text:
\section{Related Work}
\label{sec:relatedWork}

Previous studies on crypto misuses have primarily focused on Android applications and identified that 88~\% to 99~\% of the applications using crypto have at least one misuse~\cite{egele_empirical_2013, muslukhov_source_2018, kruger2019crysl, rahaman_cryptoguard:_2019, piccolboni_crylogger_2021}.
Beside Android applications, Krüger et al.~\cite{kruger2019crysl} inspected maven artifacts, mostly Java libraries.
To demonstrate the scalability of their tool \textit{CryptoGuard}, Rahaman et al.~\cite{rahaman_cryptoguard:_2019} analyzed 46 Apache projects in addition to their set of Android applications.
All studies focused on precision from the tool's perspective, rather than understanding false positives from the developer's or security analyzer's perspective.
An exception is an exploratory study~\cite{hazhirpasand2020java} that opened issues for some identified misuses.
The results obtained mostly agree with the feedback we received from the disclosure as well as with our manual analysis.
In contrast, we not only rely on the judgement of developers by manually analyzing the misuses.

Beside Java, IoT firmware, iOS applications and Python projects have been analyzed, revealing that nearly one fourth to 82~\% of the software is vulnerable~\cite{zhang_cryptorex_2019, li2015icryptotracer, feichtner_automated_2018, wicker2021Python}.
Previous research about misuses in code available from Q\&A platforms such as Stack Overflow
reveals that 71~\% to 90~\% of the posts have at least one misuse~\cite{braga_mining_2016}. %
Thus, 98~\% of the Android Apps with code copied from Stack Overflow snippets have at least one misuse~\cite{acar_comparing_2017}.

\section*{Acknowledgments}
We want to thank the anonymous reviewers and everyone who supported us on our journey to publish this work.

This research work has been founded by the Deutsche Forschungsgemeinschaft (DFG, German Research Foundation) – SFB 1119 – 236615297 and – SFB 1053 – 210487104 – and by the German Federal Ministry of Education and Research and the Hessen State Ministry for Higher Education, Research and the Arts within their joint support of the National Research Center for Applied Cybersecurity ATHENE, by the LOEWE initiative (Hesse, Germany) within the emergenCITY center.

\section{Introduction}
\label{sec:intro}

Many applications need to protect sensitive and high-value data, such as passwords or financial transactions,
using cryptography (hereafter referred to as \textit{crypto}).
For this purpose, crypto APIs provide access to crypto tasks, protocols, and primitives in all major programming languages.
However, several studies have revealed that developers struggle to use crypto APIs~\cite{lazar_why_2014,nadi_jumping_2016} correctly and introduce misuses, meaning that an API usage may be
used syntactically correct but problematic from a security perspective.
A common crypto misuse is the use of the \textit{Electronic Code Book (ECB)} mode for encryption.
Although it has been known for a long time that
\textit{ECB} is insecure~\cite{egele_empirical_2013}, it was, e.g.,
found in
the widely used Zoom video conferencing system
until May 2020\footnote{\url{https://support.zoom.us/hc/en-us/articles/360043770412-Updating-your-Zoom-Rooms-to-version-5-0-5}}.

To address this problem, static analyzers such as \textit{SpotBugs}\footnote{https://spotbugs.github.io/},
\textit{CryptoGuard}~\cite{rahaman_cryptoguard:_2019}, and \textit{CogniCrypt\textsubscript{SAST}}{}~\cite{kruger2019crysl}, have been proposed to support developers and security researchers in checking for such misuses.
These tools have been used in various empirical studies that have produced worrying insights into the state of crypto usages in the wild \cite{egele_empirical_2013, kruger2019crysl, rahaman_cryptoguard:_2019, gao2019negative}.
However, none of the studies performed a qualitative examination of the validity and severity of the findings.
Such an examination is, however, essential for both getting a more realistic picture of the state of crypto usages in the wild and %
to improve future studies and analyzes.
It is well-known that static analyzes may produce false positives, which are considered their \emph{Achilles heel}~\cite{johnson_dev, wagner2005comparing}.
Moreover, in a security context, the validity of any finding should be judged from the perspective of a threat model to get a feeling for its severity.

This paper contributes to closing this gap by designing and conducting a study focusing on qualitative examination of reported crypto misuses.
With regard to false positives, we are particularly interested in reports that are specific to their concrete usage.
An API may be used in different – non-crypto - contexts and not the same constraints apply in all contexts.
For example, the most misused JCA class \code{MessageDigest} from previous studies~\cite{gao2019negative,kruger2019crysl,rahaman_cryptoguard:_2019} may be used to compute hashes independent of a security context, e.g., to compute the hash of a file.
However, a static analysis cannot know this and has to be conservative.
Thus, it may produce false positives and draw an inaccurate picture of the security of our software.
With regard to qualitatively judging the severity of findings, we formulate and use a novel, comprehensive threat model.
Specifically, we designed and conducted a study to answer the following research questions:
\begin{enumerate}
    \item[RQ1:] What are common (effective) false positives arising from misuses, e.g., due to a non-security context?
    \item[RQ2:] How severe are the vulnerabilities introduced by crypto API misuses in applications?
\end{enumerate}

We studied crypto misuses
of two Java crypto providers -- the Java Cryptography Architecture (JCA) and Bouncy Castle (BC) -- in open-source Java projects from GitHub
using \textit{CogniCrypt\textsubscript{SAST}}{}~\cite{kruger2019crysl}.
We only included projects that are mainly developed and maintained by professionals to address the generalizability problem of open-source studies~\cite{spinellis_dataset_2020}.
Altogether, we collected
936 Java projects, of which \pgfkeysvalueof{projects_all} use a crypto API and \pgfkeysvalueof{misuses_jca_project_perc}~\% have at least one misuse.

To qualitatively analyze the misuses,
we randomly picked 157 misuses
for review.
We observed that one fourth of the misuses of the class \class{MessageDigest} -- the most misused class according to previous studies~\cite{kruger2019crysl, rahaman_cryptoguard:_2019, gao2019negative} and the second most in our study -- occur in a non-security context.
Thus, we can consider these misuses as \textit{effective false positives}~\cite{sadowski2015Tricorder}
that may not or cannot be fixed by developers.

To judge the severity of all findings, we defined a threat model that connects API misuses reported by \textit{CogniCrypt\textsubscript{SAST}}{} to security vulnerabilities.
This model subsumes the existing vulnerability model for crypto API misuses by Rahaman et al.~\cite{rahaman_cryptoguard:_2019} and includes new threats, e.g., \textit{Denial of Service} (DoS) attack and \textit{Chosen-Ciphertext Attacks} (\textit{CCA}). %
Overall, our model marks 42.78~\% of the
misuses as high severity.

In summary, this paper makes the following contributions:
\begin{itemize}
    \item We studied crypto misuses found in a large, representative data set of applications~\cite{spinellis_dataset_2020}.
    \item We provide empirical evidence that the reported misuses contain a significant amount of \textit{effective false positives}.
    Our disclosure confirms this and reveals that many may not be fixed even though some are ranked as high severity. %
    \item We created a novel, comprehensive threat model mapping crypto API misuses to vulnerabilities, introducing previously undiscussed threats like DoS attacks and CCAs.%
\end{itemize}

\section{Threat-model of vulnerabilities introduced by API misuses}

\label{sec:vulnerabilititesmodel}
To reason about the potential impact of the reported misuses, we contribute a threat model extending existing models~\cite{rahaman_cryptoguard:_2019} with more vulnerabilities caused by API misuses.
Specifically, we derive our model from a study of CrySL rules written by crypto experts, the respective APIs, and the misuses observed in our study.
In combination with standard attacks and crypto misuses from previous work, our model covers a wide variety of crypto API misuses and their attack potential.
We list the vulnerabilities, the attack types, the respective severity, the novelty, and the affected error types in Table~\ref{tab:vulnerabilities}. %

\begin{enumerate}
    \item \textbf{Predictability Through Initialization:}
Applications can become insecure if sensitive information like a key is predictable~\cite{egele_empirical_2013, rahaman_cryptoguard:_2019, lazar_why_2014}.
As an instance of this vulnerability, we consider predictable and constant crypto keys, e.g., a hard-coded key or predictable password used to derive a key from. %
Furthermore, a cryptographic secure random number in Java requires a non-predictable seed as well as the usage of a dedicated class, e.g., \texttt{java.security.SecureRandom}. %
If the application code misses to fullfill these requirements, the crypto operation becomes predictable.
While Rahaman et al.~\cite{rahaman_cryptoguard:_2019} separated predictable keys and PRNGs, our model combines them, as both attack types are due to predictability.

\item \textbf{Predictability Through Usage:}
In contrast to attacks of the type \textit{Predictability Through Initialization}, the improper usage of an API can render the respective computation predictable.
An example of this issue is the usage of crypto APIs which rely on data to be processed, e.g., \class{MessageDigest}, and fail to process the required data.
Thus, essentially resulting in a predictable computation.

\item \textbf{MitM attacks on SSL/TLS:}
The improper usage of SSL/TLS can enable an attacker to launch a Man-in-the-Middle (MitM) attack to gain sensitive information~\cite{fahl_why_2012}.
This includes improper configuration of connections, e.g., incorrect verification of protocols, as well as insecure cryptographic protocols,
e.g., TLS 1.1,
which are vulnerable to attacks like the POODLE attack.%

\item \textbf{Chosen-Plaintext-Attack (CPA):}
An encryption algorithm should be provably secure against chosen-plaintext-attacks (CPA)~\cite{egele_empirical_2013}.
An example is a
static \textit{Initialization Vector} (IV) for the \textit{Cipher Block Chaining} (CBC) mode.

