History scraping - a:visited and timing attacks [1477773 for starters]

So I had initially done some research on this pref and was under the belief they fixed the issue, but I've now learned from the user.js that it's still flawed. I tried out the PoC (which I've found to be accurate) and was disappointed (though, sadly, not surprised) to see such a hole has been left exposed by Mozilla. Personally, I make heavy use of the different coloring between non-visited and visited links in my browsing, and I'd really rather not disable this pref, and considering this method is probably not commonly used I don't think I will. But I'm trying to figure out a way to defeat the method. When I learned how it works, by throwing asteroid links of different visibility, based on the css of those links, which is based on whether you've visited them, at you, I came up with an idea, and it sort of works.
If you go into options > content > fonts & colors > colors, and set it to always override the page colors, it allows you to see all the asteroids, which will make the PoC think you've visited all the sites (and actually appears to "break" the "game," since it just keeps going and going). And, of course, I would assume that if a site were displaying multiple links with only the ones related to links you've visited being visible, it would cause all of them to show, which would alert you to what's going on. The problem is that setting it to always override colors really messes sites up, mainly because you can't tell it to only override link colors, so it also applies text and background colors. Even a basic page like AMO reviews gets completely trashed.
So my next thought was using the Visited Lite script, which colors visited links your preferred color, to also color non-visited ones. After the developer told me how to do this, I tried it and, unfortunately, it didn't work. I'm not sure if it's because of how it changes the color, or maybe when (perhaps it does it too late, being a script). So I'm now wondering if there's some way, maybe through userChrome.css, to do this, which might work at a lower level and prove effective at this. I don't have any experience with userChrome.css, so hopefully someone that does and knows how to do this could give it a try and report back. Or maybe someone has another idea.
One final note: I also just tried blocking css in uMatrix, but it didn't work, either.

I don't know about the PoC (and this is just one example, there are/were other PoCs, so they may differ) - but at this stage I would assume it checks the color - default blue = not visited, anything else = visited. Hence why when you set two different colors, it's tricked into thinking you visited all of them (and likewise with no color change for visited links, at default, it thinks you visited none).
It doesn't matter, AFAIK, if you set this via FF or scripts, its the color attribute that's being read (right?). I know you're looking for a solution so you can have two colors - but I think it's more trouble than it's worth and will visually break way too many sites
The pref is not a 100% sure fix, but it does work in that PoC. The only good news I can offer (because I can tell you now, nothing more will be done - the outstanding issues are years and years old now), is that FPI (first party isolation) might handle this - i.e:

When on SiteA you click on a LinkX, the link will now be color:visited
When on SiteB, the LinX will be color:unvisited

This is still not a perfect fix, because IMO, this still allows tracking on a first party basis. And in order to defeat that (eg TC in a hardened mode), you then lose "visited" links history (I think, not sure where it's kept, probably history - TC clears history, not sure if an option or built in).
But depending on your needs, isolating visited links by 1st party, may suit you. A first party (with JS) can track mouse clicks anyway (and if you pause over links to see their URL) - have a play here - https://clickclickclick.click/ .

^^ Also: using two different colors from default might make you more fingerprintable

I would assume it checks the color - default blue = not visited, anything else = visited. Hence why when you set two different colors, it's tricked into thinking you visited all of them (and likewise with no color change for visited links, at default, it thinks you visited none).

It's impossible to tell, since the script doesn't work on it (again, I assume it's because there's a delay before the script changes the colors), but I normally have a different color for visited links than the default (using the script), because the defaults look so close together, and also I was hoping it was helping avoid some of this crap. Anyways, when changing the Firefox setting to always (vs only with high-contrast themes) use the colors, it causes the background of the game to be white instead of black and it causes all the asteroids to be visible, and they're whatever color you have set in the Firefox options. So it may be that only the exact color that's the default (dark blue, #0000EE) is hidden, or it could have something to do with the change of the background color, or a combination of them. But if the default color of unvisited/nonvisited links could be changed, it would allow that to be tested, and may provide the same result as changing the color options, but without causing such significant and destructive changes. Unfortunately, doing so with the script doesn't work, and I don't know if that's because the theory is flawed or, what seems much more likely, because of how the script changes the color. After all, if I load a page, it takes about half a second for the links to change color, due to a delay before the script is loaded and takes action. Changing the color options in Firefox causes it to happen on load, not after, and I strongly suspect that's what causes the PoC to not work. That's why I'm wondering if there's some way to change just the links colors "always" but not affect the background and text colors and whatever else that setting affects. Even changing that bit of code (or the code that determines the default coloring) in Firefox and recompiling it would at least allow for testing and, if it proves successful maybe a change to the code to add a pref to change the color could provide a means of resisting this particular method. Another thought on this: while I'd still like to try changing the color, I actually wonder if it does have to do with the change in background, since changing the color setting also causes the spaceship to disappear (which shouldn't be related to link coloring), and the asteroids all become visible even when the link colors aren't changed from the default. So maybe that's a clue to some other potential "fix."

I know you're looking for a solution so you can have two colors - but I think it's more trouble than it's worth and will visually break way too many sites

Not sure what you mean by breaking sites. They normally have two different colors for visited vs unvisited links, and using different colors than the default doesn't break them, just makes them look a bit different. The closest thing to "breakage" I've experienced with using the script to change the visited links colors is that some links that normally wouldn't change color, because they're not normal "links," per se, (like "Pull requests" and "Issues" at the top of this page, e.g., though interestingly those aren't affected) are a different color and stand out, but that's minor.

using two different colors from default might make you more fingerprintable

True, but a) I use a different visited color anyway, as explained above, and b) while I'm all for resisting fingerprinting as much as reasonably possible, I also personally believe there are so many factors that, even when we do our best, we'll still be anywhere from fairly to highly unique, and I don't want to make it harder for me to use the web (by having visited and unvisited links look similar) just to possibly reduce my uniqueness a little bit, and then still be identifiable anyways. I mean, if it were the difference between being anonymous and not, that would be one thing, but so far, it's not even close.

something for @vertigo220 to read - https://antoinevastel.com/security/privacy/2017/04/09/history-stealing.html

I've read about timing attacks before, though not quite as in-depth. Unfortunately, until Mozilla actually takes some major steps to improve things (which is highly unlikely considering many issues have existed for years), and possibly even if they finally do, since nothing is ever 100%, history is going to be able to be exploited. Considering I need it for my own use, and therefore completely disabling it isn't an option, nor is disabling the link css, the best I can do is just try to figure out workarounds to try and defeat the various attacks. Interestingly, the one on that site said I visited a few sites that I haven't, and that aren't in my history. So it seems to not be very accurate. And I didn't do anything while it ran.

Some high precision timing attacks can be unique (clock skew vs server time?), but others (like this one) only need a difference. IANAnExpert, but regards timing

there were timing  mitigations put in place for spectre
RFP does timing issues
RFP & spectre mitigations (I think) handle these timing issues at a higher (or is that lower) level so they should cover most/every scenario
in the past there have been timing leaks that no one thought of
I opened a new issue ( #457 ) on timing stuff, there are a bunch of prefs to do with timing, at least one is not in the user.js
I am watching TBB based on ESR60 to see what they do with these prefs

which is highly unlikely considering many issues have existed for years

For years Mozilla had to battle XUL. I read a comment once from a Mozilla code dude who outlined what some changes took due to breakage - it was like 18 months to 2 years to fully implement some things due to breakage. Now its much easier, and changes are taking place at a paid pace. I guess that was more for things that extensions used. And like any organization (I have not worked in large software projects, the most ever was 4 of us, and that was back in 1823), work has to prioritized, etc - some bugs block others, etc. I think Mozilla is one of the most responsive teams around.

Interestingly, the one on that site said I visited a few sites that I haven't, and that aren't in my history. So it seems to not be very accurate

Are you using RFP? Maybe it's the spectre mitigations. IDK. I linked the article cuz it was interesting. That article is very recent. Maybe I should ask the author to join in here. I have emailed Antoine and asked him to join in here
I know you want/need the visited link to be different, so I wasn't proposing it to be a solution - but I do have questions, which will be in the next post

Questions for Antoine
The article says

Moreover, whenever a script tries to access to the color of a link by using Javascript, it always returns the color associated with unvisited links. Thus, it is not possible for an attacker to distinguish between visited and unvisited urls.

Is this due to the changes in Gecko2 ( https://developer.mozilla.org/en-US/docs/Web/CSS/Privacy_and_the_:visited_selector ) or only when the user has the pref layout.css.visited_links_enabled=false ? My understanding was the changes are tied behind the pref, and the solution is not perfect
From @vertigo220

Interestingly, the one on that site said I visited a few sites that I haven't, and that aren't in my history. So it seems to not be very accurate

I haven't tried the test myself. Is this test new, devised since spectre mitigations in browsers were implemented? How accurate is it meant to be? Maybe we could also test results with/without privacy.resistFingerprinting.

@vertigo220 Just a thought .. what would a color change on hover do? i.e turn the pref=true so all links are the same color, and then script that modified a:visited links hover attributes?

Thanks for dropping by @antoinevastel  :+1: .. love your work in #458 btw

I don't currently use RFP, but have most timing prefs disabled. As for only modifying link color on hover, it would certainly be better than nothing, and would possibly be a solution if I were super paranoid about history scraping, but it would still be a substantial usability hit for me, and I worry more about this particular issue due to principal than actual concern.

Concerning your first question, it is indeed due to the link you've quoted, and not only when the user has the pref in particular.

I do not think is right. The PoC (linked in OP) accurately reveals previously visited sites when the pref is not used. When the pref is used, the PoC fails.

