Brain Dump - Raju Alluri

Bahubali and The Lion King Resemblance

Raju Alluri 1 Comment Brain Dump, Entertainment, Movies

There are very few stories. It is the storytelling that counts.

The above statement is very true for movies. I have been a big fan of Disney’s The Lion King. The storyline of Bahubali has a strong resemblance to that of The Lion King, even though the storytelling takes a completely different route and takes gigantic proportions.

Storyline	Bahubali	Lion King
The Good King	Amarendra Bahubali is the good king that is refused the throne and eventually gets killed	King Mufasa is the good king that gets killed
The Bad Brother	It is the King’s antagonist brother Bhallaladeva that mastermindsÂ the killing of Amarendra Bahubali	It is the King’s antagonist brother Scar that plans the killingÂ of Mufasa
The Captive Queen	Devasena is held captive in Maahishmati by Bhallaladeva	Sarabi is forced to hunt for Scar and the hyenas, resembling slavery
The Kingdom	Maahishmati: People are sick and tired of Bhallaladeva’s cruel rule	The Pride Lands: The herds and packs are starving and shrinking under Scar’s inept and cruel rule
The Far Away Prince	Mahendra Bahubali grows up in a remote place without realizing that he is the prince of Maahishmati Kingdom	Simba runs away and grows up in a remote place without acknowledging his princehood
Prince Returns forÂ Love Interest	Mahendra Bahubali searches for his eventual love interest Avanthika and returns to Maahishmati to fulfill her task of freeing Devasena	Simba meets his friend and eventual love interest Nala and that leads to his return to the Pride LandsÂ and freeing of Sarabi
TheÂ Lookalikes	Mahendra Bahubali’s resemblance to Amarendra Bahubali is the key factor in the story that leads to many scenes with Bhallaladeva, Devasena and Kattappa (in the first part itself.) His resemblance brings cheers to many in the kingdom and fear to the antagonists	Simba’s resemblance to Mufasa and the former’s realization of the same is the key turning point of the story. His resemblance scares Scar and brings joy to Sarabi and rest of the pride rock
The Exploring	Mahendra Bahubali, as a kid, wants to explore what is on the other side of the high mountains. He does several unsuccessful attempts as a kid to explore beyond the mountains. Once he becomes successful doing so as an adult, the story takes a new turn	Simba’s exploratory interests are the key part of the story and his attempts end him up in big trouble. That forms the crux of the storyline and his run away from the kingdom
The Trustworthy	Kattappa, the trustworthy general and trainer that has bald head and large white beard. Discloses the identity of Mahendra Bahubali to the later and gives him an account of his own past.	Rafiki, the trustworthy shaman and advisor who has bald head and large white beard. Makes Simba realize who he really is and what his responsibilities are.
The Pride	Pride Ride	Pride Rock
Announcing the Prince	Mahendra Bahubali	Simba

Does that make you think that the storyline of Bahubali is lifted from The Lion King? You are very much wrong if you do so. There are several Telugu movies that follow similar lines (Jayam Manadera to Aadi to Indra) where the protagonist lives elsewhere without taking up his true identity and eventually comes back to claim his throne or leadership position. In fact, the faction movie series of Telugu Film Industry have considerable resemblances to The Lion King at some point or other. So are some of the early folk movies of Indian Film Industry. For that matter, all these movies have some resemblance toÂ William Shakespeare’s Hamlet in which Prince Hamlet is true heir of King Hamlet but King Claudius takes the throne.

Then why this post? I strongly believe that the storyline of the movie is of lesser importance when there is good storytelling. On the eve of the release of Bahubali – The Conclusion, I am looking forward to watch a very good storytelling. I care less for the story that I already know of from several other movies.

IT, Android One and BYOD

11 Jun

Raju Alluri 0 Comment Brain Dump, Other Opensource, Security, Technical

BYOD (Bring Your Own Device) is now a paradigm that is tightly integrated into IT spectrum. IMO, Android One helps simplify the life of IT staff while handling user owned devices that operate on data that is owned by the organizations.