\item \textbf{Chosen-Ciphertext-Attack (CCA):}
While an encryption scheme should be provably secure against CPA, it should also be safe against chosen-ciphertext-attacks (CCA).
Concretely, we cover improper padding schemes, like PKCS5 and PKCS7 in combination with the block cipher mode CBC~\cite{vaudenay2002security, klima2003side}, and the usage of plain RSA~\cite{bleichenbacher1998chosen} as these are all vulnerable to CCA.
Note, that a padding attack requires an interaction between the attacker and the program that responds to messages from the attacker.
Thus, data at rest is not vulnerable. %

\item \textbf{Bruteforce Attacks:}
Some cryptographic algorithms are vulnerable to repeated, extensive computations, e.g., a feasible collision computation for MD5 and SHA-1~\cite{stevens2017first}.
Further, primitives like DES~\cite{rahaman_cryptoguard:_2019} with a block size of 64~bit or a 64-bit authentication tag for GCM~\cite{ferguson_2005} are vulnerable to brute-force attacks to break the encryption.

\item \textbf{Credential dumping:}
In Java, string values are immutable and therefore cannot be cleared or overwritten from memory, except when the garbage collector runs, which is out of the developer's control.
Thus, the JCA enforces the usage of byte arrays, e.g., \code{PBEKeySpec}%
, to handle sensitive information.
However, developers may use strings to store this information and only convert it to byte arrays before calling the crypto API.
Furthermore, classes like \class{PBEKeySpec} provide the method \class{clearPassword} to clear the internal copy of the password.
However, usages of this class without calling this method render an application vulnerable to credential dumping.

\item \textbf{DoS Attacks:}
A Denial-of-Service (DoS) attack limits the availability of a service, e.g., by deliberately overloading the memory or consuming an extensive amount of CPU cycles.
One possibility to achieve this is by triggering an unintended behavior such as uncaught exceptions~\cite{wu2017uncaughtexceptions}.
Such exceptions can be raised when contradicting the API contract, e.g., by missing the initialization of a cipher object\footnote{\url{https://docs.oracle.com/en/java/javase/17/docs/api/java.base/javax/crypto/Cipher.html}, accessed 19.09.2022}. %
Depending on the program, such an exception can prevent further correct control flow,
can cause a program crash, or if triggered in rapid succession, it can spam the log file, increase CPU usage or cause IO congestion.
A recent example
is CVE-2021-23372, where an exception causes the application to crash. %
\end{enumerate}

We categorize the severity into high, medium, and low.
Our prioritization is based on factors like whether the vulnerability can be exploited remotely, how difficult an attack is to perform, and if the attack leads to a direct gain or needs the combination with other flaws to be of use.
Attacks such as MitM which can be triggered remotely and provide direct benefits for an attacker~\cite{rahaman_cryptoguard:_2019} are ranked as high severity.
We mark vulnerabilities as medium severity, which lead to compromises of secrets for active, dedicated attackers.
These vulnerabilities are of great help in undermining the security of the systems~\cite{wijayarathna_using_2019}.
Examples of this are CPA and CCA attacks.
An example of a vulnerability with low severity are credentials passed as a string, as these require prior access to the system or running process to be extracted.
Thus, the attacker must have exploited other vulnerabilities before to gain access to the system. %

\section{Conclusion}
\label{conclusion}

In this paper, we presented a study of Java crypto misuses that focuses on understanding (effective) false positives and the severity of misuses.
To understand common \textit{effective false positives} that arise from misuses, we manually reviewed a random sample of misuses %
and identified several \textit{effective false positives} such as the ones happening in a non-security context.
We provide an extensive threat model covering previously undiscussed vulnerabilities such as DoS attacks in the context of crypto API misuses. %
Our threat model marks nearly half of the misuses as high-severity.
For example, 29.05~\% of the applications still use SSL, TLS 1.0, or TLS 1.1. and may be exploitable remotely.

Overall, our study reveals several directions for future work.
While we got first insights into the differences of misuses between the JCA and BC, future research can answer the question if the BC API supports developers to write more secure code.
Further, our manual analysis reveals several sources of \textit{effective false positives} that can be addressed in existing static analysis tools.

\section{Empirical Study}
\label{sec:study}

\label{sec:approach}
In this section, we describe the setup of our study and the insights gained from it.
First, the
data set used for our analysis is described in Section~\ref{sec:setup}, followed by the
misuses identified in Section~\ref{sec:eval-cc}.
Our research questions are answered in Section~\ref{sec:eval-manual} and \ref{sec:eval:vuln}, respectively.
We published an artifact\footnote{\url{https://doi.org/10.6084/m9.figshare.21178243}} including our script for the threat model. %

\subsection{Dataset}
\label{sec:setup}
The dataset created by Spinellis et al.~\cite{spinellis_dataset_2020} addresses the generalizability problem of open-source studies and consists of 17,264 GitHub projects that are mainly developed or guided by enterprise employees and span multiple languages.
\textit{CogniCrypt\textsubscript{SAST}}{} works on Java binaries, hence,
we filtered out the non-Java projects and attempted to compile the rest automatically for Maven/Gradle build instructions.
This resulted in 936 Java enterprise-driven, open-source binaries, which serve as the basis of our study.
We applied the \textit{CogniCrypt\textsubscript{SAST}}{} version 2.7.2\footnote{\url{https://github.com/CROSSINGTUD/CryptoAnalysis/releases/tag/2.7.2}}
with the corresponding rule set for JCA and BC
to them\footnote{Previous studies used older \textit{CogniCrypt\textsubscript{SAST}}{} versions \cite{kruger2019crysl,gao2019negative,rahaman_cryptoguard:_2019}.}.
As the objective of our study was exploratory in nature and was designed to understand cryptographic misuses in the wild and not evaluate the tools themselves, we choose \textit{CogniCrypt\textsubscript{SAST}}{} due to its allowlisting approach and the inclusion of rules for JCA and BC.
For each successfully analyzed application in our data set, \textit{CogniCrypt\textsubscript{SAST}}{} created a report including details of the crypto objects analyzed and the identified misuses.

\subsection{Crypto (Mis)uses - an Overview}
\label{sec:eval-cc}

\textbf{Prevalence of JCA and BC.}
We consider an application to use a crypto API if we found at least one usage of either JCA or BC, without judging the security of the respective usage yet.
In total, we found \pgfkeysvalueof{projects_all} applications that use a crypto API.
All of these projects use the standard Java crypto library (JCA), while \pgfkeysvalueof{projects_bc} of these projects also use the BC API.
Within these applications, we analyzed \pgfkeysvalueof{objects_all} different crypto objects (hereafter object)\footnote{\textit{CogniCrypt\textsubscript{SAST}}{} uses the term \textsc{Object} to refer to any initialized Java object which interacts with a class covered by a CrySL rule~\cite{kruger2019crysl}} for JCA and BC.

\textbf{Misuses of JCA and BC.}
In the \pgfkeysvalueof{projects_all} projects, we spotted crypto misuses in \pgfkeysvalueof{misuses_all_project} and out of these \pgfkeysvalueof {misuses_bc_project} projects have misuses of both the BC and JCA library.
The remaining 180 projects only use the JCA library for crypto.
While previous studies reported 95~\% \cite{kruger2019crysl} and 96~\% \cite{gao2019negative} of applications with misuses for the JCA,
we observe
\pgfkeysvalueof{misuses_jca_project_perc}~\% projects with at least one misuse.
Thus, the selection criteria of so-called enterprise-driven applications~\cite{spinellis_dataset_2020} may have a slight positive impact on the number of misuses and thus security of the applications.

\textbf{Leading causes of misuses (error types):}
We identified \pgfkeysvalueof{misuses_all} misuses and those are mainly distributed over \errtype{Required Predicate}, \errtype{Incomplete Operation}, and \errtype{Constraint} errors.
Most of the misuse reports, in total 960, are due to a \errtype{Required Predicate}, which means that composing
multiple crypto objects seems to be challenging to get right.
An example of this misuse is in line 4 of Listing~\ref{lst:background} where the passed key is generated insecurely.
Thus, the required predicate of the function call \code{initSign}, namely a secure key, is not fulfilled and causes a misuse.
\errtype{Incomplete operation} errors arising out of a
missing method call contributed to
\pgfkeysvalueof{incomplete_total} misuses.
For example, crypto primitives may require multiple method calls for completion, e.g., initializing, updating, and finally retrieving a hash code.
While this is the second most frequent misuse,
only 37.80~\% of the projects are impacted by such misuses.
Most common in applications are misuses due to insecure parameters to functions, e.g., \textit{SHA-1} as a parameter to an initialization of a \code{MessageDigest} object.
Overall, 80~\% of the applications contain at least one such \errtype{Constraint} error, causing in total 566 misuses.
This prevalence can be explained by the fact that the security of algorithms evolves over time, algorithms may have not been updated, and may be used for tasks beside the crypto domain.
We observed both cases during the disclosure of our manual analysis (Sec~\ref{sec:responsible}).

\input{sections/42_classes_tabelle}

\textbf{Most frequently misused crypto classes:}
The error types discussed above describe misuses from the API perspective.
Another interesting perspective is investigating which crypto primitives were often misused based on the classes that pertain to their implementation, as certain classes may be more prone to \textit{effective false positives}, e.g., \code{MessageDigest}, or to high-severity misuses, e.g., \code{SSLContext}.
In the following, we will discuss all classes with more than 100 misuses.
Table~\ref{tab:statsclasses} presents the total number of misuses and affected projects for these classes.
While in total most of the misuses occur due to the class \class{Cipher}, 80.54~\% of the projects, have no misuse of this class at all. %
Thus, affecting only 36 projects.
We observed the second-most misuses due to the class, \class{MessageDigest} with 472 misuses in total. %
Thus, more projects (113) have at least one misuse of the class \class{MessageDigest} than no misuse of this class.
This indicates that misuses of the class \class{MessageDigest} are widespread among many applications. %
The class \class{SSLContext} contributes to 414 misuses in total within 68 projects.
We observe fewer misuses for the class \class{SecretKeySpec} with 218 misuses in total distributed among 53 projects.
These results reveal that only a few JCA classes are frequently misused in many of the applications.
For our data set, we can avoid \pgfkeysvalueof{topfourclasses_perc}~\% of the misuses by fixing misuses of these four classes.

\subsection{Manual Analysis of Reports (RQ1)}
\label{sec:eval-manual}

To gain a more in-depth understanding
of common (effective) false positives, we randomly
sampled 157 (Confidence: 99~\%, margin of error: 10~\%) misuses.
The first four authors of this paper independently analyzed the sampled misuses, with at least two reviews per misuse.
In case of disagreement, the reviewers in question resolved them with further code review until they reached a conclusion.
The focus of our analysis is the precision of the report as well as the context of the misuse to answer our first research question.