From our wiki

CSS History Leak 2 - http://lcamtuf.coredump.cx/yahh/

2 This test is a PoC (proof of concept). You will need layout.css.visited_links_enabled set as true. You will also need a normal window (not a Private Browsing one). The PoC only covers a handful of sites, and many of those will not "leak" as the code is checking HTTP and the site has moved to HTTPS - i.e the full URL has changed. For best results:

Open a normal window in a vanilla Firefox. Clear everything (Ctrl-Shift-Del).
Go to http://www.cnn.com/ and http://www.foxnews.com/
Go to the test page and play a game (takes 30 seconds or so)

Its an ancient PoC and I will need to go retest if any sites still exist that use HTTP

I think we need a better visited color PoC. I did some tests
SITE LIST
no change
- http://www.foxnews.com/
- https://news.ycombinator.com/
- https://twitter.com/
- https://www.bankofamerica.com/
- https://www.wellsfargo.com/

is now HTTPS
- http://en.wikipedia.org/wiki/Opossum
- http://reddit.com/r/conspiracy
- http://slashdot.org/
- http://www.amazon.com/
- http://www.bestbuy.com/
- http://www.bing.com/
- http://www.cnn.com/ - redirects to https://edition.cnn.com/
- http://www.diapers.com/ - redirects to amazon.com (HTTPS)
- http://www.ebay.com/
- http://www.facebook.com/home.php - redirects to https://www.facebook.com/login*
- http://www.mercurynews.com/
- http://www.nsa.gov/
- http://www.petfinder.com/
- http://www.pizzahut.com/ - redirects for ME to https://www.pizzahut.MYCOUNTRYTLD/
- http://www.playboy.com/
- http://www.scroogled.com/ - redirects to microsoft.com (HTTPS)
- http://www.walmart.com/

no longer exists
- http://timecube.com/

TEST 1

layout.css.visited_links_enabled=true
go to every single site in the list (exclude timecube.com)
play game
result: says I've been to every single site

TEST 2

clear all history play the game again
this was a never-nding game (got to 20,000!), I literally had 1 item in history and that was the test site itself
redo but visit a couple of non listed sites so history is bigger
play the game again and it ends very quickly
results: says I visited none of the sites

TEST 3

clear everything (ctrl-shift-del)
visit ONE site in the list, eg fox news
results: told me I had visited 9 of the sites (includes fox news) which is bollocks

TEST x

flip pref to false, visit a site, eg fox news
clear everything (ctrl-shift-del)
play game again (note with the pref at false you can't see the asteroids)
result: only told me it was game over

Conclusion: Test requires at least a history of two items. When the test lists sites visited, it always included the non-existent timecube.com, and I think the logic in the code causes other false positives. The original list of sites that don't change is down to four, and only one of those is http - foxnews.com
I know this test worked in the past, but it now seems a bit broken. Surely someone (I lack the skills) could code up a simple list of ten popular HTTPS sites and list them, and use JS code to display if the color indicates it was visited (although Antoine says this is not possible). @earthlng - you love this stuff man!

I didn't do quite as extensive testing of it, but when I tried the PoC it seemed pretty accurate for me. Like you, the game went on forever at one point, but in my case I think that was when I changed the color settings in Firefox's options, so I could see all asteroids. But running it normally seemed to be able to tell quite closely which sites I had visited. I agree though that having most of the sites as http and having a defunct site in the list certainly diminishes its use.

I still think that the pref is required to hide the a:visited attributes. For me I don't really care - since we enforce that pref in the user.js. I'm more concerned about the truth and if it still applies to you vertigo :) The test still seems to indicate that the pref is required, but Antoine seems to think otherwise. Wish we had a decent PoC
And I want the FPI to apply to visited as well, which should at least eliminate third parties and reduce the exposure for those who want a:visited colors

https://earthlng.github.io/testpages/visited_links.html

Thanks for making that, earthlng! It's not completely accurate, though. Said I've visited playboy.com (I haven't) and that I haven't visited ghacks.net and torproject.org (I have). Also, the start button is only half visible (bottom half is off the page) and the page doesn't scroll.

https://github.com/earthlng/testpages/blob/master/docs/visited_links.html
slashdot is using http .. should be https

I have no problems with the layout or scrolling etc. But the test is definitely dodgy (just to be clear that is not earthlng's fault, he just fixed the urls we use)
in a nilla profile with layout.css.visited_links_enabled;true, any three sites I visit at random from the list (I stayed away from http fox news and slashdot which I think should be https) get picked up, but so do any three others - every time

I did this three times, each time was three random sites. Didn't try four to see it told me 8 sites. Maybe theirs a flaw in the logic?
However, I did try 2 random sites, did this 3 times as well, and the game never finishes.

html code
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">

<title>visited links</title>

list of hyperlinks

https://www.amazon.com/

https://www.playboy.com/

https://www.reddit.com/r/conspiracy/

https://twitter.com/

https://theintercept.com/

https://www.rt.com/

https://edition.cnn.com/

https://www.presstv.com/

https://www.mercurynews.com/

https://en.wikipedia.org/wiki/Opossum

http://www.foxnews.com/

https://www.bing.com/

https://www.bankofamerica.com/

https://www.bestbuy.com/

https://thepiratebay.org/

https://www.ghacks.net/

http://slashdot.org/

https://www.petfinder.com/

https://www.torproject.org/

https://www.walmart.com/

https://www.ebay.com/

https://news.ycombinator.com/

https://www.wellsfargo.com/

add button here

button runs JS to evaluate link colors or

whatever it was the old PoC was trying to do

Either a new PoC or the current one, we could add the list of urls so we can see them. The pic is a nilla profile, all the links, even the HTTP slashdot one gets recognised as visited.

Just need to do the visited JS bit and the popup message

I'm not a JS junkie, but I would assume a script could cycle elements, take each a href which has text as the anchor, and extract the color. You would then get (in this test) one or two colors (depending on whether you had visited all, some or none of the links).
This is not perfect. What about hyperlinks that are not text, what about hyperlinks that are colored by css. I probably have it all wrong as how this is meant to get extracted. Would be nice to have a working PoC which we could also use to test when FPI is applied to a:visited

I get pretty accurate results. Visited 3 links and it correctly reported all 3 plus 1 that I hadn't visited.
All the asteroids come in from a similar angle and it's possible that you accidentally click on an invisible one. I could slow it down which should probably reduce the false-positives but it will take longer to finish the game.

Oh .. are you only meant to click on visible ones? I just click like a mad bastard cuz I have ADD

I'll reduce the :coffee: intake, and do some controlled refined clicking shortly and post back

OK, I did some surgeon like precision laser work - 3 tests

got 4 out of 4 but added a false-positive
got 3 out of 4 (missed fox news) but added a false-positive
got 3 out of 4 (missed fox news)

I think the fox news one might be broken (is it checking https?), and the false positives are invisible ones. Can you tweak the code so invisible ones are bright green and visible ones are bright red or something? I don't get the point of the silly game- just enumerate it :)

I played around with timing based history stealing and the results are surprising.
My script can accurately detect any page in your history if I check for it. RFP doesn't stop it or slow it down, it works across containers and layout.css.visited_links_enabled can't stop it either.
It even works in private windows but can only detect sites already in your history because history is not recorded in private windows.

Yeah I should probably report this to mozilla but they have a tendency to ignore all my reports and this might just be another one of those. TBB is not affected because they use PB-mode

@earthlng
Even when
/* 0862  */ user_pref("places.history.enabled", false);

?

@crssi nope. If there's no history there's nothing to "steal".

I don't fully understand all the underlying bits and bobs. History can be limited "per tab", but obviously it is used (internally at least) globally - no OA's - eg as seen by normal mode history being "accessible" in a brand new window. No idea if this is an easy fix. I would need someone to explain the timing thing - what event is used to get a time - some FF internal thing? A bit over my head
As for Mozilla, we've (or I've) built up a good rapport with Tom Ritter - sometimes its who you know. Not saying other earthlng reports aren't worthy, but this would be in a different bracket (assuming I know what earthlng is talking about re other reports). This one screams privacy breach.
So I would definitely get a PoC set up and alert Tom Ritter (and I can chime in as well) - or however you want to release it. I can't chime in with my connections if I don;t see the PoC or at least understand it more. You have my email.

FYI: I emailed Tom Ritter

@earthlng @Thorin-Oakenpants I thought I heard my name being mentioned somewhere on the internet....
Yea - I've been collecting bugs for 'pixel-stealing' attacks and there has been some interest in them lately. Although I can't promise any immediate action, I can promise that folks will look at it and compare/contrast it to the existing pixel-stealing bugs we know about (some of which are private).  So please do file that bug, or send me the info<EMAIL_ADDRESS>and I can file it.
We classify pixel stealing as anything that uses a side channel to learn pixels the website shouldn't be able to - whether that's history stealing or cross-origin content in a canvas/iframe.
I think the original Asteroids/user trickery issue is a hard problem. Assuming you don't customize visited links, and assuming you want visited links to show accurately on a page, how to you mitigate an attacker who tricks the user into indicating which links are visited and which ones aren't? It's an active user-tricking attack, like sophisticated clickjacking attacks.
That said, there is a bug somewhere about using First Party Isolation for coloring visited links, which would solve this: a site B wouldn't appear visited on site A unless you had followed a link from A -> B. And that would apply to containers too. But we haven't implemented that yet, I think it's probably a P3 for us right now: we want it, but we want other things more.)
Finally: if you know of history-stealing attacks in the wild by advertisers or trackers, we do want to know about those.  We would almost certainly want to add that to our Tracking Protection block-list if possible and it will lend weight to truly addressing this issue being prioritized higher.

That said, there is a bug somewhere about using First Party Isolation for coloring visited links

https://bugzilla.mozilla.org/show_bug.cgi?id=1398414

Assuming you don't customize visited links

This is one of the things I've been wondering all along. It seems like it might be pretty easy to defeat these types of tricks by adding the ability to change the color of links, making it a feature built directly into the browser. So then, as long as people knew about it and cared enough to do it (and it would be safe to assume that anyone that cared about it would know or find out about it), they could simply change it so the links are no longer, e.g., #0000FF and #009999 and instead are #0011EE and #0077AA, enough of a difference they wouldn't be susceptible to these kinds of "attacks."

@vertigo220
the timing attack works regardless of what colors you set, even matching ones

@vertigo220 If you set your own two unique custom colors, any decent attack would add fake links in order to establish which color was non-visited
@earthlng I understood your PoC to be based purely on timing, so I am not sure where Tom Ritter was heading with his pixel stealing (which to me is about grabbing colors?). Have you emailed him?
@ whoever - FPI would help mitigate the problem, but does nothing for first party external links itself - note that a first party can monitor clicks anyway.

"Pixel Stealing" is a general term we use for any technique that uses a side channel (rather than user trickery) to leak information about the user's activity the origin doesn't have permission to directly query.  (Well, I suppose side channel attacks that leak ASLR information or CPU activity wouldn't be pixel stealing, it's more about cross-origin leaks or history leaks.)
So in this case, if it's similar to other techniques I've seen, one might use a 'time it takes to render' side channel to learn if a link is one color or another.  But the specific technique is always informative and may be a specific hole we can close off (which has happened in the past.).

one might use a 'time it takes to render' side channel to learn if a link is one color or another

My understanding is that earthlng is not using colors. The PoC works with layout.css.visited_links_enabled=false . I guess we'll have to wait and see if The Big E decides to share

Your message wasn't delivered to<EMAIL_ADDRESS>because the address couldn't be found, or is unable to receive mail.
The response from the remote server was:
550 5.1.1<EMAIL_ADDRESS>Recipient address rejected: User unknown in virtual alias table

well, I tried

@earthlng : that email for Tom works for me. Are you using your *** email account (the one I know about)?

^^ .com worked

@earthlng are you sure tom @ .com is the same as tom @ .org ?

Tom edited his comment:

I typoed my own email. Fixed; sorry about that.