The IT staff’s ownership over the client devices/end points is reducing very fast in recent years. This is due to the use cases that focus on end users,Â service providers, partners and internal employees that are continuously contributing to the data of an organization. Despite reducing level of ownership of these devices, the IT staff continue to have a responsibility to prove that they have adequate controls over these devices and their data.

For example, signatures of customers and delivery details on delivery personnel’s client devices should be ascertained with to all the integrity and confidentiality controls by IT staff of any shopping website and its delivery partners. There were times when the client devices are custom made solutions for the delivery companies, but smart phones are rapidly replacing these legacy client devices. More often than not, these smart phones are owned and updated by individuals rather than organizations. Hence these BYOD devices pose a challenge to the IT staff and increase threat to the data confidentiality and integrity.

The major challenge for IT staff is to ensure that all the nomadic client devices are running approved, stable and latest stack. In olden days (say about 10 years ago), the client devices are mostly laptops that need to be patched and upgraded regularly, along with appropriate user access controls on these devices. With the proliferation of smart phones as client devices, the challenge goes multi-fold. Wearing an IT Professional’s hat, I do see every smart phone like this:

The moment I think about manageability of that smart phone (not ownership of the smart phone, which is never going to happen), I see the smart phone as

The IT stack in the above picture is a combination of various off-the-shelf and home grown applications, together with well tested configurations of these applications. More often than not, the IT stack applications and configurations heavily depend on the underlying Android Stack. That means it pays to support these applications and configurations on a limited set of latest versions of Android.

When it comes to the upgrades (read patching) of the Android stack, both the carrier and vendor have long release cycles in place for stack upgrades on target devices. As a result, most smart phones that are more than a year old end up running Android versions that are old and probably not patched fast enough. This is true with any mobile OS though, not just with Android.

Supporting the IT Stack in the above picture is a nightmare for IT staff if they are to support this on multiple and older versions of mobile operating systems. Due to this, the IT staff may want the mobile phones to run with the latest OS. But the large release cycles of phone vendors and carriers often become a hurdle to accomplish this.

Android One (https://www.android.com/one/) is the best solution out of that version control mess. I have been using a cost effective and reasonably powered Android One phone since 2014. Over the last year and half, this phone has become my device of choice for use cases that strictly require latest versions of Android Platform and its eco system. The use cases include IT tools like VPN connectivity apps, single sign-on solutions, device control/erase solutions, messaging solutions and sharing solutions. This $100 unlocked dual SIM phone is a very reasonable investment for accomplishing adherence to stringent IT policies.

Android One is supported by phones that are very high end (e.g. the Nexus series sold directly by Google) all the way to cost effective phones in emerging economies. In almost all cases, the phones come with unlocked versions, leaving a wider choice of carriers to customers.

Updates to my Android One smartphone have been regular and painless in the last year and half. The ability to grab the latest update of Android within a few hours makes Android One my preferred choice.

In any BYOD centered IT infrastructure, Android One is the best way to go for IT staff to enforce tighter IT policies on smart phones while ensuring that the user devices are running with latest version of the mobile stack. That in turn ensures that the IT stack on the smartphone is current and easy to manage.

Driverless Cars: Moral and Legal Considerations

09 Aug

Raju Alluri 0 Comment Brain Dump, Economy, Entertainment, Interesting, Technical

Driverless cars are no longer a fantasy. Despite being far from general purpose use, this technology is evolving leaps and bounds, thanks to players like Google and Tesla making steady progress on this technology. As the technology evolves and enters into public life, several legal and moral issues are going to crop up.

The recent issue of Communications of the ACM carries a nice article describing the moral challenges of driverless cars. In this thought provoking article, the author brings up scenarios that bring up ethical and moral questions. To quote from the article,

However, should an unavoidable crash situation arise, a driverless car’s method of seeing and identifying potential objects or hazards is different and less precise than the human eye-brain connection, which likely will introduce moral dilemmas with respect to how an autonomous vehicle should react …

Driverless cars have potential to fare better than humans in 90% (or better) of the times. But the other small percentage of times usually bring in more ethical and legal dilemmas where humans would fare vast better than the technologies used in driverless cars. In these situations, human drivers are usually faced with multiple choices that vary in terms of amount of impact or destruction to property or humans. The senors and algorithms used in driverless cars (as they stand for the next few years) may have limitations in identifying the course that leads to least impact or least destruction. When the system operating a driverless car takes a non-optimum decision, there could be several legal and ethical ramifications.