Previous studies~\cite{kruger2019crysl} concentrated on measuring precision under the assumption that the rules of the static analysis are correct and based on error types that can be easily verified manually, namely \errtype{Constraint} and \errtype{Type State} errors.
In contrast, we inspected all error types and show
that some misuses can occur due to an incomplete or outdated rule-set or occur in a non-security context.
Thus, resulting in \textit{effective false positives}.
We also consider such issues as a contributing factor to the overall lower precision discussed in this paper.

\textbf{Undecided Reports.}
We explicitly marked misuses as \textit{undecided} if it was impossible to judge their validity due to cryptic or confusing error reports.
A common reason was that the reported insecure usage could not be identified at the location of the report, nor in the respective callers. %
In total, we observed \pgfkeysvalueof{idk} misuses which fall into this category.
All of these misuses occur for the more complex error types, namely \errtype{Incomplete Operation}, \errtype{Required Predicate}, and \errtype{Type State}.
We assume that these error reports will be of little help to the
user
attempting to make decisions based on them.
For the remainder of the discussion, we will focus on the remaining 126 misuses.

\textbf{True Positives.}
Our qualitative analysis revealed \pgfkeysvalueof{tp} (roughly 74~\%) true positives distributed among all previously discussed JCA classes and error types.
By using regex, e.g., with grep, to detect usages such as MD5, \pgfkeysvalueof{tp-grep} true positives can be detected.
Analyst or developers may consider such simple and fast tools as a prefilter of more sophisticated analyses such as \textit{CogniCrypt\textsubscript{SAST}}{}~\cite{kruger2019crysl} and \textit{CryptoGuard}~\cite{rahaman_cryptoguard:_2019}.
The remaining true positives are due to an incorrect order of method calls  (\pgfkeysvalueof{tp-order}), which requires a typestate analysis, storing secrets in Java strings (\pgfkeysvalueof{tp-string}), using a default value of the JCA (\pgfkeysvalueof{tp-default}), or hard-coded credentials (\pgfkeysvalueof{tp-hardcoded}).
The remaining 8 instances that we classified as true positives from the static analysis depends on information that can not be dissolved statically.
True positives due to incorrect call orders and relying on defaults are to the best of our knowledge not covered in existing denylist approaches.
Thus, showcasing the importance of a sophisticated static analysis beyond simple pattern matching.

We observed \pgfkeysvalueof{loop} misuses because a required call is only present in a loop body where the respective loop may not be executed (Listing~\ref{lst:loop}, Line \ref{lst:l:body}).
Thus, a misuse may be present and causing a vulnerability.
While these cases should be analyzed to identify if a vulnerability can be triggered causing a true positive, most often these cases results into effective false positives indicating a coding smell.
Note, that this is a known limitation of analyses such as \textit{CogniCrypt\textsubscript{SAST}}{}~\cite{kruger2019crysl}.

  \begin{listing}
\begin{minted}[breaklines,numbers=left,firstnumber=last,fontsize=\small,escapeinside=!!]{java}
final MessageDigest md = getMessageDigest(algo);
final byte[] buffer = new byte[4096];
int count = 0;
while ((count = inputStream.read(buffer)) > 0) { !\label{lst:l:guard}!
    md.update(buffer, 0, count); !\label{lst:l:body}!
}
return md.digest();
\end{minted}
  \caption{A \code{MessageDigest} object which only calls \code{update} when it has something to read from an \code{InputStream}.}
  \label{lst:loop}
\end{listing}

\textbf{False Positives.}
Our manual analysis resulted in 35 false positives caused by several reasons. %
One reason are incorrect API specifications. \textit{CogniCrypt\textsubscript{SAST}}{} relies on the correctness of the API specifications, and in case of incorrect or outdated specifications, the respective report is erroneous and leads to a false positive.
In total, we observed \pgfkeysvalueof{fp-crysl} misuses due to this reason.
For example, the \textit{Optimal Asymmetric Encryption Padding (OAEP)} was encoded with a typo as \textit{OEAP} in the CrySL rule, causing a misuse to be reported, when the correct padding scheme \textit{OAEP} is passed.
We fixed this error in a pull request which is already merged into the main branch of the CrySL rules repository.
Previous studies have assumed the correctness of the CrySL rules~\cite{kruger2019crysl} and thus not considered these usages as false positives.
With this assumption, our analysis reveals a true positive rate of 84~\% that is similar to previous studies~\cite{kruger2019crysl, hazhirpasand2020java}.
In another example, the call order of functions was modeled incorrectly.
After a discussion about this issue, a pull request fixing this problem was opened.

Besides the correctness of the specification, the underlying static analysis can cause false positives due to imprecise modeling of the program flow.
Our reviews revealed \pgfkeysvalueof{fp-model} false positives due imprecise modeling, e.g., wrapping of crypto objects.
The remaining false positives are due to further challenges with respect to modeling the program statically.

\begin{figure}
\centering
\includegraphics[width=0.8\columnwidth]{figures/EFP.pdf}
\caption{Common \textit{effective false positives} patterns that we identified during our manual analysis.}
\label{fig:efp}
\end{figure}

\textbf{Effective False Positives.}
During our analysis, we observed that some misuses discussed previously are \textit{effective false positives} (cf. Section~\ref{def:efp}).
Thus, the user of the analysis would not take any action, as, while they may acknowledge that it is theoretically a correct finding, it is invalid or irrelevant for the specific application.
We provide an overview of the common patterns that we identified in the wild in Figure~\ref{fig:efp}.

Concretely, we identified \pgfkeysvalueof{non-sec-misuses} out of the 126 misuses from a non-security context.
One example
is the usage of \textit{MD5} in deeplearning4j\footnote{An open-source deep learning library for JVM-based languages (Stars: 12.2k, Forks: 4.9k), \url{https://github.com/deeplearning4j/deeplearning4j}}.
Here, the \textit{MD5}-digest is used to verify that the input array %
was not modified during execution.
Another example is in the project UAVStack\footnote{Graphical tool to monitor and analyze programs running JVM (Stars: 667, Forks: 278), https://github.com/uavorg/uavstack} where \textit{MD5}-hashes of a file are used to provide content-aware detection changes.

The number of \textit{effective false positive} misuses due to a non-security context may appear low at first sight.
However, one has to consider this number in relation to the overall number of reports for the specific kind, e.g., class \class{MessageDigest}.
It turns out that \pgfkeysvalueof{non-sec-misuses-md_perc}~\% of the \class{MessageDigest} misuses in our randomly selected sample fall into the category of \textit{effective false positive} due to non-security context.
If we consider (a) that roughly 25\% of the reported \class{MessageDigest} misuses are potentially \textit{effective false positives} and (b) that this class causes by far the most of the misuses reported by previous studies~\cite{gao2019negative, kruger2019crysl, rahaman_cryptoguard:_2019}, respectively the second most frequent in our study, it becomes clear that previous reports may contain a significant number of \textit{effective false positives}.
Further, this may significantly decrease the acceptance of these tools by developers~\cite{johnson_dev, sadowski2015Tricorder}.

Besides the context, we observed that the \pgfkeysvalueof{tp-string} true positives, which use a string instead of a byte-array, may result in \textit{effective false positives}.
While it is possible to read user input as a byte-array, some credentials are passed by API design as a string instead of the byte-array.
Thus, the developer has no effective and easy way to fix the misuse by hand.

Our analysis revealed another potential source for \textit{effective false positives} not considered by previous studies.
Some misuses may be intentionally introduced in the projects contained in our data set.
For example, the static analyzer SonarSource\footnote{https://github.com/SonarSource/sonar-java (Stars: 755, Forks: 501)} includes tests, not following the typical naming scheme for test, for correct API usages and insecure crypto misuses.
These misuses, in total 13 in our sample, within the tests are intended.

\vspace{-0.2mm}
\begin{obs}{}{}
A non-security context, the usage of string, and "intentional misuses" are common \textit{effective false positives}.
\end{obs}

\subsection{Vulnerabilities (RQ2)}
\label{sec:eval:vuln}

Based upon our vulnerability model introduced in Section~\ref{sec:vulnerabilititesmodel}, we will discuss the most common vulnerabilities and their severity in this section.
Most of the misuses are due to the attack types \textit{Predictability Through Initialization} (876), \textit{Bruteforce Attacks} (400), and \textit{Predictability Through Usage} (343).
In total, we identified 1,153 high-severity, 643 medium-severity, and 334 low-severity misuses.
We present the number of misuses, their severity, and their relationship to the respective attack types in Figure~\ref{fig:severity}.

\textbf{High-severity vulnerabilities.}
Vulnerabilities belonging to the attack type \textit{Predictability Through Initialization} are caused by 691 misuses spread over 108 projects.
They are due to an insecurely generated key caused by a \errtype{Required Predicate} error.
Another source of insecurely generated keys are insecure key generation parameters, e.g., \textit{HmacSHA1} or \textit{DES}.
These were reported for 84 misuses within 29 projects.

The usage of SSL, TLS 1.0, and TLS 1.1 is insecure and should be avoided.
We found 141 such misuses in 61 individual projects.
For example, 29 misuses within 20 projects are caused by using SSL. %
\begin{figure}
    \centering
    \includegraphics[width=0.8\columnwidth]{figures/SeverityAttackTypes.pdf}
    \caption{Number of misuses by severity for the attack types.}
    \label{fig:severity}
\end{figure}

\textbf{Medium-severity vulnerabilities.}
Our analysis detected 336 misuses which can result in \textit{Predictability Through Usage} by observing the crypto function calls, their call order, and inputs.
For example, the analysis identifies at least one path which consumes the crypto object without adding any data, e.g., instantiating a message digest without providing an input.
Beside the predictable computations, the most relevant medium-severity vulnerabilities are due to insecure PRNGs (total: 185) and DoS attacks caused by exceptions (total: 45).