Good news! They landed a fix in FF63 that stops my attack if layout.css.visited_links_enabled=false.
There might be other timing methods that still work but I tried a few different variables with the method I used and can't make it work anymore.

^^

I did a search for pixel stealing a few weeks ago

884270 : Link Visitedness can be detected by redraw timing
557579 : do restyle when history lookup finishes regardless of whether links are visited

this one as well

773338 : history timing attack with href switching

and of course the FPI one

1398414 : Key :visited per origin (first-party-isolation for :visited).

nvm, the PoC still works. The only good news is that it seems disabling HW acceleration slows it down to a point where the attack is no longer really practical.

So we're currently screwed with layout.css.visited_links_enabled = false and screwed with layout.css.visited_links_enabled = true .... great!

This is limited to global history, right? The only reason I use history is so I can have a little give and take in per tab history with workflow for ONE site I administer.
Might start looking at an extension to wipe history after a domain tab close, or all history older than x minutes on a timer, or something

This is limited to global history, right?

Yeah.

Disabling high resolution timers won't stop the attack, even if it breaks the POC. One can build high res timers out of other web features.
I'm working on fuzzyfox to mitigate that, but it will be very experimental when it lands.

yup, been aware of fuzzy for a while: https://bugzilla.mozilla.org/show_bug.cgi?id=1432429
earthlng: https://bugzilla.mozilla.org/show_bug.cgi?id=1440863#c6

Hmmm, so stupid question time: privacy.resistFingerprinting.reduceTimerPrecision.microseconds currently has a value of 1000. Is this the value that determines the 100ms (I do not know what a microsecond is)? And raising it would lower entropy?
note: I have no intention of changing it, just asking
yup: I know (now) that this does not affect the PoC

https://bugzilla.mozilla.org/show_bug.cgi?id=1217238#c111

If privacy.resistFingerprinting is enabled, the precision is 100ms or the value of privacy.resistFingerprinting.reduceTimerPrecision.microseconds, whichever is larger.

following the STR in https://bugzilla.mozilla.org/show_bug.cgi?id=1217238#c107 it looks like that's still the case in my FF62

all over my head: here's another timing attack: https://blog.sheddow.xyz/css-timing-attack/ ... I will just assume Fuzzy Fox and/or RFP/Spectre timing mitigations in FF are enough.
@tomrittervg link FYI just in case there is/was no bugzilla

A microsecond 1/1000 of a millisecond:
a privacy.resistFingerprinting.reduceTimerPrecision.microseconds value of 1000 means one millisecond.
Here there's a
Reduced time precision section that explains it.
DOMHighResTimeStamp API can go down to 5 µs: a tracking heaven.

See: https://github.com/w3c/hr-time/issues/56

here's another timing attack: https://blog.sheddow.xyz/css-timing-attack/

in its current form it doesn't really work when RFP is enabled. There's a very small chance that it can get a character correct even with RFP enabled but to brute-force the full string would take way too long. There's a much higher chance that you'll have left the site again before it can get even the 2nd or 3rd char.

FYI: FuzzyFox has landed

@Thorin-Oakenpants It has, yes; but this is different than Resist Fingerprinting and First Party Isolation. This is so far down the scale of 'experimental' I'm probably going to need to follow-up and restrict it to Nightly only or some other type of safety switch. Enabling this pref will basically make your profile unsuable, so please don't encourage people to enable it or enable it for others.  We landed this to provide a base for performance testing and experimentation; which we'll be doing over the coming months.

^^ Yup. I mentioned it in case anyone (eg @earthlng ) wanted to play with it with his PoCs etc. Certainly wouldn't flip it until it was "stable" - I'll amend my post above to make it clear

FYI: https://nakedsecurity.sophos.com/2018/11/02/popular-browsers-made-to-cough-up-browsing-history/
Not sure if anything new in there, but the linked pdf is a good read: https://www.usenix.org/system/files/conference/woot18/woot18-paper-smith.pdf
@earthlng @tomrittervg

Section 5, page 10 (emphasis mine)

Firefox with visited links disabled.Turning off Firefox’s layout.css.visited links enabled configuration flag should eliminate visited link styling altogether. Not so: disabling the flag fails to block either our visited-link attacks or Paul Stone’s older one; we reported this bug to Mozilla.

What's that bugzilla?

https://bugzilla.mozilla.org/show_bug.cgi?id=1477773

@tomrittervg ^^ Since that was resolved fixed in FF63, did it mitigate any of the attacks? earthlng said:

nvm, the PoC still works. The only good news is that it seems disabling HW acceleration slows it down to a point where the attack is no longer really practical

Keep in mind that earthlng is talking about his PoC, not the one(s) in the bugzilla, but they are probably the same(?)

closing this. Mozilla are aware of the latest timing & side-channel attacks, and FPI will most likely be applied to a:visited. And there's always FuzzyFox :fox_face:

I'm get excited ... https://bugzilla.mozilla.org/show_bug.cgi?id=1632765

I'm get excited ...

Uha... beersies and naked singing I can see. 😄


Remove all SealedValueClass usage

Based off of #271 , The value-clazz LIBRARY has been born.
It solves all of these issues and enables the use of sealed classes instead of sealed interfacees in a lot of places which is preferable as a sealed interface compiles to just an interface in platform specific languages.

This will actually open up a lot of opportunities for consolidating things. Currently there are separate implementations for base32 and base64 which could be morphed into a single class to make it far simpler as it's just a regular class with no restrictions like Kotllin's value class.

value-clazz will be archived. All value class usage within the public API will be removed.


Official dataset download link not working

Hello,
Is there anyone could share an access to Astyx HiRes2019 dataset for academic used?
The official one has been taken down.

This is what I found someone to put the open source dataset on github, you can refer to it
https://github.com/under-the-radar/radar_dataset_astyx


Creating databases without invoking binaries

Currently when you create a new Padrino project with PostreSQL adapter when you try to create or drop the database it tries to call createdb or dropdb binary as seen in padrino-gen/padrino-tasks/sql-helpers.rb.
While this works in general it's pretty useless when the database sits in a container (Docker for example). I know that ActiveRecord does this without relying on binaries. Would it be possible to replicate this in Padrino so we don't rely on binaries?

Pretty sure since ActiveRecord 4 the given DB's binaries are used for dumping.
With MySQL for example, triggers were not dumped until they moved to mysqldump. Situation may have been similar for PostreSQL, but I don't use it so not sure. 😳

@sshaw For dumping? Maybe. For creating the database - definitely not since I can use Rails with Postgres in Docker OOB provided I setup the right credentials in configuration.

For dumping? Maybe. For creating the database - definitely not since

Ah yes, you're correct.


Why TxnTaxCodeRef not work

`$result = Invoice::create([
"Line" => [
[
"Amount" => 15,
"DetailType" => "SalesItemLineDetail",
"SalesItemLineDetail" => [
"ItemRef" => [
"value" => 1,
"name" => "Services"
],
"TaxCodeRef" => [
"value" => "TAX",
],
"Qty" => 1
],
],
[
"Amount" => 15,
"DetailType" => "SubTotalLineDetail",
"SubTotalLineDetail" => [],
]
],
"TxnTaxDetail" => [
"TxnTaxCodeRef" => [
"value" => 6,
],
"TaxLine" => [
[
"Amount" => 0.60,
"DetailType" => "TaxLineDetail",
"TaxLineDetail" => [
"TaxRateRef" => [
"value" => "10",
"name" => 'trsfgfdgdfgd'
                        ],
                        "TaxPercent"=> 4,
                        "NetAmountTaxable" => 15,
                        "PercentBased" => true
                    ],
                ],
                [
                    "Amount" => 0.68,
                    "DetailType" => "TaxLineDetail",
                    "TaxLineDetail" => [
                        "TaxRateRef" => [
                            "value" => "11",
                            "name" => 'trsfgfdgdfgd'

                        ],
                        "TaxPercent"=> 4.5,
                        "NetAmountTaxable" => 15,
                        "PercentBased" => true
                    ],
                ],
                [
                    "Amount" => 0.06,
                    "DetailType" => "TaxLineDetail",
                    "TaxLineDetail" => [
                        "TaxRateRef" => [
                            "value" => "12",
                            "name" => 'trsfgfdgdfgd'

                        ],
                        "TaxPercent"=> 0.375,
                        "NetAmountTaxable" => 15,
                        "PercentBased" => true
                    ],
                ]
            ],
            "TotalTax" => 2.34,
        ],
        "CustomerRef" => [
            "value" => "3"
        ]
    ]);`

I set TxnTaxCodeRef for my tax code but always set default tax code.

Check if your company is AST enabled. If it is AST enabled, the TxnTaxCodeRef is set by AST. For line item, the Tax Code is always "TAX" or "NON".


[FSDE-18069] Migrate Picker group component to new Vue documentation

The CI pipeline did not run successfully in https://jenkinsprod.corp.intranet:8443/job/UX-CHI/job/Productive/job/Chi/job/PR-367/1/. :x:

The CI pipeline run successfully in https://jenkinsprod.corp.intranet:8443/job/UX-CHI/job/Productive/job/Chi/job/PR-367/2/. :white_check_mark:

You can check this PRs instance in https://03bd449292ba1c930549ca9151816f516faadfab-chi-pr.enterprise.ctl.io (external) and in https://nginx-pr-367-ux-chi.kubeodc-test.corp.intranet/ (internal)

The CI pipeline run successfully in https://jenkinsprod.corp.intranet:8443/job/UX-CHI/job/Productive/job/Chi/job/PR-367/3/. :white_check_mark:

You can check this PRs instance in https://03f05dc1c5ff0e2bfd4b5677f10658cf85f8640b-chi-pr.enterprise.ctl.io (external) and in https://nginx-pr-367-ux-chi.kubeodc-test.corp.intranet/ (internal)

The CI pipeline run successfully in https://jenkinsprod.corp.intranet:8443/job/UX-CHI/job/Productive/job/Chi/job/PR-367/4/. :white_check_mark:

You can check this PRs instance in https://fd2f8f8dda04d7e4434ea7cd5b3c890aa50fd161-chi-pr.enterprise.ctl.io (external) and in https://nginx-pr-367-ux-chi.kubeodc-test.corp.intranet/ (internal)

The CI pipeline run successfully in https://jenkinsprod.corp.intranet:8443/job/UX-CHI/job/Productive/job/Chi/job/PR-367/7/. :white_check_mark:

You can check this PRs instance in https://f7c5c7c28d001cb8a0b910a194eea71305359868-chi-pr.enterprise.ctl.io (external) and in https://nginx-pr-367-ux-chi.kubeodc-test.corp.intranet/ (internal)

@josecarlosgonzalezv Encara JC!