As discussed in the above mentioned article, handing over control to a human driver in emergency situations is far from reality, given the response times needed by a disengaged human. Even the automation around a fully engaged driver’s action is being subjected to several legal questions around responsibility. For example, this article on WSJ discusses how Tesla’s autonomous car-passing feature intends to pass on the responsibility to the driver, by making it a driver initiated (e.g. turn on the signal) automation. Given that the same action of the driver in a car with and without these autonomous features results in drastically different ramifications, states like CA, NV and FL are mandating special registrations for drivers of autonomous vehicles. The registration is based on the level of autonomous features of the vehicle.

Beyond the responsibility question that touches the legal aspects, driverless cars technology needs to continually improve upon the ethical questions that come up during an emergency situation. For example, is it okay to crash the car in the next line to avoid a bicyclist who is jumping a pedestrian signal?

Then comes the integrity question around the autonomous features. What is the possibility of these features getting tampered or outdated? Is Tesla’s Over-the-air update going to be a typical standard for automakers across the globe?

In a nutshell, the legal aspects of driverless cars can be best handled by training the drivers for those specific features. However, the ethical aspects require more maturity of the technology. Add the complexity of changes in driving rules across multiple geographic regions (states, countries) and we are going to see a lot of technology evolution in this space.

Here are a few lingering thoughts that I have regarding driverless cars. I am more anxious to find the answers sooner.

What happens if the road sign standards change across borders? E.g. colors and sizes of signs across states, speed limits posted in miles vs. kms across countries. We may soon see a few settings on your dashboard to let the car know (or confirm) that you are driving in New Jersey or Maine or Canada.
Cars may be certified to run autonomously in certain areas only. Like “This car can use the autonomous features in CA and NV only, but not in AZ.”
Cars would be able to identify the speed limit on a signpost and ignore a similar looking sign on a billboard next to a freeway. Do they do it by improving their sensors or depend on a networked repository (say Google Maps) of speed limits in that area.
Visual congestion identification and taking alternate routes. Pretty simple given the current advances in maps technology.
In situations where disengaged drivers don’t have awareness of circumstances that led to an accident, cars may require legally acceptable sensor information logs. In other words, the cars would have scaled down versions of blackboxes like in aircrafts.
What if someone hacks the “car stack”? How does one get to know? Do we get to do a periodic (smog-check like) stack-check and certification? If this looks like a fantasy, please checkout the Tesla hack and fix a couple of days ago.

And here is an extreme one:

If it turns out that the damages caused in an accident by an autonomous car with a disengaged driver are much higher than the damages if an engaged driver were operating the car without autonomous features, what are the insurance ramifications? Would insurance companies track maturity levels of the autonomous features and charge accordingly for insurance?

I do live in interesting times.

Availability is a fundamental requirement of Security

11 Jun

Raju Alluri 0 Comment Brain Dump, Security, Technical

When people talk about security, they often picture confidentiality and integrity in their mind. However, the role of availability is equally important while defining the security. In fact, the term security is defined as a combination of confidentiality, integrity and availability by major standards and certifications.

There is a quote on a lighter tone in security community: The most secure computer may be the one that is not connected to any network. But such systems hardly play any major role in providing meaningful services to customers and consumers. The goal of a security expert is to ensure that the system (and its services) are available to all the intended users, while preserving the confidentiality and integrity of the data, system and its services.

For an end user facing service (say, a shopping site or a cloud service) to operate as expected, it requires several internal or public facing infrastructure services to operate in tandem. A shopping site might require its DNS service (public), CDN service (public) payment exchange (public) and private cloud service (internal) to function properly for delivering its online services to end customers. As the comprehensiveness of online services increase, there are more and more micro-services, infrastructure services and housekeeping services that play a major role in determining the health and availability of the overarching (end user facing) service.