\textbf{Low-severity vulnerabilities.}
Most (192) of the low-severity vulnerabilities are of attack type \textit{brute-force} for ciphers, e.g., using an insecure signature algorithm or a 64-bit block cipher.
For the attack type \textit{credential dumping}, we identified 130 low-severity misuses within 47 projects due to the use of a string instead of a byte-array for passing on secrets.
If an attacker has control over the system, they might retrieve the secret handled as string from memory as it is immutable and cannot be cleared from memory.
Furthermore, we found 12 misuses which use a byte array for their secrets and misses to clear the memory explicitly.
Thus, the secret may stay in memory as for the previously discussed secrets handled as strings.

\vspace{-0.2mm}
\begin{obs}{}{}
Nearly half the misuses (42.78~\%) are of high-severity and should be prioritized while fixing misuses.
\end{obs}

\subsection{Responsible Disclosure.}
\label{sec:responsible}
We informed - when possible - all projects for which we could confirm a true positive from the analysis perspective.
To avoid influencing the maintainers, we did not provide information about our judgment w.r.t \textit{effective false positives}.
So far, we received feedback for 22 misuses from 55 reported misuses.
One project fixed the misuse that we classified as high severity and
15 projects considered the misuse that we reported as an \textit{effective false positive}, with responses ranging over "\texttt{MD5} is used to generate test data", "the affected program component is not shipped to the customers", "the usage is secure in our setting", or "misuses in dependencies are ignored".
One of these projects added documentation to the identified insecure usage, and initiated an internal analysis of their code for crypto misuses.
Overall, the disclosure confirms our observation that a more fine-grained assessment of misuses is important, e.g., considering a context.
For five misuses, we received no final decision from the maintainers, e.g., they only thanked us for the report, and for one misuse we were asked to provide a fix that requires to change their API. %
Further, some discussions raised the questions which entity, e.g., the maintainers or the user of an application, is responsible for fixing a misuse.

\section{Background}
\label{sec:backgroundAndRelatedWork}
\label{sec:background}
\input{sections/25_listingbackground}

In this section, we provide background information regarding crypto API misuses in Java and introduce \textit{CogniCrypt\textsubscript{SAST}}{} \cite{kruger2019crysl}, the crypto API misuse analyzer we used for our study.
In addition, we introduce the term \textit{effective false positives}.

\subsection{Misuses of Java Crypto APIs}
\label{sec:cryptomisuses}
\label{sec:background:misuses}

The JCA provides a set of extensible cryptographic components ranging from encryption over authentication to access control, enabling developers to secure their applications.
It is implementation-independent by using a "provider" architecture; developers can plug and play their implementation of crypto primitives for use with this architecture.
A commonly used provider besides the default that is shipped with the Java Development Kit (JDK) is the Bouncy Castle library.

Listing~\ref{lst:background} illustrates a usage of the JCA to sign a byte-array \mintinline{Java}{dataToSign}.
For this, the \code{Signature} object is initialized with a signature algorithm (Line~\ref{lst:constraint}) and a private key, passed via the function \code{getPrivateKey}, is added to the \code{Signature} object \code{s} (Line~\ref{lst:required}).
Next, the byte-array \code{dataToSign} is passed to \code{s} to actually compute the signature of the data (Line~\ref{lst:l:update}) before the function returns the signed bytes.
Unfortunately, the call to \code{sign} that would return the signature is missing (Line~\ref{lst:l:incompleteoperation}).

A \emph{crypto misuse}, hereafter just misuse, is a usage of a crypto API that is considered insecure by experts.
A misuse may be syntactically correct, a working API usage, and may not even raise an exception.
We will briefly discuss the error types defined by Krüger et al.~\cite{kruger2019crysl} to illustrate some misuses.

\begin{enumerate}
    \item \textbf{Constraint Errors} (Listing~\ref{lst:background}, Line~\ref{lst:constraint}): Crypto APIs use parameters to let developers select crypto algorithms when initializing crypto objects.
    These parameters are often passed as strings
    in a specific format.

    \item \textbf{Incomplete Operation Errors} (Listing~\ref{lst:background}, Line~\ref{lst:l:incompleteoperation}):
    The security of crypto objects may rely on a specific protocol. %
    For instance, \code{Signature} crypto objects, once initialized and filled with data via a call to \code{update(byte[])}, require a call to the \code{sign} method to complete the signing operation.
    Thus, the required calls to complete the use of an initialized crypto object are missing.

    \item \textbf{Required Predicate Errors} (Listing \ref{lst:background}, Line~\ref{lst:required}): Crypto objects often depend on each other.
    For example, \texttt{Signature} objects require a correctly generated \texttt{Key} object. %
    In order for a composed crypto solution to be secure, it is required that its components
    on which it depends are secure.
    Thus, composing a crypto object with required but insecure objects results in a misuse.

    \item \textbf{Never Type of Error:}
    Sensitive information, e.g., a secret key, should never be of type
    \texttt{java.lang.String}, as strings are considered insecure compared to mutable byte arrays.
    Strings are immutable and stay in memory until collected by Java's garbage collector.
    Thus, they are longer visible in memory for attackers than necessary and outside of the direct control of the developer~\footnote{\label{fn:jcastring}\url{https://docs.oracle.com/en/java/javase/17/docs/api/java.base/javax/crypto/spec/PBEKeySpec.html}, accessed 19.09.2022}.

    \item \textbf{Forbidden Method Errors:} Certain methods of crypto objects should never be called for security reasons.
    For example, the \code{PBEKeySpec} object generates keys from passwords and requires a crypto salt while initializing the object.
    Therefore, constructors that are not parameterized with a salt
    cause a misuse.

    \item \textbf{Type State Error:} Such an error occurs when an object moves into an insecure state as the result of an improper method call sequence.
    For example, a \code{Signature} object requires a call to the \code{initSign} method prior to any number of calls to the \code{update} method.

    The key difference to an \error{Incomplete Operation Error} is that the missing and expected call is within the call sequence, while for an \error{Incomplete Operation Error} the expected call sequence is not finished.
\end{enumerate}

\input{sections/37_vulnerabilities_table}

\subsection{\textit{CogniCrypt\textsubscript{SAST}}{}}
\label{sec:app-ccsast}

For our study, we used the crypto misuse detector \textit{CogniCrypt\textsubscript{SAST}}{} which follows an allowlisting approach.
In contrast to denylisting approaches such as \textit{CryptoGuard}~\cite{rahaman_cryptoguard:_2019} that describe vulnerabilities, allowlisting approaches describe all secure API usages.
Violations of the
defined rules are reported as misuses~\cite{kruger2019crysl}.
Previous studies reported a precision of 85~\% to 94~\%~\cite{kruger2019crysl, hazhirpasand2020java}.
Further, \textit{CogniCrypt\textsubscript{SAST}}{} supports the BC library next to the JCA.

\subsection{Effective False Positives}
\label{def:efp}

Past research has shown that developers consider false positives as the "Achilles heel" of static analyzes~\cite{johnson_dev, ayewah2007evaluating}.
However, in practice, the definition of false positives varies:
From a static analysis perspective, a false positive is a finding which is incorrectly identified by the analysis.
For developers on the other hand, some findings can not be fixed in the application, e.g., due to a broken standard. %
Sadowski et al.~\cite{sadowski2015Tricorder} introduce the term \textit{effective false positives} to cover reported misuses
on which a user will not take further action. %

For an example of an \textit{effective false positive}, consider a usage of \textit{MD5} that is correctly flagged by the static analysis.
However, the usage of \textit{MD5} at hand happens in a non-security context as the concrete call cannot be influenced by external factors and is not essential for the security of the software.


