soccer-stats.git
I'want to create a jenkin job to invoke the playbook https://github.com/ricardozanini/soccer-stats/blob/master/provision/playbook.yml, but don't know how do. Which path should I put here?
Invoke Ansible Playbook
Answer: Well you already have installed the Ansible plugin on Jenkins.
Then you can call your playbook on Jenkins file or inside your job.
<code>ansiblePlaybook credentialsId: 'private_key', inventory: 'inventories/a/hosts', playbook: 'my_playbook.yml'
</code>
Source: https://wiki.jenkins.io/display/JENKINS/Ansible+Plugin
Comment: Actually I'm new to Jenkin and Ansible. Is it correct to create a jenkin job from Jenkin UI, specify Git Repository as: https://github.com/ricardozanini/soccer-stats.git and in section  Invoke Ansible Playbook, specify Playbook path as: /provision/playbook.yml ?
Comment: Basically yes... You also need to tell Jenkins about your inventory file or fill the hosts info there... after that, just run the job and it should work fine...
Comment: Thanks Kelson Silva
Comment: In this sample, I've used the pipeline parameters to set the inventory at the "-l" flag at the Ansible plugin level. You should set your environment accordingly. If you are having difficulties to set this repo, just raise an issue at the repo and I could help you more.

Invoke Ansible Playbooks From Jenkins


Only allow whitelisted IP addresses to try to connect in fail2ban

Question: My auth.log is littered with connection attempts from nasty zombies. It is really annoying. And the server doesn't even permit password logins. What I would like to do is set up fail2ban to only permit connection attempts from a specified whitelist. How would I go about this? I am guessing that this might in fact not be a job for fail2ban, if so, how would I set this up anyway, on an ubuntu server?
Answer: fail2ban just updates your firewall rules ("Generally Fail2Ban is then used to update firewall rules to reject the IP addresses for a specified amount of time, although any arbitrary other action (e.g. sending an email) could also be configured.").
It would be better to just configure your firewall manually to only allow connections to applications like SSH from certain IP addresses instead of the rule it's set to currently.
You mention Ubuntu so try reading about ufw - Uncomplicated Firewall (where the quickstart guide point #6, shows exactly the scenario you are looking to solve) other distibutions of Linux likely rely on iptables and there are other questions to achieve it with iptables.
Answer: Have you tried setting your jail to maxretry = 0?
It will ban the user from the first login attempt (good or bad) so basically will only allow whitelisted users.
Comment: I wrote this ages ago - not sure if your advice will help but sounds useful to know. Thanks for the input