As big companies increasinglyÂ outsource their IT infrastructure to cloud service vendors (DNS, mail, compute infrastructure, to name a few), they increasingly depend on availability of each of these infrastructure components. As cloud service providers mature their infrastructure services, they become more and more alluring to small enterprises and startup companies, given the lower entry cost and least effort to scale up. In a nutshell, the availability of services outside the perimeter of a company, irrespective of its size, becomes essential element in offering secure services to the employees and customers of that company. On a side node, the definition of the perimeter of a company is fast diluting with more and more cloud service providers offering infrastructure services.

Even for companies that internally host their infrastructure services, the availability of these services is the most critical component in providing secure services to their end customers or employees.

Lack of availability of contributing components severely impacts security of an online service. Lets take a look at a simple example. When an authentication and authorization component operates at lesser availability levels, users of that component (developers, IT admins) make amends to lessen the impact of non-availability. For example, they may want to cache a few things for a longer amount of time. That makes any online service that depends on that authentication and authorization mechanism more vulnerable than a service that operates on top of a highly available authentication and authorization service. As more and more amends are made to reduce the impact of availability of internal components, the online service gets more holes in its security.

Every developer and IT engineer should work towards providing hooks for availability metrics and augmenting them with actionable operating procedures when availability gets impacted. These hooks and procedures should be fine-tuned as time goes on and as new factors influence the availability.

Every security expert should look at availability of an online service and that of its internal components as fundamental requirement for ensuring security of such service. Ample bells and whistles (in the form of monitoring and management infrastructure) should be setup to catch availability issues within an online service’s eco-system. Trends related to lesser availability of a component and service need to be detected and acted up on.

Data Insurance: to Limelight and Mainstream

31 Dec

Raju Alluri 0 Comment Brain Dump, Economy, Security, Technical

In contrast with other essential elements of human life like death and taxes, the history of insurance has been very short. However, in terms of evolution, the concept of insurance has been constantly changing and continuously embracing new domains. Insurance of properties, life, health, beauty, athletic talent and limbs are very trivial now. Data insurance, which has been limited once to multi-billion dollar corporates and that too for limited scenarios, is now taking center stage.

The drivers for data insurance existed for quite some time, but they haven’t proliferated into human life and organizational practices as it happens now. The key drivers pushing the trend towards data insurance are the protections we need against data loss, data compromise and data misuse.

Organizations, as they evolve in their presence over web, social networks and mobile applications, are capturing more and more data. The rest of the discussion in this article focuses on two categories of this data.

Acquired data: All the customer information, employee information and any other user information collected directly or indirectly from the users constitutes this acquired data. By nature, this class of data is highly likely to have sensitive information that includes personally identifiable information (PII), credit card information, etc.
Generated data: All the housekeeping, analytics and user behavior data in an organization falls into this category. This data is very vital in deliveringÂ better user experience to both end users and internal teams. This data is mostly generated by an organization’s web/mobile applications that interface with end users and may be augmented with data inferred from other user interactions like support calls and email exchanges.

Any compromise on acquired data leads to a very big exposure – loss of face, legal tangles and/or customer loyalty issues. The data compromises detected at companies like Target and Home Depot are leading to customer unrest, loss of loyalty and severe financial implications from legal consequences.

Any compromise of generated data makes an organization limp (often heavily) in their business process. Generated data compromise mostly leads to inefficiencies and exposure of the secret sauces to competition.

The impact of a compromise on generatedÂ can’t be taken any lightly when compared to the impact of acquired data compromise. The generated data may also include intellectual property related items that could hurt a company in the long run when that data is compromised.

Digital (or digitized) data captured by humans also is increasing in its prominence,Â value and the risk of compromise. Whether it is personal pictures of celebrities or tax data of individuals, the risk associated with any compromise of this data is increasing over time. As the data access avenues are increasing (e.g. health data accessed via a wearable device), the potential for compromise of personal data is also increasing.