Garrett Masquerade is the brother of Spencer Masquerade, half-brother to Loki Masquerade and Bonereaper Masquerade, and adopted brother of Logan Venom. Garret is a trained assassin and thief who is often accompanied by his half-brother, Bonereaper Masquerade or his cheetah, Skeiron.
Garrett joined Sapient in November and managed to work his way up to Opus Parva, but after hearing about the conflict, he left Sapient to find his brothers. He found them in Portland and stayed with them for several months.
Now, Garrett is back in Casa di Cavalieri.
Species: Garrett's sighthound lineage plays heavily in his design. His wolf lineage adds to his height and his coyote blood also contributes to his physique.
Fur: His fur is long and silky like a Borzoi. It is shorter due to his wolf blood.
Optime Hair: His Optime hair is spiked and is mostly concentrated in the front.
Facial Features: His head is somewhat wolflike with a narrower face. He does have a slight slope to his face like a sight hound.
Build and Size: He is long-legged with a deep chest and a wiry and lean frame. He is quite tall and holds himself confidently.
Lupus: His Lupus form is tall and looks like a sighthound with a wolf/coyote face.
Humanization: His level of humanization is high. He wears clothes and uses weapons. He does see value in feral forms though prefers Optime for most things.
Garrett's outfits often include leather and are often dark-colored. He prefers clothing with hoods and frequently wears coats as well to disguise his identity. When not wearing what he calls his "suits", he often wears his leather jacket over something like a shirt.
Garrett was raised to use his intelligence as well as his fighting skills. He is a quick thinker and a natural improviser when the situation calls. He also has a good memory and is able to quickly analyze a situation and pick the best option. He is capable of assessing a person's strengths and weakness and can come up with a plan relatively quickly. He is a good strategist and often uses his wits in a fight.
If Garrett doesn't agree with something, he will rebel and try to change it. He will not be silenced without a fight and even then, he will show slight hints of disagreement. He doesn't play by the rules and oftentimes will find loopholes to get around them. Though, he doesn't break the rules unless it is for a good reason. He may test them, but breaking them is reserved for the times that he really needs to.
Garrett can be an adrenaline junkie at times. He often does parkour just for the fun of it and may do dangerous things just to feel the high. He has grown out of it, but he wouldn't say no to the invitation. He isn't afraid to take risks and doesn't prefer to take things safe. He does know that these actions may affect others and tries not to include others in his schemes.
Garrett has a big brother instinct and is a bit protective towards his brothers and often people he considers to be his friends. He will put himself in harm's way to ensure their safety. His family is very important to him, especially his siblings and the people he considers to be family. However, he can be a bit blind to their actions which could cause trouble.
He was raised to uphold justice, no matter what. But, he has a slightly different view on some things. He is willing to steal from merchants to get what he wants, but he will not steal from those with families or people who rely on them. And he doesn't take necessities such as medicine or food. He is not above killing bad people or injuring mooks, but he tries to minimize or otherwise erase the possibility of collateral damage and will not hurt innocent people.
" He follows his own moral compass, which, although good, may not agree with that of society."
''"The chaotic good dislikes confining laws, self-discipline, and they distrust authority"
Species: Garrett doesn't have a species bias, but he is partial to dog hybrids.
Gender: Garrett respects both genders, but he does flirt more with guys.
Sexuality: Garrett doesn't really understand polyamorous relationships.
Archetype: Garrett hates rapists and killers. He will go out of his way to dispose of one.
Bisexual. He does prefer guys over girls, though but he can appreciate a female's looks. He is quite flirty but he can take no for in answer.
Garrett has belief in no god, but he does understand the concept of heaven and hell.
He does drink, but he does it moderately. He doesn't understand why people get high, though.
Armed combat (Expert): Garrett has been trained to fight with blades and tomahawks. He can dual-wield and used speed to dodge blows or blocks them when necessary. He also is known to use common items such as bones, bottles, and rocks that are within reach if he has to.
Unarmed combat (Skilled): Garrett fights with a mixture of mixed martial art techniques and dirty fighting. He goes for the soft spots and dodges and blocks attacks when possible. He often uses kick-boxing maneuvers because of his long legs and isn't afraid to jab someone in a soft spot.
Feral Fighting (Skilled): Garrett has been trained in feral combat to bring down others when on four legs. He is lighting-fast and also employs dirty tricks. He has also fought a two-legged Luperci while in a feral form and often goes for the legs or knocks them over.
Projectiles (Competent): Garrett can use throwing knives and throw tomahawks. He can hit a mark but goes for the center mass. Knives are the go-to throwing weapon but he has thrown random items at people and favors a bottle to do this.
Sleight of Hand (Competent): Garrett knows a bit of sleight of hand. He can make this disappear and reappear.
Breaking and Entering (Competent): Garrett knows how to get into homes and out.
Hunting (Competent): Garrett is capable at hunting in feral form. He relies on his speed to bring prey down but he has learned mainly from chasing down suspects and applying it to prey.
Agility (Skilled): Garrett is quite agile and can do some degree of Parkour with his speed. He has had to chase after runners and learned how to use his agility to catch up with a suspect.
Stealth (Skilled): Stealth is one of the things Garrett has honed on in his assassin training. He knows very well how to hide in plain sight and ambush. His pelt color is best for dark forests and has been used to ambush from alleyways.
Tracking (Skilled): Tracking is another skill he's learned as an assassin. He has some skill at tracking people in an urban setting, but in a wild setting he can track prey and sometimes Luperci. He relies on sensory aid when tracking.
Manipulation (Skilled): Garrett is skilled at manipulating people. He can be charming and charismatic which helps him convince people to do things or think a certain way.
Strategically Thinking (Expert): Garrett is good at breaking things down and figuring out how to react.
Languages (Competent): Garrett's eidetic memory allows him to learn many languages. He knows French and Italian and knows different phrases from other languages.
Negotiation (Skilled): Garrett is good at haggling traders. He knows how to get what he wants and won't stop until he gets it. He has some ability to negotiate with violent people but primarily uses this skill while trading.
Interrogation (Skilled): Garrett knows how to get a confession from a criminal. He will sweat someone out, bluff, or annoy someone until he gets something out og them.
Victimology (Apprentice)): Garrett can find patterns in crime victims.
Profiling (Apprentice): Garrett is currently studying profiling. He can figure out a Modus Operadni and has some ability to figure out why the person is doing it.
Slower shifting: Garrett is normally clothed which means he can't shift as quickly as some.
Rural Areas: Garrett's domain is the city. He is more used to urban fighting than fighting in forests.
Impulsiveness: Garrett is still young and he sometimes doesn't think before he talks.
Hunting Alone: It's harder for him to hunt alone so he often hunts with Skeiron's help.
More Victims: He does need several victims to compare data and wants to hone this skill so that he can better predict who the criminal will strike.
Garrett was born in an area of Washington D.C alongside his brother, Spencer to Sijarem Masquerade and Bellex Marauder.
The city he lived in was ruled by four families: the Masquerades, the Purge, the Venom, and the Chandler. In the city, the Masquerade and the Purge were the enforcers and the Venom and the Chandler controlled the trade.
Garrett and Spencer were brought back to their father after birth. They was raised alongside two half-brothers, Loki and Bonereaper and a ward that the Masquerades had taken in, Logan Venom. Once he learned to shift, his father sent him to be trained as an assassin by the Purge family. Before Garrett was sent off, he was gifted a cheetah cub and a golden eagle. His father had taken him to an animal menagerie to find a companion and they had come across a young cheetah cub that had been given to the place by an African trader. The young boy selected the feline and eagle and while training, he also trained them with the help of his adopted brother, Logan Venom and his trainer, Razor who are both skilled in working with animals.
While training, he befriended Cheshire Panthera and Chaos Purge.
He also started studying psychology in order to help him figure out his targets and enemies. While training as an assassin, he specialized in knives and tomahawks as well as hand-to-hand combat.
When he was a year and a nine months old, he became a full assassin and was paired up with Chaos, a sniper and Cheshire, a paladin. The trio worked together for three months before Garrett decided to explore the world. He and his half-brother, Bonereaper had heard about a place in Nova Scotia called 'Souls and decided they wanted to journey there and explore.


text:
Earl Timothy Cone Wiki, Biography, Age, Wife, Net Worth, Family, Instagram, Twitter & More Facts
Tim Cone is an American professional basketball coach who is the head coach of Barangay Ginebra San Miguel in the Philippine Basketball Association (PBA). He is the most accomplished coach in PBA history with 23 titles, including two Grand Slams. He is a proponent of the triangle offense.
Scroll Down and find everything about the Tim Cone you need to know, latest relationships update, Family and how qualified he is. Tim Cone's Estimated Net Worth, Age, Biography, Career, Social media accounts i.e. Instagram, Facebook, Twitter, Family, Wiki. Also, learn details Info regarding the Current Net worth of Tim Cone as well as Tim Cone 's earnings, Worth, Salary, Property, and Income.
Tim Cone, better known by the Family name Earl Timothy Cone, is a popular Sports coach. he was born on December 14, 1957, in Oregon. is a beautiful and populous city located in Oregon United States of America. Earl Timothy Cone entered the career as Sports coach In his early life after completing his formal education
Tim Cone Early Life Story, Family Background and Education
Cone was born in the United States and grew up in Oregon. He moved to the Philippines when he was nine years old after his father came to the country to work in the logging industry. Cone studied in a public elementary school in Baler, Aurora and later moved to the International School Manila.
Cone returned to the United States when he was 18 years old to study at the Menlo College in California and the George Washington University in Washington D.C.. After graduating from college, Cone worked in a bank in San Francisco before returning to the Philippines at age 24.
Read Also: Nathan Collins Wiki, Biography, Age, NetWorth, Family, Instagram, Twitter, Social Profiles & More Facts
Earl Timothy Cone Net Worth
According to Wikipedia, Google, Forbes, IMDb, and various reliable online sources, Earl Timothy Cone's estimated net worth is as follows. Below you can check his net worth, salary and much more from previous years.
Tim's estimated net worth, monthly and yearly salary, primary source of income, cars, lifestyle, and much more information have been updated below.
Tim who brought in $3 million and $5 million Networth Tim collected most of his earnings from his Yeezy sneakers While he had exaggerated over the years about the size of his business, the money he pulled in from his profession real–enough to rank as one of the biggest celebrity cashouts of all time. his Basic income source is mostly from being a successful Sports coach.
Tim ConeNet Worth
Income Source Sports coach
Noted, Tim Cone's primary income source is Sports coach, We are collecting information about Earl Timothy Cone Cars, Monthly/Yearly Salary, Net worth from Wikipedia, Google, Forbes, and IMDb, will update you soon.
Tim Cone Personal Life, Relationships and Dating
Tim Cone is married to Cristina Viaplana, a Filipino, since August 1991 after dating for seven years. Cone's daughter works in the United States as of 2019. He can also speak Filipino although he prefers to speak in English in press conferences.
Tim Cone: Age, Height & Weight
Tim Cone's age 63 years (as in 2021), height & weight. Dress & Shoe size Updated below scroll down and check all about height & weight. Dress & Shoe size.
Tim Social Media Activities.
he is a famous person on social media i.e. Instagram, Facebook, Twiter, Youtube, etc. Please scroll down to see information about Tim Cone Social media accounts.
Tim Cone Biography
Tim Cone
Earl Timothy Cone
Date of Birth December 14, 1957
Birth Day December 14
Birth Place Oregon
Famous As Sports coach
Also Known for Sports coach
Occupation Sports coach
How Old he was when he started his career? he was only Years old when he started his career as Sports coach
Tim Cone Height, Weight and Body Measurement
Tim Cone Family, Parents, Siblings
Tim Cone Current Affairs, Relation Ships, Dating
Tim Cone Awards and Honors
Tim Cone Social Media Profiles and Accounts