The CI pipeline run successfully in https://jenkinsprod.corp.intranet:8443/job/UX-CHI/job/Productive/job/Chi/job/PR-367/8/. :white_check_mark:

You can check this PRs instance in https://0774944af17577ba8ea44e86254aba8865be5b43-chi-pr.enterprise.ctl.io (external) and in https://nginx-pr-367-ux-chi.kubeodc-test.corp.intranet/ (internal)


Content hugging and content compression resistance priorities

Hey, how can I use Content hugging and content compression resistance priorities with Easy Peasy?

Hi @ServusJon 👋
You can use content hugging and compression resistance priorities as usual, the only thing to keep in mind is that you need to play with the constraint priorities and to do so you would need to use the .with method when creating your attributes, more info here.
However, I use the following helper methods at work:
/**
    Content hugging & resistance helpers, because I'm tired of thinking about this
 */
extension UIView {

    /**
        Adjusts the view's size in order to wrap the content using as little space as possible when
        wrap is true
        - parameter wrap: Whether the content should be wrapped
        - parameter axes: Axes affected by this rule
        - parameter priority: Priority of the constraint based in which the rule will take effect

        - returns the current `UIView` instance to ease the concatenation of operations
     */
    func easy_wrap(wrap: Bool, axes: [UILayoutConstraintAxis] = [.Vertical, .Horizontal], priority: Priority = .HighPriority, offset: Float = 10) -> UIView {
        for axis in axes {
            let value: Float = wrap ? priority.layoutPriority() + offset : priority.layoutPriority() - offset
            self.setContentHuggingPriority(value, forAxis: axis)
        }
        return self
    }

    /**
        Adjusts the view's size respecting or not the size of its content
        - parameter collapse: Whether the size of the content should preveal
        - parameter axes: Axes affected by this rule
        - parameter priority: Priority of the constraint based in which the rule will take effect

        - returns the current `UIView` instance to ease the concatenation of operations
     */
    func easy_collapse(collapse: Bool, axes: [UILayoutConstraintAxis] = [.Vertical, .Horizontal], priority: Priority = .HighPriority, offset: Float = 10) -> UIView {
        for axis in axes {
            let value: Float = collapse ? priority.layoutPriority() - offset : priority.layoutPriority() + offset
            self.setContentCompressionResistancePriority(value, forAxis: axis)
        }
        return self
    }

}

I don't find them particularly good reason why I haven't made them public until now.
This is an usage example:
private lazy var shippingLabel: UILabel = {
    let label = UILabel(frame: CGRectZero)
    label.easy_wrap(true, offset: 5).easy_collapse(false)
    return label
}()

I hope you find it helpful :)

Yes indeed. thank you.
What would you use to achieve a layout that works in different orientations?
`    let image = UIView()
override func viewDidLoad() {
    super.viewDidLoad()

    image.backgroundColor = .green

//        image.frame = CGRect(x: 10, y: 10, width: 200, height: 200)
view.addSubview(image)
    image <- [
        Top(0).when { $0.isHorizontalRegular }, // portait
        Left(0),
        Right(0),
        Height(100)
    ]

    image <- [
        Top(100).when { $0.isVerticalCompact }, // landscape
        Height(10).when { $0.isVerticalCompact }, // portait
    ]

}

override func traitCollectionDidChange(_ previousTraitCollection: UITraitCollection?) {
    image.easy_reload()
}`

The height of the view breaks when I go back to portrait after switching to landscape. I am struggling to structure the code in a way that it works for orientation and screensizes :-(
Can you help?

It's breaking because there is no Height attribute when the size class goes back to HorizontalRegular.
I think this should fix your code:
let image = UIView()

override func viewDidLoad() {
    super.viewDidLoad()
    view.addSubview(image)
    image <- [
        Top(0).when { $0.isHorizontalRegular }, // portait
        Left(0),
        Right(0),
        Height(100).when { $0.isHorizontalRegular }, // portait
    ]

    image <- [
        Top(100).when { $0.isVerticalCompact }, // landscape
        Height(10).when { $0.isVerticalCompact }, // portait
    ]

}

override func traitCollectionDidChange(_ previousTraitCollection: UITraitCollection?) {
    image.easy_reload()
}

Now the view is only visible in landscape. :-(  Is there a best practice to organize or setup constraints for a layout like this?

You can structure it in many different ways, for example:
override func viewDidLoad() {
    super.viewDidLoad()
    view.addSubview(image)
    image <- [
        Top(0).when { $0.isHorizontalRegular },
        Height(100).when { $0.isHorizontalRegular },
        Top(100).when { $0.isVerticalCompact },
        Height(10).when { $0.isVerticalCompact },
        Left(0),
        Right(0),
    ]

}

or
override func viewDidLoad() {
    super.viewDidLoad()
    view.addSubview(image)

    // Common constraints
    image <- [
        Left(0),
        Right(0)
    ]

    // Horizontal regular
    image <- [
        Top(0),
        Height(100)
    ].when { $0.isHorizontalRegular }

    // Vertical compact
    image <- [
        Top(100),
        Height(10)
    ].when { $0.isVerticalCompact }
}

But just to be clear, which frame would you like to have for landscape and portrait? I'm not sure what do you want to achieve.

This is just an example. In this example I want to change the height and top value based on orientation. In your examples the green block is still not visible in portrait.

Ok, got it. Try with this :)
    image <- [
        Top(0).when { $0.isVerticalRegular },
        Height(100).when { $0.isVerticalRegular },
        Top(100).when { $0.isVerticalCompact },
        Height(10).when { $0.isVerticalCompact },
        Left(0),
        Right(0)
    ]

That works!
And what if I want to have a view a different width on an iPad depending on the Orientation? Size classes don't work here?

Cool!
In that case you would need to figure it out in a different way as the size class will always be Compact. Remember that you can evaluate any condition within a when closure, like this:
Width(100.0).when {  [weak self] in
    return self?.isLandscape ?? false
}

not working :-(

Hey @ServusJon 👋
I know I know, it was just an example showing how to check properties using Conditions. The property isLandscape is not part of UIKit, therefore you would need to implement it.

Thank you @nakiostudio that helped a lot. Sorry for all this noob questions…

I don't think those are noob questions 🙂. Feel free to ask as much as you want or direct message me on twitter.

HI,
How is it possible to use your wrap with new version ? :)


warning 213: tag mismatch

Whats is the problem?
Compiler output:
C:\Users\Leonardo\Desktop\samp-server\gamemodes\sample.pwn(225) : warning 213: tag mismatch Pawn compiler 3.2.3664	 	 	Copyright (c) 1997-2006, ITB CompuPhase 1 Warning.
Line 225:
new handle; handle = sql_connect(SQL_HANDLER_POSTGRESQL, "<IP_ADDRESS>", "postgres", "leo123", "samp", 5432);

I really not know what is returned... but I converted to int and works.
new handle;
handle = _:sql_connect(SQL_HANDLER_POSTGRESQL, "<IP_ADDRESS>", "postgres", "leo123", "samp", 5432)

Sorry.. was only create a variable of "kind ´sql´":
new SQL:handle;
handle = _:sql_connect(SQL_HANDLER_POSTGRESQL, "<IP_ADDRESS>", "postgres", "leo123", "samp", 5432)


Summarizer erases JVM crash executions

Description
When the concrete executor tries to execute a branch that leads to a JVM crash, it creates a UtExecution instance that correspond to the failure. The test generator will process this execution in a special way: the generated test case will be disabled and it will contain a comment about the possible JVM crash.
Summarizer considers only two subclasses of UtExecution, UtSymbolicExecution and UtFuzzedExecution, but not the parent class itself. As a result, summarizer erases these failed (JVM crash) executions, and no tests are generated for them.
A related problem: failed executions are not erased during the code generation / summarization phases in utbot-framework unit tests, because the result of the call to summarizer is not assigned to anything. It seems that this inconsistency should be fixed as well.
To Reproduce
Turn fuzzing off (either via the plugin settings dialog window or by setting UtSettings option useFuzzing to false).
Generate a test suite for the following class using the plugin.
import sun.misc.Unsafe;

import java.lang.reflect.Field;
import java.security.AccessController;
import java.security.PrivilegedAction;

public class JvmCrashExample {
    public int crashPrivileged(int i) {
        return AccessController.doPrivileged((PrivilegedAction<Integer>) () -> {
            try {
                Field unsafeField = Unsafe.class.getDeclaredField("theUnsafe");
                unsafeField.setAccessible(true);
                Unsafe unsafe = (Unsafe) unsafeField.get(null);
                unsafe.putAddress(0, 0);

                if (i == 0) {
                    return i;
                }

                return 1;
            } catch (NoSuchFieldException | IllegalAccessException e) {
                throw new RuntimeException(e);
            }
        });
    }
}

Note: this example uses doPrivileged to allow the concrete executor to run privileged code (the unsafe call) despite the sandbox limitations. If the crashing code is not wrapped in doPrivileged, and the operation is not explicitly enabled by a sandbox configuration file, a special test case will be generated instead with the annotation @Disabled(value = "Disabled due to sandbox"). To reproduce this issue, please either allow all unsafe operations to the concrete executor, or use doPrivileged.
Expected behavior
A disabled test case should be generated.
import org.junit.jupiter.api.Test;

public class JvmCrashExampleTest {
    ///region Test suites for executable unsafe.JvmCrashExample.crashPrivileged

    ///region

    /**
     * JVM crash report
     */
    @Test
    @org.junit.jupiter.api.Disabled(value = "Disabled due to possible JVM crash")
    public void testCrashPrivileged1() {
        JvmCrashExample jvmCrashExample = new JvmCrashExample();

        // This invocation possibly crashes JVM
        jvmCrashExample.crashPrivileged(-255);
    }
    ///endregion

    ///endregion

}

This test case is successfully generated when UtSettings.enableMachineLearningModule is set to false (i.e., summaries are disabled).
Actual behavior
When UtSettings.enableMachineLearningModule is set to true (default value, summaries are enabled), no test cases are produced, and the plugin shows the usual "no tests generated" message box.
Environment
This issue can be reproduced with Java 11 as the project JDK, although it is not JDK-specific. It does not depend on mocking settings or JUnit/TestNg version as well.
Additional context
I'd suggest to fix this issue from both sides:

UtExecution should be converted to a sealed class, and a dedicated child class (e.g., UtFailedExecution) should be used to represent JVM failures instead of plain UtExecution.
Summarizer code should be adjusted to correctly handle all execution types (symbolic executions, fuzzer executions, and failure executions) to avoid accidently dropping any of them.

The summary generation phase in the utbot-framework unit tests should be fixed as well to match the plugin behavior.

@dtim super, will do next week

@amandelpie Thank you. I am willing to prepare the engine part if you agree with the overall approach (let's discuss it next week).

@amandelpie do we have this problem now? Or we should close it since there is no problem anymore

@amandelpie, I've checked on the latest main - it's not reproducing. So closing as stale.