Given all this increased focus on data and its risks, we see a bigger shift towards insuring the data by corporations and individuals. Data Insurance is taking new paths that are less traveled by insurance companies in the past. Data Insurance packages now contain and cover a wide variety of data sets.

Just like humans undergo a set of prerequisite tests before taking a new health insurance package, data sets might undergo certain audits that cover the access controls and security risks associated with this data. We may also see a trend towards re-audits during renewals of data insurance to re-validate the access controls and risks.

The key factor in Data Insurance is determining the value of data. Human life insurance packages usually cover sums like 5x annual income. Vehicle insurances usually cover up to the Bluebook value of a vehicle. Coming up with valuation for data is not that straight forward though. The valuation process might differ greatly between acquired data and generated data. Unlike constant depreciation of a vehicle’s Bluebook value, the value of data may either decrease (data that becomes stale over time) or increase (with volumes or with increased sensitivity of same data) over time. Data Insurance companies and the insured organizations/individuals will often be re-evaluating the value of data to optimize costs and minimize the impact of exposure.

In summary, here are some of the primary factors by which data insurance evolves:

Categorization of data
Valuation of data
Data audits

As data insurance hits mainstream, all these factors experience market growth and some sort of standardization beyond what we have today.

Swachh Bharat Campaign: My Thoughts

31 Oct

Raju Alluri 0 Comment Brain Dump, Interesting, Misc

Now that (apparently) the initial euphoria around the Swachh Bharat initiative has died down and people are settling back to their normal course of action, here are my thoughts on this great initiative.

The Swachh Bharat initiative is my long term wish for India come true. The moment I set my foot on western hemisphere almost a couple of decades ago, I realized how different surroundings can be made to look like. After relocating back to India a while ago, lack of cleanliness has been one of my big pain points that I have been trying fix across the board.

The Swachh Bharat initiative by our Prime Minister Shri Narendra Modi is right on spot and we all should thrive to see a clean and green India. However, just like many of the good initiatives, this one might make people get carried away in executing it the wrong way.

For an initiative to get popularity, we either need to document widespread participation or measurable results. Some popular initiatives get their popularity due to participation and others get popularity due to socializing of sustained results. Often, people take the first route and document the participation. Three hundred people posting their pictures on a social networking site for an event gets an event more popularity than documenting the fact that three thousand people actually participated in it.

People seem to be more inclined to post their participation in Swachh Bharat by clicking a few pictures while cleaning up a road or premises. I haven’t seen anyone posting a picture of a road or premises that stayed clean over a period of time.

In other words, instead of fixing the symptoms, we should fix the root cause and make sure that the symptoms don’t show up time and again. That is the best sustainable path to success.

For Swachh Bharat to become a lifestyle (not just an initiative), we need to focus on the following:

Reducing the opportunities to make any road or premises unclean. For example, Indian Railways came a long way in keeping many platforms and stations in clean state when compared to 15 years ago. The train tracks, compartments and some stations are not clean enough yet, but we have seen a good improvement recently. All they did is to force every vendor to keep a trash bin next to the stall and increased the number of general purpose trash bins. This led people to eventually get to the habit of using the trash bins than platforms to dump the waste. We need to take similar approach to ensure that people participate more in keeping things clean than making things clean.
Ensuring that people understand the importance of keeping things clean. We need to slowly, but surely, eradicate the “not my job” attitude when it comes to keeping public and common places clean. Some part of it comes from forced legislation (I like the positive impact of “No smoking in public places” rule) and rest of it should come from people’s belief and passion. This is where politicians and celebrities can help by taking the message to masses. I like a celebrity’s picture of cleaning a road, but that should somehow translate to a message that keep things clean first.
Clean up – This is how the initiative is currently being perceived in mass media. Even though it is a good start, it should slowly get to the back stage and give room to the other two focus points mentioned above. Clean ups should be regular, can even be voluntary by people who are no way in that role, but shouldn’t be just momentary.

In summary, I want to see Swachh Bharat to become a lifestyle than an being an initiative by our Prime Minister. We all should focus on keeping places clean than cleaning up places as an aftereffect. That way, we can head to seeing a sustainable Swachh Bharat.

Category: Brain Dump