redpajama_set_name: RedPajamaCommonCrawl


text:
Scientists conclude cigar-shaped interstellar object not an alien spaceship
An artist's impression of the first interstellar asteroid: Oumuamua. This unique object was discovered on 19 October 2017 by the Pan-STARRS 1 telescope in Hawaii. Subsequent observations from ESO's Very Large Telescope in Chile and other observatories around the world show that it was travelling through space for millions of years before its chance encounter with our star system.	M. KORNMESSER/AFP/Getty Images
WASHINGTON — After investigating the nature of a mysterious and apparently cigar-shaped object called 'Oumuamua spotted in 2017 speeding through our solar system, astronomers remain uncertain over how to classify it, but are confident it is not an alien spaceship.
Its odd shape and motion had prompted some scientists to wonder whether 'Oumuamua – the first object from another star system found passing through our solar system – was some sort of alien technology perhaps exploring the cosmos. But after poring over the data, an international team of researchers wrote that "we find no compelling evidence to favor an alien explanation."
Scientists tracked the reddish-colored 'Oumuamua from Oct. 14, 2017, until Jan. 2, 2018, after which it became too faint to detect even using the most powerful telescopes. It is estimated to be a half-mile (800 meters) long, tumbling through space.
"Our key finding is that 'Oumuamua's properties are consistent with a natural origin, and an alien explanation is unwarranted," said University of Maryland astronomer Matthew Knight, co-leader of the research published in the Nature Astronomy.
"Yes, if it made a sudden, unexplainable turn that would certainly have warranted further exploration," Knight added.
'Oumuamua (pronounced oh-MOO-uh-MOO-uh) was first detected by the University of Hawaii's Pan-STARRS1 telescope. Its name in the native Hawaiian language means a messenger arriving from a great distance.
Knight said it is not easy to fit 'Oumuamua into familiar classifications such as a comet or asteroid.
"We have tried to avoid putting it in one of those boxes and prefer to call it more generically an 'object,'" Knight said.
"In simple terms, asteroids are rocky and devoid of ices, while comets are a mixture of rock and ice, so-called 'dirty snowballs,'" Knight added.
'Oumuamua was somehow ejected from a distant star system, traversing through interstellar space and through our solar system. It deviated slightly from a path that would be explained purely by the Sun's gravitational pull because of what some researchers said was apparently a very small emission of gas from its surface, indicative of a comet, though any such emission was so slight as to be undetected. It lacked a dust tail or gas jets, characteristic of comets.
The researchers wrote that a "straightforward explanation for 'Oumuamua is that it is a planetesimal" – a planetary building block – or a fragment of one – formed in faraway star system.
Its composition remains a mystery, including whether it is just rock or includes some metal or other ingredients. It is currently located beyond Saturn, dashing out of our solar system. (Reporting by Will Dunham; Editing by Sandra Maler)
Science of Summer: Learning how new trees may help an old...  Shake, rattle and roll: How the NRC puts really big trucks...
Dubai to Organise Global Investment in Aviation Summit in January 2020
TMAC Resources' Second Quarter Exploration Results Include High-Grade Intercepts at Doris and Madrid North
TMAC Resources Announces Q2 2019 Production of 38,520 Ounces
More News Releases


text:
Consent is transformative
International Day Of Consent
Festival of Consent
Sex Worker's Opera at the Festival of Consent
#IDoConsent events
Cabaret Of Consent
Photo: Manu Valcarce
Exhibition: Listen to Me: 5 Years of Sex Worker's Opera
Created and performed by sex workers and friends, based on the experiences of our 35 members and over 100 people from 18 countries across 6 continents, including outdoor workers, strippers, escorts, brothel workers, porn actors, sugarbabies and webcam models.
The photos were taken over 5 years of shows in London, across the UK and in 6 different countries including at the International AIDS Conference in 2018.
The global stories accompanying the photos include written stories, audio testimonies, songs, videos, poetry, webcam shows and field recordings in collaboration with sex worker-led collectives in Chile, Singapore and South Africa.
The exhibition was first premiered in Cape Town in March this year at the launch of their first ever Sex Worker Theatre programme and toured to Rotterdam, Netherlands in summer.
Photos by Vera Rodriguez, Manu Valcarce, Jordan Busson, Paul Blakemore, Julio Etchart.
Photo: Julio Etchart
Workshop (2-4pm): Capitalism & Consent: Sex Work, Stigma and Storytelling
Have you ever done something you didn't want to do… for money? (Shockhorror) Or had a job you quite enjoyed, or really enjoyed… except for the admin? Have you ever had a job that was soulless monotonous… or a job that was really soulful and you knew was your calling?
We could be talking about a bar job, domestic labour, being a banker, being musician or sex work. Sex work is no monolith, no single story, and in this workshop we place the various types of work sex workers do on a wider spectrum of capitalism and consent… in a patriarchal and colonial world… and how the dominant narratives feed in to stigma and stereotypes.
With no experience necessary, in just two hours together, we'll go beyond herstorical divisions between movements and build bridges with wider feminism, LGBTQ+ campaigns and diaspora and migrant struggles to develop new stories through which we can uplift each other going forward.


text:
SPENGLER AND WITTMANN REACH THE PODIUM FOR BMW.
QUICK FACTS. DTM NÜRBURGRING.
01 Saturday: First podium for Bruno Spengler in the 2018 DTM season.
02 Saturday: Timo Glock chases his way up from twelfth to fourth place.
03 Sunday: Wittmann reaches the rostrum in the 100th DTM race for BMW since 2012.
04 Sunday: Five BMW drivers in the points at the anniversary race.
Highlights vom Samstag.
Sehen Sie hier die Höhepunkte des Samstagsrennens in der Videozusammenfassung.
SATURDAY.
First podium for Spengler in the 2018 DTM season.
In the 15th race of the 2018 DTM season, BMW Team RBM's Bruno Spengler achieved his first podium finish of the season at the Nürburgring. After 40 laps, the Canadian driver crossed the finishing line second in the BMW Bank M4 DTM. Three more BMW drivers followed Spengler into the top-ten.
Victory went to Audi driver René Rast, while Timo Glock put on a successful charging performance in the DEUTSCHE POST BMW M4 DTM to move up from twelfth place and cross the line in fourth. Right behind him, BMW Team RMG driver Marco Wittmann drove the BMW Driving Experience M4 DTM to fifth place. Wittmann's team-mate Augusto Farfus (Shell BMW M4 DTM) finished ninth, scoring two points. Joel Eriksson (BMW M4 DTM) and Philipp Eng (SAMSUNG BMW M4 DTM) finished in twelfth and 16th positions.
Before the 100th race for BMW since the DTM comeback in 2012 gets going on Sunday, the legendary Nürburgring Nordschleife will be the focus of attention in the morning. BMW works driver Martin Tomczyk, working as a race expert for German TV channel SAT.1, will then be racing through the "Green Hell" with the BMW M4 DTM race taxi.
" It feels very good to be back on the podium. We had a really good day today. "
Bruno Spengler
SUNDAY.
Marco Wittmann in the home race for the BMW Team RMG.
In BMW Team RMG's home race at the Nürburgring, Marco Wittmann finished third to reach the podium in the BMW Driving Experience M4 DTM. After completing 40 laps, he was just 3.439 seconds behind the winner, René Rast (Audi). Wittmann now has 137 points and is the best-placed BMW driver in the overall standings, in fifth place. The BMW drivers once again gave a strong team performance with five BMW M4 DTMs making it into the top ten, scoring a total of 45 points.
Behind Wittmann, Bruno Spengler (BMW Bank M4 DTM) secured fourth place. Joel Eriksson (BMW M4 DTM), Augusto Farfus (Shell BMW M4 DTM) and Philipp Eng (SAMSUNG BMW M4 DTM) followed in sixth, seventh and eighth positions. Timo Glock had to be content with 16th place after an early collision and subsequent drive-through penalty. As was the case on Saturday, BMW Team RBM claimed the fastest pit stop with Eriksson's car.
BMW Motorsport, BMW Team RBM and BMW Team RMG were competing in their 100th DTM race since BMW's comeback in 2012. Farfus and Spengler have been involved in every one of those 100 races.
" Overall, I am completely satisfied with third place. I drove a clean race and was close to the lead. "
Marco Wittmann
NÜRBURGRING IN PICTURES.
Impressions from the eighth race weekend of the season.
DTM Nürburgring


Need to cut down on the clutter around your home? Safe and Sound Removals has the extra space you need. With over 50 years in the business, we have the knowledge and experience to help you out. Being family owned and operated means that we will make sure that every customer is treated with the best customer service possible. We use our experience to know what's important to customers, and we know that everyone needs cheap storage units that are secure and safe.
If you are looking for cheap storage units in Melbourne, look no further! Our Melbourne storage warehouse is both well-maintained and secure, and with a convenient location, it's never going to be too far to go and check on any goods you have in your storage unit.
With so many years providing cheap storage for our customers, Safe and Sound Removals has built a professional standard which ensures our customers are always getting the best service possible. So, if you have any items around the house that you need safely stored, there is a secure, affordable and well-maintained storage facility in Melbourne that has everything you need. Stop falling victim to the leaks in your garage, insects in the shed and the dust in the attic. Give us a call and get a quote on what is available at our secure warehouse full of dry and well-maintained storage units.
With cheap storage units ranging from one cubic meter to 40 cubic meters available for long term or short term storage, our Melbourne storage location has an option for everyone. There is also plenty of shipping container storage options, so you can keep your goods in a huge waterproof container. We also offer experienced teams of removalists at affordable prices to help you make the move from home to storage, or you could even just get a hand wrapping and packing your goods.
With so many options it could be tough to know what option is the best for your needs, but never fear, Safe and Sound Removals has the knowledge to help you out. Never be afraid to give us a call and we will be more than happy to use our vast experience and knowledge to help you decide on what storage unit is best suited to your needs.
We have so many options available for your consideration, but there is still a few things that they all have in common, they're all affordable, reliable, and convenient.