Great, many thanks @alisevych


resultset.FieldsTable only returns null

Code used: https://pastebin.com/EePCSc5L
Output: https://i.imgur.com/ykaftWf.png
Doesn't happen in .GetField or .FieldsArray, only .FieldsTable is being buggy for some reason.
Using the plugin on Windows 7 x64 (04rel006)

First one should be fixed by: bfdb042442c4bd9453a8668dc900acfa59873d42
Second one should be fixed by: 3a5563820ddfd6f5157aefb901f873b93c5f0ae0
I'll be closing this for now. Let me know if the problem persists and thanks for the report.


Mode change feedback flash

It would be nice if the major mode changes would flash a quick feedback toast so that you know what you're doing and that it's doing something.
These should be a setting so that users who are more advanced can then turn it off if they so like.
You could use that for config load errors as well (which right now pops up a terminal window).

I searched for a related feature and came across this issue. Here are my 2 cents:

Add more callbacks to the configuration, such as on-mode-change.
Enable the ability to query the current state of aerospace with aerospace current mode.

My use case was to run a script based on different modes and add borders to focused window only in some of the modes

Or add a field within the mode declaration that can run some script. Previously, I have done something similar with JankyBorders and skhd. After entering a mode, a message was sent to the borders app and the color of the borders change


Basic linear algebra for complex numbers

🚀 Feature

Support basic linear algebra for complex numbers.
Motivation

I talked with @sw005320 about https://github.com/nttcslab-sp/dnn_wpe and it turns out, that the matrix inversion implemented with real numbers is unstable. In a beamforming example @Emrys365 observed a performance difference of 5 dB in a signal to distortion ratio (SDR) where he replaced the inversion with numpy code (torch: 5dB, numpy 10dB).
I tried torch.inverse and torch.solve and interestingly they are working in 1.6.0.dev20200623+cpu (Not mentioned in https://github.com/pytorch/pytorch/issues/33152).
Is it possible, to support torch.matmul and some other linear algebra functions?
I also tried to use backward after torch.solve and the code fails with the exception msg, that matmul is not implemented.
Does someone know, how the gradient is defined in torch for complex numbers?
Is it grad_real + j grad_imag or grad_real - j grad_imag?
And how can I add/fix the gradient, when I find a broken implementation?
Pitch

Using native functions for linear algebra of complex numbers instead of https://github.com/kamo-naoyuki/pytorch_complex

torch.solve and torch.inverse miss a backward function
torch.matmul does not work

Alternatives

https://github.com/kamo-naoyuki/pytorch_complex has precision problems with the matrix inverse.

Additional context

Currently, I am considering to jump between pytorch_complex and torch.autograd.Function:
def hermite(a):
    return a.transpose(-2, -1).conj()

def matmul(t1, t2):
    real1, imag1 = t1.real, t1.imag
    real2, imag2 = t2.real, t2.imag
    o_real = torch.matmul(real1, real2) - torch.matmul(imag1, imag2)
    o_imag = torch.matmul(real1, imag2) + torch.matmul(imag1, real2)
    return o_real + 1j * o_imag

class Solve(torch.autograd.Function):
    @staticmethod
    def forward(ctx, A, b):
        x, _ = torch.solve(b, A)
        ctx.save_for_backward(A, x)
        return x

    @staticmethod
    def backward(ctx, grad_output):
        A, x = ctx.saved_tensors
        gb, _ = torch.solve(grad_output, hermite(A))
        gA = - matmul(gb, hermite(x))
        return gA, gb

@vincentqb and @mthrok,
This is one of the most serious issues when we try to use pytorch to some speech and audio processing during the JSALT workshop activities, as I mentioned before. Now, with the investigation from @boeddeker and @Emrys365, this problem becomes more serious, and also what we need is more clear. Of course, it's better to be supported by PyTorch for these basic operations in the long term future, but it would be great if torchaudio can handle this issue in the short term.

cc @anjali411

Hi @boeddeker thanks for creating this issue! torch.matmul is already supported for complex on cuda on master (#40431). I will add torch.matmul for complex numbers on CPU once the the TH to ATen port is complete (#40927).
For the expected autograd behavior for complex, checkout this doc note (to be merged) here: https://github.com/pytorch/pytorch/pull/41012

Hi @anjali411, thanks for the feedback. Good to hear, that matmul is supported on the GPU.
Is torch.solve also planned to be implemented on the GPU?
How do I figure out, if a gradient is already implemented?
In https://github.com/pytorch/pytorch/issues/33152 are no gradients mentioned (except gradient check).
Since the gradient torch.solve currently fails, I expect, that it uses the real gradient definition.
I am not sure, what the documentation in pytorch/pytorch#41012 tries to tell me.
I only knew two ways to define the complex derivative.
Assuming L is a loss value (real valued) and z = x + j y is a complex number, then the gradient can be:

\partial L / \partial x + j \partial L / \partial y

or

\partial L / \partial x - j \partial L / \partial y

You may add a factor in front of the derivative, but that would not change the chain rule.
Depending on which definition is used, some real valued gradients may be correct or most are incorrect.
In Table 4.1, 4.2 and 4.3 of [1] are the equations that can be used to obtain the gradients for both definitions and Equation 3.2 and 3.3 show the notation that is used in that work.
The difference between both definitions is only a conjugate transpose. So maybe a conj is sometimes missing.
[1] https://arxiv.org/abs/1701.00392

Hi @anjali411, thanks for the feedback. Good to hear, that matmul is supported on the GPU.
Is torch.solve also planned to be implemented on the GPU?
How do I figure out, if a gradient is already implemented?

Here's a list of the functions for which backward is supported and tested: https://github.com/pytorch/pytorch/blob/dac63a13cbe105c81db4539147687d593704fe83/test/test_autograd.py#L4336

In pytorch/pytorch#33152 are no gradients mentioned (except gradient check).
Since the gradient torch.solve currently fails, I expect, that it uses the real gradient definition.
I am not sure, what the documentation in pytorch/pytorch#41012 tries to tell me.
I only knew two ways to define the complex derivative.
Assuming L is a loss value (real valued) and z = x + j y is a complex number, then the gradient can be:

\partial L / \partial x + j \partial L / \partial y

or

\partial L / \partial x - j \partial L / \partial y

The autograd support for complex numbers is still in the prototype stage but we follow the JAX's convention for autograd for complex numbers, wherever supported.

Hi @anjali411, I forgot to say, thank you for pushing complex support in pytorch.

Hi @boeddeker Yeah it's a part of the plan, but we can certainly make it high priority if it's commonly used. can you create an issue for that on pytorch repo?

Sure, I opened an issue in pytorch.

In general, some of the ops are not fully tested for complex yet, but we will be working on making the support for complex more extensive in 1.7. are there any other functions that are commonly used by Audio Community and are not supported for complex numbers in PyTorch yet? We can certainly prioritize adding such functions.

Currently, the exception RuntimeError: _th_addmm_out not supported on CPUType for ComplexDouble blocks me to do further test (On my notebook I have no GPU to do the tests on the GPU).
In the long term it would be nice to have the eigenvalue decomposition implemented with gradient support, but the implementation and the tests are quite complicated. So other operations are currently more interesting (e.g. fft with complex numbers (not tested if already implemented)).

The autograd support for complex numbers is still in the prototype stage but we follow the JAX's convention for autograd for complex numbers, wherever supported.

Thanks for the link. The information that I am interested in, is not directly on that page, but I found how pytorch defined the gradient. In Pytorch the optimizers have to add a conj when they do an optimizer step. I personally prefer the other definition, but both work.

@sw005320 @boeddeker can you links to some functions/code blocks from the ESPnet repository that use complex numbers for a reference point? That would help in avoiding any last minute surprises for some functionalities that are not yet supported for complex numbers (for eg. torch.clamp etc) but we can prioritize them if we know about them ahead of time.
Also, I will we working on writing a tutorial for complex numbers and was curious to see if you have any ideas on application (s) I could cover in the tutorial that would demonstrate the importance of complex numbers as well as interesting as a unit application.

@anjali411 sure, I can give you two pointers.

https://github.com/fgnt/nara_wpe/pull/46 is an example for a dereverberation algorithm (WPE) implemented with torch.
The algorithm works in the STFT domain. I tested the code with real numbers, so I expect it should also work with complex numbers, when the support for the operations is available.

Application: Speedup the computation by using the GPU

In https://github.com/espnet/espnet/tree/master/espnet/nets/pytorch_backend/frontends are some components that are used for an End-2-End training of speech enhancement/source separation and speech recognizer. The complex operations are in the beamformer and dereverberation algorithm (WPE, https://github.com/nttcslab-sp/dnn_wpe). To compensate the complex support they use https://github.com/kamo-naoyuki/pytorch_complex (Interpret complex operations as real operations) at the moment.

Application: Support End-2-End training of frontend and backend [1] in pytorch.
I haven't carefully analyzed, but using pytorch_complex increases the memory consumption (e.g. 1 matrix multiplication is splitted in multiple operations with the real and imag component)
Maybe @sw005320 can point you to an example (I got only some files to train an NN that are not under version control)

Maybe one motivation for complex support is the feature extraction (Beside to the E2E training).
In the audio domain (or at least in our subfield) most of the time the feature extraction involves complex numbers.
So currently the code is a mix of numpy and torch. It would be nice when everything can be done in torch.
e.g. When the feature extraction gets expensive and you do it on demand, the GPU can speedup the input pipeline.
[1] Beamnet: End-to-end training of a beamformer-supported multi-channel ASR system

@anjali411 sure, I can give you two pointers.

fgnt/nara_wpe#46 is an example for a dereverberation algorithm (WPE) implemented with torch.
The algorithm works in the STFT domain. I tested the code with real numbers, so I expect it should also work with complex numbers, when the support for the operations is available.

which functions in this PR need to work with complex numbers? do all the functions also need autograd support?

Application: Speedup the computation by using the GPU
In https://github.com/espnet/espnet/tree/master/espnet/nets/pytorch_backend/frontends are some components that are used for an End-2-End training of speech enhancement/source separation and speech recognizer. The complex operations are in the beamformer and dereverberation algorithm (WPE, https://github.com/nttcslab-sp/dnn_wpe). To compensate the complex support they use https://github.com/kamo-naoyuki/pytorch_complex (Interpret complex operations as real operations) at the moment.
This is actually helpful for referencing which functions are required for complex tensors. We already support many of these functions. I would encourage you to check out the complex support for these functions and give feedback!

For example, I would also like to draw your attention to the view functions we added very recently torch.view_as_real, torch.view_as_complex that are equivalent to the functions in this file: https://github.com/kamo-naoyuki/pytorch_complex/blob/master/torch_complex/utils.py.

I haven't carefully analyzed, but using pytorch_complex increases the memory consumption (e.g. 1 matrix multiplication is splitted in multiple operations with the real and imag component)

what do you mean by pytorch_complex? do you mean floating point tensors of shape (..., 2) to represent complex values?
Also I think it would be useful to setup a meeting and discuss more on how we can integrate torch complex tensors in ESPnet.

which functions in this PR need to work with complex numbers? do all the functions also need autograd support?