University of Iowa researchers have found a type of grass that was once a staple of the American prairie can remove soil laden with PCBs, toxic chemicals once used for cooling and other industrial purposes.
The researchers investigated how adding an aerobic PCB-oxidizing microorganism could enhance the oxidation of certain PCB congeners (PCB 52, PCB 77, and PCB 153). "It seems to have worked for at least one of the congeners studied," says Tim Mattes, associate professor of civil and environmental engineering and corresponding author on the paper, published in the journal Ecological Engineering.
Researchers found that after 24 weeks, about 40 percent of total PCB mass had been removed by the switchgrass-treated soil, significantly higher than the 30 percent removed from untreated soil. Soil applied with a PCB-oxidizing microorganism (Burkholderia strain LB400) was found to remove about 47 percent of one of the PCBs tested. Also, the presence of switchgrass appeared to facilitate the microorganism's survival in the soil.


text:
Cultivating Citizens: The Regionalist Work of Art in the New Deal Era
Reviewed By: Keri Watson
Lauren Kroiz
Berkeley: University of California Press, 2018. 312 pp.; 51 color illus.; 51 b/w illus. Hardcover $65.00 (ISBN 9780520286566)
What is the role of the artist in twentieth-century American society, and how do museums and universities engage with living artists? What role does art play in the American academy and in American life? These are among the questions Lauren Kroiz wrestles with in Cultivating Citizens: The Regionalist Work of Art in the New Deal Era, a long overdue reevaluation of the American Regionalist triumvirate of Grant Wood, Thomas Hart Benton, and John Steuart Curry. Featuring a mix of lush color reproductions, black-and-white documentary photographs, and preliminary sketches, and drawing on a wealth of primary sources, including special collections at the Universities of Iowa and Wisconsin, the Archives of American Art, and the Archives of the Kansas City Art Institute, Cultivating Citizens offers readers a compelling reexamination of the controversies surrounding the art and professional lives of these formidable personalities. Building on the earlier scholarship of Howard Singerman, A. Joan Saab, and Michael Denning, Kroiz demonstrates the important role that pedagogy played in American art during the 1930s and 1940s and provides readers with insight into the contested role of Regionalist art in the academy and American culture.1
Cultivating Citizens is organized into three parts, one each for Wood, Benton, and Curry, and begins and ends with a brief account of the life of Earl Sugden, a fifty-six-year-old Wisconsin farmer, painter, and gubernatorial hopeful who was featured in a March 1941 issue of Life magazine. Sugden provides a surprising but appropriate anecdotal framing device, as his work as a professional farmer, amateur artist, and aspiring politician sets the stage for Kroiz's well-researched examination of the ways in which art, education, and politics intersected in mid-twentieth-century America. Each of the three parts, which can easily stand on its own, includes four chapters and uses the artist and his defining titular locale to explore the multifaceted and complex ways art influenced cultural and educational debates of the period. Examining the motivations of scholars, artists, and academic administrators, Kroiz outlines how the work of Wood, Benton, and Curry shaped public discourse on the role of art in American society.
"Part 1: Iowa" begins with Grant Wood's short-lived Stone City Art Colony, continues through his time teaching in the newly created Department of Art and Art History at the University of Iowa, and concludes with his untimely death and posthumous reputation. With the attention of a journalist writing an exposé, Kroiz teases out the pedagogical and social tensions that pitted the University of Iowa's leading art historian, German-émigré H. W. Janson, and its art department chair, Princeton-trained art historian Lester Longman, against Iowa's native son Wood. Through their heated debates on the appropriate use of photography (is it a tool or a cheap trick that leads to overly commercialized images?) and the politics of verisimilitude (is it democratic or fascist?) to discussions about the purpose of art education (should it be mechanical and technical or part of a well-rounded liberal arts education?), Wood, Janson, and Longman influenced not only teaching at the University of Iowa but also the reception of American Regionalism across the country (Janson's well known and influential History of Art did not include American Gothic [1930; Art Institute of Chicago] until 2007), and the institutionalization of art and art history departments at universities across the United States. As Kroiz shows, the ways in which the art and art history programs of today are conceptualized, taught, and situated in American universities is based largely on the debates staged in Iowa during the 1930s. Janson feared that embedding art in the university curriculum would lead to the commercialization and commodification of higher education, whereas Wood, influenced by both philosopher John Dewey and the European atelier system, envisioned art-making as dependent on the "mutual interdependence" of technical precision and personal expression (83). Kroiz's discussion illustrates the stakes of this debate in her thoughtful views about Wood's Sentimental Ballad (1940; New Britain Museum of American Art)—a painting made at the behest of the Association of American Artists to encourage popular interest in John Ford's film The Long Voyage Home—but that was harshly critiqued for its photographic realism and led to accusations within the department that "Wood applied, secretly and unethically, a practice derived from commercial art that discredited him both as a painter and a teacher" (57). For Longman, art history formed the bridge that mediated between the technical aspects of art education and the intellectual objectives of the liberal arts, which led him to establish a curriculum for the modern MFA degree that integrated both disciplines and trained a generation of professional artist-teachers. Certainly higher education today is largely commodified, and the factors that contributed to the reframing of the university as a business have gone far beyond art and art history departments, but Kroiz's careful analysis of the significant pedagogical contests that unfolded in Iowa illustrate larger issues within art, education, and society that we continue to grapple with today.
"Part 2: Missouri" shifts to Thomas Hart Benton, the Kansas City Art Institute, and the Nelson Gallery of Art and Atkins Museum. Here, debates raged between Benton and the Harvard-trained museologist Paul Gardner: How should museums form their collections? Should educational staff be paid? What is the public that museums serve? What are the museum's responsibilities to living artists, to art historians and scholars, and to children and their families? Limited by the constraints of William Rockwell Nelson's will, which funded the museum's building and collection but not education or outreach, Gardner recruited women from the Kansas City Junior League to serve as unpaid docents, a system quickly adopted by museums across the United States. As an artist and teacher at the nearby Kansas City Art Institute, Benton felt usurped and emasculated by Gardner's replacement of professionals, like himself, with female volunteers—feelings he visualized in the Kansas City panel of A Social History of the State of Missouri (1936; State Capitol, Jefferson City, MO), in which he "rendered the steps of the gallery's instantly recognizable Neoclassical façade behind scenes of bloody slaughterhouse labor and political corruption" (99). As Kroiz notes, Benton constructs the scene to align the young museum visitors and their female teacher/docent with the knocker of the slaughterhouse, thereby situating them as docile followers of the museum's agenda who passively absorb art without question or action. Gardner, who had been trained by Paul Sachs at Harvard University's Fogg Museum in a museology program based largely on the European system, emphasized historicism and formalism in his art education program. As observed by noted museum director John Cotton Dana and others, Sachs's museum studies program went a long way toward professionalizing American museums, but it also enshrined art as a rarified object removed from the daily concerns of the public—something to be looked at but not touched or made.2 This belief ran counter to the concerns of Regionalists such as Benton who, following Dana, saw art as integral to everyday life and vital to the spread of democratic principles. For Benton, art was active, not passive, but the educational programs offered by the Nelson Gallery stressed stylistic analysis and connoisseurship, not art making—they even hosted a junior docent program to train the next generation in aesthetic appreciation. Benton, as an artist and art teacher, advocated for the model of art exhibition espoused by the Association of American Artists (AAA), the New York City gallery that sold low-cost prints in department stores (and not coincidentally represented Benton, Wood, and Curry), and denounced the Nelson Gallery as "a graveyard run by a pretty boy with delicate wrists and a swing in his gait" (146). The blatancy of Benton's homophobia prevented his complaints from being taken seriously, and his volatile personality ultimately led to his dismissal from the Kansas City Art Institute, but Kroiz's investigation reveals the ways in which the seemingly personal feud between Gardner and Benton was actually rooted in period debates about the aesthetic, pedagogical, and political roles of the museum in democratic society.
"Part 3: Wisconsin" focuses on John Steuart Curry and his position as artist-in-residence at the University of Wisconsin from 1936 until his death in 1946. The last of the triumvirate to enter the academy, Curry did not return to his native Kansas, but moved from New York City to Wisconsin, where he was recruited by the Department of Agriculture to work with rural sociologists and provide artistic training to farmers. Unlike the contentious situations Wood and Benton found themselves in, Curry worked collaboratively and collegially with Wisconsin administrators, faculty, students, and community members to demonstrate the sociological value of art. Even as modernists in New York City condemned Curry for making paintings that lacked technical skill, Curry's role as artist-in-residence, rather than faculty in an art department, allowed him to advocate a "pedagogy of amateurism" that positioned his own struggles with technical proficiency as a strength rather than a weakness (168). Through insightful analyses of paintings such as State Fair (1919; The Huntington Library, Art Museum, and Botanical Gardens), The Stallion (1937; New Britain Museum of American Art), and Wisconsin Landscape (1938–39; The Metropolitan Museum of Art), Kroiz demonstrates how Curry's paintings functioned pedagogically to illustrate local concerns and bring art to the people. As Kroiz notes, "Regionalists and their advocates believed that individuals who learned to make art also learned the tools to become modern citizens, a role defined by active participation in the democratic sphere" (6). Foreshadowing current interest in socially engaged artistic practice, Curry's paintings and his position as artist-in-residence demonstrated that art was an experience available to anyone, and that the University of Wisconsin Rural Art Program, of which Earl Sugden was a part, showed through its classes and community art exhibitions that "self-expression [was] essential to a democratic citizenry" (165).
Cultivating Citizens: The Regionalist Work of Art in the New Deal Era offers readers a new look at Regionalism and the role of pedagogy in American art history. The significance of place is woven throughout the text, specifically vis-à-vis New York City, and the ways in which artists worked within and against systems of the avant-garde is emphasized. Wood in Iowa, Benton in Missouri, and Curry in Wisconsin may have been geographically removed from the center of the art world, but the debates that raged in the heartland influenced practices and policies in New York and Washington, DC, and had lasting consequences across the country. These issues still impact universities today, making Cultivating Citizens a must-read for anyone interested in the historical debates that shaped the current state of the arts and humanities. As Kroiz shows, during the 1930s and 1940s, American Regionalism "provoked crucial disagreements over the role art and its study play in democracy," and these arguments continue to resonate with artists, scholars, and citizens today (15).
Cite this article: Keri Watson, review of Cultivating Citizens: The Regionalist Work of Art in the New Deal Era, by Lauren Kroiz, Panorama: Journal of the Association of Historians of American Art 5, no. 2 (Fall 2019), https://doi.org/10.24926/24716839.2248.
PDF: Watson, review of Cultivating Citizens
Howard Singerman, Art Subjects: Making Artists in the American University (Berkeley: University of California Press, 1999); A. Joan Saab, For the Millions: American Art and Culture between the Wars (Philadelphia: University of Pennsylvania Press, 1999); and Michael Denning, The Cultural Front: The Laboring of American Culture in the Twentieth Century (London: Verso, 1996). ↵
John Cotton Dana, The Gloom of the Museum (Woodstock, VT: Elm Tree Press, 1917); Jeffrey Trask, Things American: Art Museums and Civic Culture in the Progressive Era (Philadelphia: University of Pennsylvania Press, 2012); and Carol Duncan, A Matter of Class: John Cotton Dana, Progressive Reform and the Newark Museum (Pittsburgh: Periscope, 2009). ↵
About the Author(s): Keri Watson is Assistant Professor of Art History at the University of Central Florida, Orlando
Keywords: 5.2, Keri Watson, Lauren Kroiz, modernism, twentieth-century art
Fall 2019 (5.2)
Of Masks, Mockery, and Modernism: Alexander Z. Kruse's Self-Portrait of an Art Critic
Teaching with Primary Sources
Heritage and Hate: Teaching Confederate Monuments with Archives
Looking for What's Not There in the Marcel Breuer Papers
Bridging the Distance: Teaching and Curating with Mail Art from the Archives of American Art
Artistic Journeys: Assignments Engaging Primary Source Materials
Isn't It Time for Art History to Go Public?
A Revolution in Color: The World of John Singleton Copley
Selling Andrew Jackson: Ralph E. W. Earl and the Politics of Portraiture
Fanny Palmer: The Life and Works of a Currier & Ives Artist
The End of Landscape in Nineteenth-Century America
The Trans-Mississippi and International Expositions of 1898–1899: Art, Anthropology, and Popular Culture at the Fin de Siècle
Proud Raven, Panting Wolf: Carving Alaska's New Deal Totem Parks
Georgia O'Keeffe: Living Modern
Models of Integrity: Art and Law in Post-Sixties America
Once Upon a Time in America: Three Centuries of US-American Art
Constructing the World: Art and Economy 1919–1939
Chiura Obata: An American Modern
In the Vanguard: Haystack Mountain School of Crafts, 1950–1969
Suzanne Lacy: We Are Here
Queer California: Untold Stories