The first argument of the function wpe_v6in nara_wpe is complex valued. So most functions have to work with complex numbers.
Currently, the code fails with missing support for matmul.
When combining WPE with a NN the inverse_power will be estimated from an NN. So gradient support for mul, matmul, conj, transpose/permute, getitem, sub and solve would be necessary (I hope I didn't forget a function).

For example, I would also like to draw your attention to the view functions we added very recently torch.view_as_real, torch.view_as_complex that are equivalent to the functions in this file: https://github.com/kamo-naoyuki/pytorch_complex/blob/master/torch_complex/utils.py.

Thanks for this hint. I think they are slightly different. In torch_complex they have two tensors, one for real and one for imag and they are converted to a Tensor "(..., 2)", while torch.view_as_real expects a complex tensor (e.g. dtype=complex) as input. In torch_complex is the dtype never complex (so they support also old pytorch versions).

what do you mean by pytorch_complex? do you mean floating point tensors of shape (..., 2) to represent complex values?

Ah, sorry, that was a type, I meant torch_complex from kamo-naoyuki.
He splits the complex numbers in real and imag and does all operations just with real operations.
Example for multiplication: z = x + jy, w = u + jv, z * w = (xu - yv) + j(x * v + (y * u))
I haven't carefully thought about the intermediate tensors that are necessary to save for backward, but it may be higher than doing the complex multiplication with a single function (vs 4 multiplications and 2 additions).

Also I think it would be useful to setup a meeting and discuss more on how we can integrate torch complex tensors in ESPnet.

Sure, we can setup a meeting. My timezone is UTC+2 (Germany).
Do you have a suggestion when and where we meet?
@sw005320 Who should/wants to participate from ESPnet?

@anjali411 @boeddeker I will coordinate the meeting then.

I should have seen this earlier. Did the meeting happen? What were the conclusions?
I currently use this method to emulate complex tensors in pytorch and I see now that this is what is done in torch_complex as well.
I think svd and  pinverse would be very good to have as well as it's more robust than inverse.

Hi @mpariente
Thanks for your comment.
The meeting has happened and we followed the discussion above and narrowed down the requirements from ESPNet to the followings

Gradient support for

mul
matmul
conj
transpose / permute
getitem
sub
solve
symeig / eigh
exp

We are interested in hearing complex number use cases and we are also interested in your work of asteroid. So how about we set up a meeting?

Hi, thanks for your answer.
This would already be great to have !
I guess z.abs() would be z * z.conj() so there is no need to explicitly require the gradients?
How about log?
Yes, we could set up a meeting. I'm tagging @popcornell and @faroit here as they could also be interested.

Second this, it is essential for integrating standard DSP techniques (e.g. beamforming) in a simple way for E2E training.
Regarding instability of matrix inversion, I tried in the past to do E2E training through operations that required matrix inversion (on real numbers only) and using double precision does make a huge difference, i don't know however if it is your case.

Hi @mpariente, @popcornell
Thanks for the response. @dongreenberg will coordinate the meeting.

In PyTorch 1.9, complex numbers are supported in most (if not all) of the linear algebra. Thanks for the feedback!


Question: Control ESPSomfy shades with url?

Hello,
its possible to control the shades with url?
for example like this:
ipfromESP32Somfy/Shadename/up
ipfromESP32Somfy/Shadename/my
ipfromESP32Somfy/Shadename/down

Yes you can call http://<ip address>/shadeCommand?shadeId=<id>&command=up
The docs on this are located in the wiki.  To operate the new group commands you use http://<ip address>/groupCommand?groupId=<id>&command=up
https://github.com/rstrouse/ESPSomfy-RTS/wiki/Integrations#rest-commands

I suspect you have this sorted.  I will close this for now.  Open another issue if you have further questions.


Remove sslv3.dshield.com and tlsfun.de tests

This pull request removes the following tests:

sslv3.dshield.org appears to be offline (see #297).
tlsfun.de is a sanity check dependent on StartCom (see #296). Other providers (such as badssl.com and badtls.io) already offer similar tests to the ones we use from tlsfun.de.
expired.tlsfun.de tests the same things as e.g. expired.badtls.io and self-signed.badssl.com.
badcert-edell.tlsfun.de and superfish.tlsfun.de can be replaced with edellroot.badssl.com and superfish.badssl.com.

Closes #297. Closes #296.

Internets behave bad today, but PR LGTM.

Thanks!


Migrate to same host different datastore fails

Description
Sunstone migrate function to the same host but a different datastore works fine when guest is powered off. However when guest is powered on libvirt does a save and when it tries a restore it cannot because the paths in the XML still point to the previous datastore.
To Reproduce

Create 2 system datastores ids 100, 101. Place guest on 100.
Migrate a guest to the same host but datastore 101 while it is powered on

Errs out along the lines of:
Fri Dec 13 20:50:46 2019 [Z0][VMM][D]: Message received: LOG E 543 restore: Command "virsh --connect qemu+tcp://localhost/system restore /var/lib/one//datastores/101/543/checkpoint --xml /var/lib/one//datastores/101/543/checkpoint.xml" failed: error: Failed to restore domain from /var/lib/one//datastores/101/543/checkpoint

Fri Dec 13 20:50:46 2019 [Z0][VMM][D]: Message received: LOG I 543 error: Cannot access storage file '/var/lib/one/datastores/100/543/disk.0' (as uid:9869, gid:9869): No such file or directory

Not sure what the solution is - temporary symlink from previous datastore to be removed when the vm shuts down?
Details

Affected Component: one
Hypervisor: libvirt issue
Version: 5.10.1

Progress Status

[ ] Branch created
[ ] Code committed to development branch
[ ] Testing - QA
[ ] Documentation
[ ] Release notes - resolved issues, compatibility, known issues
[ ] Code committed to upstream release/hotfix branches
[ ] Documentation committed to upstream release/hotfix branches

Still an issue though...

Hello @mzealey,
Thanks for reporting the bug. I have made some tests to try to reproduce it:

Have two system datastores:

onedatastore show 0
DATASTORE 0 INFORMATION
ID             : 0
NAME           : system
USER           : oneadmin
GROUP          : oneadmin
CLUSTERS       : 0
TYPE           : SYSTEM
DS_MAD         : -
TM_MAD         : shared
BASE PATH      : /var/lib/one//datastores/0
DISK_TYPE      : FILE
STATE          : READY

DATASTORE CAPACITY
TOTAL:         : 451.6G
FREE:          : 327.2G
USED:          : 101.4G
LIMIT:         : -

PERMISSIONS
OWNER          : um-
GROUP          : u--
OTHER          : ---

DATASTORE TEMPLATE
ALLOW_ORPHANS="NO"
DISK_TYPE="FILE"
DS_MIGRATE="YES"
RESTRICTED_DIRS="/"
SAFE_DIRS="/var/tmp"
SHARED="YES"
TM_MAD="shared"
TYPE="SYSTEM_DS"

IMAGES

onedatastore show 100
DATASTORE 100 INFORMATION
ID             : 100
NAME           : ds_1
USER           : oneadmin
GROUP          : oneadmin
CLUSTERS       : 0
TYPE           : SYSTEM
DS_MAD         : -
TM_MAD         : shared
BASE PATH      : /var/lib/one//datastores/100
DISK_TYPE      : FILE
STATE          : READY

DATASTORE CAPACITY
TOTAL:         : 451.6G
FREE:          : 327.2G
USED:          : 101.4G
LIMIT:         : -

PERMISSIONS
OWNER          : um-
GROUP          : u--
OTHER          : ---

DATASTORE TEMPLATE
ALLOW_ORPHANS="NO"
DISK_TYPE="FILE"
DS_MIGRATE="YES"
RESTRICTED_DIRS="/"
SAFE_DIRS="/var/tmp"
SHARED="YES"
TM_MAD="shared"
TYPE="SYSTEM_DS"

IMAGES

Instantiate a VM from the marketplace:

onevm list --no-expand
  ID USER     GROUP    NAME            STAT  CPU     MEM HOST             TIME
   1 oneadmin oneadmin Alpine Linux 3. runn    1    128M localhost    0d 01h32

Migrate the VM to another datastore:

Mon Mar 15 09:29:02 2021 [Z0][ReM][D]: Req:7856 UID:0 IP:<IP_ADDRESS> one.vm.migrate invoked , 1, 0, false, false, 0, 0
Mon Mar 15 09:29:02 2021 [Z0][DiM][D]: Migrating VM 1
Mon Mar 15 09:29:02 2021 [Z0][ReM][D]: Req:7856 UID:0 one.vm.migrate result SUCCESS, 1
Mon Mar 15 09:29:02 2021 [Z0][ONE][E]: VM 1 is already in host 0.
Mon Mar 15 09:29:03 2021 [Z0][VMM][I]: ExitCode: 0
Mon Mar 15 09:29:03 2021 [Z0][VMM][I]: Successfully execute virtualization driver operation: save.
Mon Mar 15 09:29:03 2021 [Z0][VMM][I]: Successfully execute network driver operation: clean.
Mon Mar 15 09:29:03 2021 [Z0][IPM][D]: Message received: SAVE SUCCESS 1 -

Mon Mar 15 09:29:03 2021 [Z0][TrM][D]: Message received: TRANSFER SUCCESS 1 -

Mon Mar 15 09:29:03 2021 [Z0][VMM][I]: Successfully execute transfer manager driver operation: tm_context.
Mon Mar 15 09:29:03 2021 [Z0][VMM][I]: Successfully execute network driver operation: pre.
Mon Mar 15 09:29:05 2021 [Z0][VMM][I]: ExitCode: 0
Mon Mar 15 09:29:05 2021 [Z0][VMM][I]: Successfully execute virtualization driver operation: restore.
Mon Mar 15 09:29:05 2021 [Z0][VMM][I]: Successfully execute network driver operation: post.
Mon Mar 15 09:29:05 2021 [Z0][IPM][D]: Message received: RESTORE SUCCESS 1 -

Mon Mar 15 09:23:48 2021 [Z0][VM][I]: New LCM state is RUNNING
Mon Mar 15 09:29:02 2021 [Z0][VM][I]: New LCM state is SAVE_MIGRATE
Mon Mar 15 09:29:03 2021 [Z0][VM][I]: New LCM state is PROLOG_MIGRATE
Mon Mar 15 09:29:03 2021 [Z0][VM][I]: New LCM state is BOOT_MIGRATE

As you can see everything worked correctly.