text:
Thomas Stewart
A conversation with Thomas Stewart, editor of the Harvard Business Review and fellow at the World Economic Forum.
October 2004 October 2004 June 2004
Richard Ben-Veniste; Thomas Stewart
Politics, Business
Richard Ben-Veniste, a member of the 9/11 Commission; Thomas Stewart, editor of the Harvard Business Review. 53:18
'Winning'
Former GE C.E.O. Jack Welch and Suzy Wetlaufer of Harvard Business Review talk about their new book, "Winning." 53:37
Google Restructuring; John Sununu; Colin...
Politics, Business, Tech
A discussion of Google's restructuring. Fmr. chief of staff John Sununu on his book, "The Quiet Man." Comedian Colin Quinn on "The Coloring Book." 53:30
William B. Harrison, Jr.
JPMorgan Chase CEO William B. Harrison, Jr. on lessons he's learned over the years. 53:49
Nitin Nohria, dean of the Harvard Business School, discusses the ways in which the school has changed. 37:20


There seems to be an inevitably about the rise of AI. Machines. Robots that will aid us, work with us and help us evolve as a species… Well, that or turn on their creators, bringing about the end of our species.
An online food delivery service have brought home 1,000 take away meals via robots, during trials in London.
Produced by Starship Technologies, the robots can hold about 22lb in weight, and travel up to 10mph.
Armed with a radar, multiple cameras and sensors, the robots can detect and avoid any obstacles (including puny humans) in their path. And, while they are monitored from a control centre, human assistance has not yet been called for.
Ideal candidates to take on last mile delivery, the Just Eat robots are sure to be adopted by rivals and other industries in the next couple of years. Will they permanently replace your traditional pizza delivery guy? Who knows – Let's just hope they don't get too aspirational though.
The definite attention grabbers in the revolution of the last mile, drones have become media stars thanks to successful tests by big companies.
In recent months they have been delivering pizza, medical supplies and, erm, contraband to prisons, but can we really expect drone deliveries to take off?
Well, some online giants are intent on releasing swarms of drones into our skies. However, the great drawback is a question of safety. Governments and other authorities are rightly concerned about collisions, crashes and the general maiming of the public, so it all depends on the brains behind the technology working with law makers to make drone deliveries a reality.
If the technology is accepted, then the impact on the last mile would be huge. Airborne delivery would mean an order is fulfilled just a couple of hours after been placed, and the costs of fuel and manpower almost eradicated.
Drones aren't they only forms of transport looking to replace the trusty old van. Bikes, boats and trains are all back in the running to bring new life to the last mile.
The bike has the obvious advantage of being light, compact and capable of getting much closer to your front door. Great for small or medium(ish) deliveries, but obviously out of the question for heavy duty goods.
While taking advantage of the UKs canals and railway lines could create moving distribution hubs, carrying large cargos into the heart of the city, and then distributing by van, bike or drone.
Amazon are also building traditional distribution hubs in cities throughout the world, with 58 established in the US last year alone.
Bring the distribution centre closer to the delivery location obviously cuts the last mile running time down. It also means that your couriers are focused on one specific area, therefore giving them a deeper insight to help the get the job done more efficiently.
The emergence of crowdsourcing apps like Uber, Hungry House and Airbnb is now giving rise to logistics based apps that function in the same way. Like city based distribution hubs, engaging a 'local' courier to fulfil a delivery has the advantage of local knowledge to save time and money.
Placing lockers at convenient locations like shopping malls, stations, gyms, etc. gives customers the option to pick-up their order directly from the lockers at their own convenience, using a barcode scanner to get the goods.
InPost lockers have proven successful by freeing the courier and customer from a specific delivery time.
As we said, we now live in at a time where technology and intent are finally in sync to take on the challenges of the last mile. An attack that will continue to see more solutions emerge, and the inefficiencies finally addressed.
The days of the 'Last Mile Delivery' may indeed be numbered – The time of the 'Last Metre Delivery' is now upon us.
To find out how we can help you take on the last mile, please contact us today.


text:
from ConfigParser import ConfigParser

def get_cfg():
    cfg = ConfigParser()
    cfg.read('configuration.ini')
    return cfg

def api_info(a):
    cfg = get_cfg()
    items = dict(cfg.items(a))
    return items

def get_api_item(a,b):
    cfg = get_cfg()
    item = cfg.get(a,b)
    return item

def get_proxies():
    cfg = get_cfg()
    proxies = dict(cfg.items('proxy'))
    if len(proxies.keys())==0:
        return None
    first = proxies.keys()[0]
    if proxies[first] == "none":
        return None
    return proxies

redpajama_set_name: RedPajamaGithub


Cambridge Granta were beaten by six wickets at home to Sudbury in the East Anglian Premier League.
Action from Cambridge Granta vs Sudbury.
Urging his team-mates on from the Clare College Sports Ground boundary rope, Alex Sears called for Cambridge Granta to put Sudbury under a "bit of squeeze".
With the Gibbs Denley East Anglian Premier League match seemingly slipping away from them, the hosts were able to do just that, causing a bit of a wobble in the visiting ranks.
However, experienced campaigner Tom Huggins proved an immovable object as he carried his bat for 111 to ensure Sudbury triumphed.
They successfully reached 201 for 4 with 10 balls to spare as Granta suffered defeat in the competition for the first time this season.
"I think that's a good thing about our team that we're never going to give up and will go right until the end," said Granta captain Johnny Atkinson.
"We knew we had to work really hard, especially after not getting too many early wickets, and that we had to stay patient and be really tight in the field.
With grey skies and a damp track, losing the toss was a blow for the hosts and they were denied the chance to chase for the first time this campaign.
They were soon in a spot of bother on 12 for 2, but up stepped Michael Pepper to make his mark on the match, coming to the crease in only the second over after Dougie Rice had gone for a duck.
And he proceeded to bat for the remainder of the innings, maintaining his excellent early-season form which has also seen him shine for the Unicorns.
Pepper, whose older brother Chris is set to return from university soon to bolster the Granta ranks, made an unbeaten 125 off 151 deliveries, with his knock containing eight boundaries.
The biggest partnership he forged was worth 51 with Drew Hawley, who was the side's second-highest scorer with 19.
A productive final over saw 18 runs added to the tally as Granta posted 199 for 9 from their allotted 50 overs.
Sudbury wicketkeeper Adam Mansfield certainly earned his corn with five catches and a stumping, but he did not hang around for long in the run chase, being caught behind by Pepper off the bowling of Raj Singh for two.
However, Granta, who were already stretched and had called up Dan Kindred and Evan Hill from the seconds and thirds respectively, suffered an injury blow when Singh pulled his hamstring.
Sudbury skipper Huggins and Darren Batch (56) soon got on top as they controlled matters, ticking along nicely with patient batting and putting on 141 together.
Things got interesting towards the end as three wickets went down in quick succession, but Huggins used all of his experience to see the job through and James O'Brien (17 not out) hit the winning boundary.
"It was a huge toss to lose. All of the conditions were going in the favour of the team bowling first," said Atkinson.
"The pitch was a bit damp, the overhead conditions were perfect for swing bowling and I certainly would have jumped at the chance to bowl first.
"We knew we had to dig and get past the first half an hour, but unfortunately we weren't able to do that and lost a couple of early wickets.
"We were always playing catch-up from then on, so it was certainly a frustrating toss to lose.
"It's the first time we haven't chased this season. We're not always going to win the toss and bowl first, so it was good to have an opportunity to try something new.
Half-centuries from Joe Reed and Peter Worthington proved to be in vain as Mildenhall went down by five wickets at Great Witchingham.
The former hit 59 and the latter got 56 as Ben Shepperson's men amassed 244, being all out in the final over.
Tino Best and Worthington took two wickets apiece in the run chase, but Luke Schlemmer guided Witchingham home.
His unbeaten 106 was added to by Michael Jones (58) as the hosts reached 247 for 5 in the 48th over.
Burwell suffered an agonising one-wicket defeat to Vauxhall Mallards.
Burwell openers Thomas Jagot (75) and Simon Donald (72) put on 103 for the first wicket, with Joe Tetley contributing 44 as they made 259 for 9.
Mitchell Todd made 104 and Ben France 50 as the home side closed in on the total. But Josh Arksey (2 for 44) removed France and Jay Ghelani (3 for 35) bowled Todd to give their side a chance.
But an unbeaten 26 off 19 balls from No 10 Paul Bradshaw got his side over the line.