OpenNebula version:

OpenNebula 5.13.85 (42ae0e0f)
Copyright 2002-2021, OpenNebula Project, OpenNebula Systems

Licensed under the Apache License, Version 2.0 (the "License"); you may not
use this file except in compliance with the License. You may obtain a copy
of the License at http://www.apache.org/licenses/LICENSE-2.0

So please, could you provide more information and also the specific steps + resources you are using?
Closing until more information is provided. We will reopen if needed.
Best,
Álex.


Question about the detector and feature extractor

Hi! Thanks for your great work!
I've read your code and noticed that int your model, you imported the detection results from Detectron in Data/Test_Faster_RCNN_R-50-PFN_2x_HICO_DET.pkl, which contains bbox annotations of human and objects. And used another simplified ResNet-50 (just stage1 to stage4) to extract features from the proposals cropped from the raw image according to the annotations above. Is my description true in the model? I would really appreciate it if you can correct me if I am wrong.
Many thanks for your attention! 😁

You are right, but we're actually using Data/Test_Faster_RCNN_R-50-PFN_2x_HICO_DET_with_pose.pkl which also includes pose detection result.

Thanks for your reply!
May I ask have you tried to use the features from stages in the detector directly, instead of extracting the features once more before entering the three streams? I'm thinking of whether it is necessary to re-extract the features again.

We have tried that but it turned out to decrease the mAP.

Thanks a lot!


Will still work after 3g off by BMW

BMW have posted that they will discontinue connected drive support  after Feb 2022.
More info found on USA: https://www.bmwusa.com/content/dam/bmwusa/connected-drive/pdf/3G_FAQ.pdf
How that will affect this great software and what functionality we will still have?
Still 10x for great job.

I hope it will continue to work! The protocol itself doesn't use the 3g connection, but I suspect the car uses it to check the subscription status to enable the protocol. You might need to use coding to force-enable the BMW A4A Apps protocol after the subscription service becomes unavailable.

It should work. I have an NBT retrofitted into a BMW E60, that means I can't pay for any of the subscriptions. As long as "BMW APPS" are coded you should be good.


Whitaker Lab Management responsibilities: Malvika+Georgia

Week commencing: 13 April 2020
Task Managers

Date
Scheduled lab tasks [1]
Time
Assigned to
Resource (link)

Mon
V-Coffee
14:30
MS/GA
Link to be shared on Slack

Tue
V-Coffee
14:30
MS/GA
Link to be shared on Slack

Wed
V-Coffee Weekly touch base [2]
14:30 & 15:00 resp.
MS, GA, Whitaker lab members (optional)
Link will be sent on Slack

Thurs
Lab meeting, Create weekly update PR
15:00
MS
Link will be shared in HackMD

Fri
V-Coffee
14:30
MS/GA
Link to be shared on Slack

[1] Any other topics

Weekly virtual coffee reminders
Weekly lab meetings

Any significant deadline or event coming up?

Checking in with members

Does someone need an accountable buddy for their difficult projects?

If people need help reviewing some of their ideas, or invite feedback

An idea to schedule co-working space/hour: Lab HackMD for indicating co-working

[2] Weekly touch base

Review the GitHub repo for issues/PR
Identify our tasks for next week
Create a lab-meeting HackMD and schedule to send them
Weekly meeting PR review
Create a weekly "overview PR" for Kirstie

This looks awesome!! Can we capture the plan in the repository somewhere?
What's the logic of having lab meeting before a weekly touch base?

The weekly touch base is for Georgia and me to have a plan for next week and review the repo and PRs together.

Yep - sounds great.
I was thinking that for a regular schedule it would make sense to have that check in before lab meeting because it will be very helpful for driving discussions when we're all synchronously - if virtually - "face to face". But totally fine to experiment and see how it works.

Edited Friday weekly-touch base and moved to Wednesday after the virtual coffee so that we can invite members from the lab to stay back and join the discussion with me and Georgia.


update meta/runtime.yml to non EOL version

With upcoming EoL dates on the horizon, we will want to bump the version found in the runtime file to something like 2.13 or whatever the min supported version for the platform is.

bumped in #57


Update MD file on new branch 2017-33-02_09-12-41

:white_check_mark: Validation status: passed

File
Status
Preview URL
Details

split/updateTestCon.md
:white_check_mark:Succeeded

For more details, please refer to the build report.
Note: If you changed an existing file name or deleted a file, broken links in other files to the deleted or renamed file are listed only in the full build report.


feat: improve datasets api

This PR improves the backend API of the dataset-browser. The primary changes:

The API now uses SPARQL for fetching the metadata of datasets (instead of Elasticsearch)
The structure of the API now follows the API of the researcher
The API no longer supports the dataset props spatialCoverages and genres - these props are not being used by datasets (on production). We can add them again when needed
The dataset props publisher and license have become optional (instead of required). This is a small breaking change.

This pull request will probably also fix: https://github.com/colonial-heritage/colonial-collections/pull/340
Since the file that shows typescript errors is removed.


Incorporate compiler-plugin code-generators to unique service path generation logic

Description:

$subject

This is an improvement to #1813
Related to ballerina-lang change #33987

Currently when using bal run command with automatic service-path generation enabled will give a runtime error.
error: Error retrieving Service Information: service path not found
	at ballerina.websub.2.Listener:retrieveGeneratedServicePath(sub_listener.bal:114)
	   ballerina.websub.2.Listener:executeAttach(sub_listener.bal:104)
	   ballerina.websub.2.Listener:attach(sub_listener.bal:72)

This happens due a limitation in our current approach. This could be resolved by using compile-time code-generators.
Hence marking this issue as a bug.


fix: remove defaultValue if value is added to component

In the case that a component becomes controlled due to state reference, but the customer has added a defaultValue prop the defaultValue prop should be removed to avoid react warnings.
This change modified the order of some functions so the import order has changed as a result.

Codecov Report

Merging #403 (092106b) into tagged-release/q1-release (c5e0b3c) will increase coverage by 0.03%.
The diff coverage is 97.22%.

@@                      Coverage Diff                      @@
##           tagged-release/q1-release     #403      +/-   ##
=============================================================
+ Coverage                      93.07%   93.11%   +0.03%
=============================================================
  Files                             44       44
  Lines                           1734     1744      +10
  Branches                         391      390       -1
=============================================================
+ Hits                            1614     1624      +10
  Misses                           116      116
  Partials                           4        4

Impacted Files
Coverage Δ

...eact/lib/react-component-with-children-renderer.ts
94.64% <ø> (-0.82%)
:arrow_down:

...ckages/codegen-ui/lib/common-component-renderer.ts
100.00% <ø> (ø)

...gen-ui-react/lib/react-studio-template-renderer.ts
91.01% <95.23%> (+0.13%)
:arrow_up:

...-react/lib/react-index-studio-template-renderer.ts
100.00% <100.00%> (ø)

...-react/lib/react-theme-studio-template-renderer.ts
88.46% <100.00%> (+0.22%)
:arrow_up:

packages/codegen-ui-react/lib/workflow/mutation.ts
96.51% <100.00%> (+1.38%)
:arrow_up:

...ackages/codegen-ui/lib/studio-template-renderer.ts
100.00% <100.00%> (ø)

Continue to review full report at Codecov.

Legend - Click here to learn more
Δ = absolute <relative> (impact), ø = not affected, ? = missing data
Powered by Codecov. Last update c5e0b3c...092106b. Read the comment docs.


Stamp icon

Icon Request

Icon name: Stamp
Use case: Stamp tool in image editors; stamp in loyalty apps
Screenshots of similar icons:

I guess something like this could work, but I'm not quite sure it's readily recognisable:

Looks a bit like a baby pacifier to me 🙈 Perhaps less rounded edges, kinda like in Trophy icon, could do the trick?

Maybe adding an extra line also helps?

The roundiness is much better now IMO! As for the line... I don't know, maybe it helps a bit?

Maybe try one with just a line at the bottom @karsa-mistmere ?

I've tried that already, IMO it looks pretty OK if I violate the 2px gap guideline and a bit funny if I don't:

Again, as with people icons, maybe the guidelines need to be adjusted. Maybe we could add a clause that states a 1px gap is acceptable in instances where it is necessary to add negative space but the separate elements would also work as a single path or without a gap. Some other icons would also benefit from such allowance I think e.g.:

I think the first one is not bad if you look at the 100% version. I'm only not sure about the line in the middle, I would say keep it as simple as possible.

I'd vote for the version with the line, but it's not like I'm anyone you should listen to regarding design stuff :)

Yeah, something completely new that I think works better than all previous ones:

I'd vote for the first or third one (see above).

My favs:
https://github.com/lucide-icons/lucide/issues/883#issuecomment-1315032498 2nd one
https://github.com/lucide-icons/lucide/issues/883#issuecomment-1315397313 1st one


Release 0.3.1

Codecov Report

Merging #128 (da1aa0f) into main (a5c3f0e) will not change coverage.
The diff coverage is n/a.

@@           Coverage Diff           @@
##             main     #128   +/-   ##
=======================================
  Coverage   56.70%   56.70%
=======================================
  Files          46       46
  Lines        1388     1388
=======================================
  Hits          787      787
  Misses        601      601

Continue to review full report at Codecov.

Legend - Click here to learn more
Δ = absolute <relative> (impact), ø = not affected, ? = missing data
Powered by Codecov. Last update d98d5f2...da1aa0f. Read the comment docs.


Microsoft Entra Verified ID is now GA

Microsoft Entra Verified ID now generally available - Microsoft Tech Community
#ATCP

@barclayn
Can you review this PR?
IMPORTANT: When this content is ready to merge, you must add #sign-off in a comment or the approval may get overlooked.
#label:"aq-pr-triaged"
@MicrosoftDocs/public-repo-pr-review-team

@bolt-io : Thanks for your contribution! The author(s) have been notified to review your proposed change.

Updated to resolve merge conflicts

Learn Build status updates of commit 90452ea:
:white_check_mark: Validation status: passed

File
Status
Preview URL
Details

articles/active-directory/verifiable-credentials/decentralized-identifier-overview.md
:white_check_mark:Succeeded

articles/active-directory/verifiable-credentials/how-to-dnsbind.md
:white_check_mark:Succeeded

articles/active-directory/verifiable-credentials/how-to-opt-out.md
:white_check_mark:Succeeded

articles/active-directory/verifiable-credentials/how-to-register-didwebsite.md
:white_check_mark:Succeeded

articles/active-directory/verifiable-credentials/how-to-use-quickstart-idtoken.md
:white_check_mark:Succeeded

articles/active-directory/verifiable-credentials/how-to-use-quickstart-selfissued.md
:white_check_mark:Succeeded

articles/active-directory/verifiable-credentials/how-use-vcnetwork.md
:white_check_mark:Succeeded

articles/active-directory/verifiable-credentials/introduction-to-verifiable-credentials-architecture.md
:white_check_mark:Succeeded

articles/active-directory/verifiable-credentials/plan-issuance-solution.md
:white_check_mark:Succeeded

articles/active-directory/verifiable-credentials/plan-verification-solution.md
:white_check_mark:Succeeded

articles/active-directory/verifiable-credentials/verifiable-credentials-faq.md
:white_check_mark:Succeeded

For more details, please refer to the build report.
Note: Broken links written as relative paths are included in the above build report. For broken links written as absolute paths or external URLs, see the broken link report.
For any questions, please:Try searching the learn.microsoft.com contributor guidesPost your question in the Learn support channel

#sign-off


Local installation only works with non-hashed access token

I just finished setting up the repo locally and finally figured out that for a subject access token created in Nightscout, I had to remove the sha1 hashing code for NIGHTSCOUT_API_TOKEN and just export it as-is.

Same for me. I always used the "not-hashed" token.
But there have been users who had to hash the token in order to use it. Unfortunately, there is no fully plausible documentation on Nightscout.


Change openapi_spec function to cache spec.

change the function signature and make it only generate once

[!WARNING]
This pull request is not mergeable via GitHub because a downstack PR is open. Once all requirements are satisfied, merge this PR as a stack on Graphite.
Learn more

#590
#589  👈
#588
main

This stack of pull requests is managed by Graphite. Learn more about stacking.

Join @rohinb2 and the rest of your teammates on  Graphite

Merge activity

Mar 14, 5:10 PM EDT: @rohinb2 started a stack merge that includes this pull request via Graphite.


fix filter examples, semicolon missing

Please can this be merged? It would have saved me literally over an hour of headscratching.

👍


Machine Learning - Roadmaps and Resources :Adding ML Roadmap and Resources

Closes #142
Description

I have added a folder containing all the resources and roadmaps to learn Machine Learning for an absolute beginner

Checklist
I have carefully reviewed and adhered to the contributing guidelines before creating this pull request.

@sanjay-kv Have a look at it. Also add the labels to it


node-scrypt don't support Node v12

Similar error when installing a package that depends on scrypt-js as this issue: https://github.com/barrysteyn/node-scrypt/issues/193
Could you give any help on it? Thanks in advance!

I don’t think I depend on NaN for anything in this package, is it not working? I haven’t tried node 12 yet, but will check on it this week.

@ricmoo Thank you for response. And I use this package under node v12, and building failed with a similar errors. I'm not sure if it is due to scrypt-js but it must be relative to node-scrypt.

I've just confirmed that script-js works fine in node v12.
I've never used the node-scrypt package, but that is unrelated to this repository and not a project I have anything to do with...
Maybe you can convince your upstream dependencies to switch to scrypt-js, or by the looks of it, switch to my ethers library, which uses scrypt-js. :)

@ricmoo I see. And have a glance at ethers and it looks nice, I'll have a try. Thank you very much!


Added generic-world-time

Q
A

Bug fix?
no

New sample?
yes

Related issues?

What's in this Pull Request?
Added generic-world-time.

Very cool sample @tecchan1107, thanks!


docs: first classification program

Closes #1031
Summary of Changes
We have the Titanic example ready for documentation.

:tada: This PR is included in version 0.18.0 :tada:
The release is available on:

npm package (@latest dist-tag)
npm package (@latest dist-tag)
v0.18.0
GitHub release

Your semantic-release bot :package::rocket:


Prohibit http-client from throwing exceptions for non 2xx response status codes

I need some clarification on the purpose of this change before I can accept
it. What issue does this solve?
On Feb 9, 2017 12:45 PM, "Pavlos Georgiou"<EMAIL_ADDRESS>wrote:

You can view, comment on, or merge this pull request online at:
https://github.com/kallisti-dev/hs-webdriver/pull/118
Commit Summary

Prohibit http-client from throwing exceptions for non 2xx response
status codes

File Changes

M src/Test/WebDriver/Internal.hs
https://github.com/kallisti-dev/hs-webdriver/pull/118/files#diff-0
(3)

Patch Links:

https://github.com/kallisti-dev/hs-webdriver/pull/118.patch
https://github.com/kallisti-dev/hs-webdriver/pull/118.diff

—
You are receiving this because you are subscribed to this thread.
Reply to this email directly, view it on GitHub
https://github.com/kallisti-dev/hs-webdriver/pull/118, or mute the
thread
https://github.com/notifications/unsubscribe-auth/ABdZhFIWu6t1nPG_ARJsHYBSoeFIZUnZks5ra1CYgaJpZM4L8ciy
.

If selenium server responds with 500 http client will throw SomeException and the json response will never reach the handler you have that maps responses to FailedCommandType errors. With this patch http client does not throw SomeException in IO and the response flows through.

I had 500s from selenium for errors such as StaleElementReference which is clearly a non exceptional thing

Seems like this was fixed in http-client version 0.5.0 https://hackage.haskell.org/package/http-client-0.5.5/docs/Network-HTTP-Client.html#v:checkResponse. I will close this PR.


nixos-unstable advanced despite timeouts in tested

Issue description
https://hydra.nixos.org/build/82148855#tabs-constituents
https://hydra.nixos.org/job/nixos/trunk-combined/tested/latest-finished
I don't see a good reason for this behaviour, and it appears that channels can potentially bump despite massive timeouts, which could mask failures. This appears to be critical.
Of note:

There are no non-timeout failures. I believe this might be the culprit.
All the timeouts happened on packet-t2-4

Steps to reproduce
Technical details
Please run nix-shell -p nix-info --run "nix-info -m" and paste the
results.

I've noticed that sometimes Hydra shows jobs as timed out even after the same package was successfully built as a dependency of another job. Could that be related?

@xeji I don't think so in this case, due to the nature of the tested job?

Also thanks @etu for the heads-up.

All build steps show all as succededed: https://hydra.nixos.org/build/82148855#tabs-buildsteps

I guess we can check every out path to confirm that it's a false negative.

Checking the out-path of the tested aggregate:
nix path-info /nix/store/qyvy2six4gb2r275g25whfgdzf2wf2fk-nixos-19.03pre153673.a70d3bab72d --store https://cache.nixos.org
is a positive match, so the failures appear to be false negatives at least.

Looks like a Hydra bug.

I'll refile it later then.

I assume somebody restarted the tested job without restarting the constituents. The fact that the former succeeded implies that all its dependencies succeeded as well.

Thank you for that explanation @edolstra


README.md: FIxed typo

Replace 'globoi' with 'globocom'

Coverage remained the same at 89.344% when pulling 36efb7f3c9f0a8f10144c7efd3a239c67d9ad4c3 on marcelometal:patch-3 into 16d22f8ee905f5fcd665ccdb5b057dbcca3cbb92 on globocom:master.


Layout is messed up with too many commits in graph

Try putting in my username - because I have a couple particularly high-commit days, the graph seems to flow outside the region, and the dropdown from the menubar becomes scrollable.

Humm... I don't see it here...

Can you attach a screenshot too? Also, you can try right click on the Github Pulse icon, it should refresh the WebView, so we can know if it's going to keep constantly happening or just happens sometimes...

Right-clicking definitely fixed it, thanks!
I think it happened because I'd clicked it when I had 0 commits, and then I pushed 2, and clicked it again, and then it was messed up?

Humm, I see, but It shouldn't happen, I've done it before a lot of times during testing...
Looks like the size of the graph went mad, but makes no sense, because it's never updated.
Anyway I'll leave this open and look deeper into it as soon as I've finished the chrome extension to(day|morrow).

I'm closing it here and tracking it on #18.


Nested blockquote accent lines not consistent with parent blockquote

Open sandbox vault and install Border
Create a blockquote with nested blockquotes, like so:

> TITLE
> > subtitle subtitle  subtitle  subtitle  subtitle  subtitle  subtitle  subtitle  subtitle  subtitle  subtitle  subtitle  subtitle  subtitle  subtitle  subtitle  subtitle  subtitle  subtitle  subtitle  subtitle  subtitle  subtitle  subtitle  subtitle  subtitle  subtitle  subtitle  subtitle  subtitle
> > > subtitle  subtitle  subtitle  subtitle  subtitle  subtitle  subtitle  subtitle  subtitle  subtitle  subtitle  subtitle  subtitle  subtitle  subtitle  subtitle  subtitle  subtitle  subtitle  subtitle  subtitle  subtitle  subtitle  subtitle  subtitle  subtitle  subtitle  subtitle  subtitle

Result:

The left accent lines of the children blocks extend further down compared to the parent's left accent line
The left accent lines of the children blocks don't have any radius, while the parent's does have radius

I just checked, and the blockquote accent lines have a rather complex structure in the DOM tree. This makes it nearly impossible to style them with CSS alone to match the parent blockquote. Sorry.


Add a new 'Styling' category to the 'Documentation issue' template

Adds a new 'Styling' category to the 'Documentation issue' template.
Context
Otherwise it's not clear what issue should be selected. The other categories don't seem related.
For example, these issues:

#27621
#27623

Contributor Checklist

[ ] Review Contribution Guidelines
[ ] Make sure that all commits are signed off to indicate that you agree to the terms of Developer Certificate of Origin.
[ ] Make sure all contributed code can be distributed under the terms of the Apache License 2.0, e.g. the code was written by yourself or the original code is licensed under a license compatible to Apache License 2.0.
[ ] Check "Allow edit from maintainers" option in pull request so that additional changes can be pushed by Gradle team
[ ] Provide integration tests (under <subproject>/src/integTest) to verify changes from a user perspective
[ ] Provide unit tests (under <subproject>/src/test) to verify logic
[ ] Update User Guide, DSL Reference, and Javadoc for public-facing changes
[ ] Ensure that tests pass sanity check: ./gradlew sanityCheck
[ ] Ensure that tests pass locally: ./gradlew <changed-subproject>:quickTest

Reviewing cheatsheet
Before merging the PR, comments starting with

❌ ❓must be fixed
🤔 💅 should be fixed
💭 may be fixed
🎉 celebrate happy things

Thank you for your contribution!
The DCO check is failing, please look into that as we can't accept the PR otherwise.

Sorry, I don't have an option to add a DCO.

Sorry, I don't have an option to add a DCO.

I assume you created this PR via Github UI and we didn't have an automatic DCO. It's fixed now.
Because of legal reasons, I can't merge this PR (😵💫). Are you ok with me just copying it?  Or you can close this PR and redo the change, it should be signed off.

Closing in favor of #27691


Bump version & reformat changelog

Description

Bump the version to 1.10.0
Reformat the change log to flow better

Validation

Related Issues

Resolves #562
Resolves #561

Check List

[x] I confirm that my contribution is made under the terms of the Apache 2.0
license.
[ ] I have run pnpm checks to ensure code compiles and meets standards.
[ ] I have run pnpm test to check if all tests are passing.
[ ] I have covered new added functionality with unit tests if necessary.
[x] I have added an entry in the Changelog.md.

Rebased to get the changelog entry from #575