What does a Great Father Do?

Today my daughters wished for Father’s Day. It raised question how should father be to children. Sharing  real life story observed and asking myself “How will I behave with my children in adverse condition where I have no control?” and “Can I be father to my daughters like the father to his son in the story?”

“This is the price you pay for having a great father. You get the wonder, the joy, the tender moments – and you get the tears at the end, too. “

Once upon time, there was father and mother. The retired father had a son and daughter. The son went to engineering college.The son was healthy guy, involved in sports and leading social-curricular activities at college.  The son was college students chairman and coordinated placements also. In his final year, the son got placement in non-IT firm, which was very much aligned to his passion and got placement in IT company.

The son wanted to be in India, with responsibility of taking care his retired parents. When son submitted his medical checkup for non-IT firm, the company send him an email that they are withdrawing the offer and the reason was that he has only one kidney. Yes, one of his kidneys was removed when he was less than 2 years old. The son was broken and could not comprehend the reason, as he never have thought someone would reject him based on physical ailment and have involved in lot of automotive work with passion.  The son went to attend the initial training for IT firm and realized his mind not ready for IT job.

Here comes the real test for father. Your son was confident with his success and for no logical reasons, he has been thrown away from pedestal and how do you  support him. The father supported his son and asked him to do what is best for him. The son joined a job in his area of interest  paying him salary less than Rs 10,000 p.m. This job was a really tight job being on the shop floor and hectic interacting with lot of people.

The father motivated son to appear for GRE/TOEFL. The father enabled son with internet dongle( not common in those days) month, downloaded application, printed them, filled them and got pay order for application fees and send application to colleges, travelling where needed.  The son got admission in to college in USA and had no scholarship.  The father said that he will support with his means. The son quit his job to come and prepare and the father has bought one-way ticket. When you leave job, you lose your medial insurance also.

Here comes the second test for  father. The son plays volleyball every day and one day he slips and his ribs are broken. His visa interview is around. The father and his friends admit him in hospital and they perform minor surgery.  The father acknowledge that falling in sports was natural.  when your children make mistake that impacts their life, as parents we get annoyed and hurt them with our words. The father did not say anything and spend a lot of money, which was limited at his life stage.

Here comes the third test for father: After 2 weeks, they find that surgery has not healed and the surgery needs to be repeated. The father was broken in heart. Visa interview is coming, tickets are booked, son does not have job and son is in hospital, need to spend money, which is  limited and they have to repeat surgery.

The father ran around found an elderly doctor waiting till late night. His only priority was his son life and not him. The elderly doctor said that he would take care  son’s priority and not others. The son may attend visa interview and will not be able to travel on booked date and can travel after week of the booked date.

Before his retirement, the father  bought car and he loved driving  the car. He sold the car and paid for second surgery. He explained others that there is problem with his ears and does not want to drive and hence he is selling his car.  As there was no money to get another fresh ticket, he ran around  and literally pleaded/ requested many people and  with doctor’s  letter was able to get ticket transferred to later date without additional payment.

Readers can see connect between this story and Sujatha‘ story, which I have read also. When I observed this father-son journey, it came across as new age variant and decided to write and wish all fathers Father Day.


Is it fair to ask “Married or Single?”

Read article Married or Single?  posted by Punit Soni. In recruitment process, candidate asked this question”Married or Single?”. I was surprised to see this article. May be I did not expect an article on women rights from Punit Soni (sorry?) and was happy that he was ready to scratch upon the tip of the iceberg. Made me think my IT Career experiences.

Been for more than decade in IT industry, I agree that huge effort is needed from new manager to follow fair approach towards women and differently able people.   Not only large companies can create a fair environment for women, small companies and startups can do also. What is needed is a positive mindset and that comes from positive interactions experienced by male employee early in career in his team or by his supervisor Did they have right experiences that influences them on being manager to  create positive environment for women?

Here my experiences and learning that has helped me to create my perspective towards women employees. sharing the same to say it is possible to create positive mindset.

In my second job, the only Tech Lead I worked for long duration and was friend was women. One day, she had to leave late and she comes by 2-wheeler from south Bangalore. My manager Asif had called for a taxi. On her leaving, he asked her to go home safe in taxi. She went in cab leaving her 2-wheeler. These are times when team worked using desktops and  cab means private card called in advance and we worked in Central Business district. Thanks Asif to help me get right perception to support female employee.

When we went to USA, we had our first daughter born and we were only two of us. Not knowing what to do in new city, I asked my female lead engineer(45 years old) and she was extremely helpful to make me see the responsibility to take care of my wife and my child.   At the same time, She raised question to my  company manger “what will Srini do if baby is born and project is over previous week”. My manger neither gave her proper answer and also came and polished asked “How does she know that your wife is pregnant? I responded that this is our problem and we will handle”.

This lead engineer c and manger shared  how my manger responded and  shared that we take steps to ensure that  your family will not be in zombie state and know what to do. Surprised that how Mid-West Americans supported, contrary to my past wrong belief ” Americans do not care”, both men and women. When baby was born, support received from everyone in Milwaukee, made me humbler and also make me to think of “Pay backwards”what I received. Our manager  attitudes gets developed when we are engineer and the positive it is towards women, it remains positive later. 

In my third job at startup, it was multiple experience. As company, women were treated well. Company bought 4 wheeler and hired driver for company owned 4 wheeler and employed the driver.Officially the driver becomes escort for female employee going late. After Prathibha case, female employees were asked to go home by 8:30 pm and we had a cab at 8:30 pm . Another trip at 7: 30 pm to drop employees to closest bus-stop. My friend Sudhakar showed that we can  balance diversity and being frugal and it is mindset.

On my end, I hired women employee for short term. she was quick learner, well skilled and went for higher studies later.  Thanks to V who  was my first female team member.  She shared how guys behaved, remarks shared without bad intention and why it hurts. My patient listening to her geared myself to hire women employees and understood their needs from manager.

Talent needs to be valued, irrespective of  men or women. My colleagues used to share with women candidates project challenges, late evening call support needed. We conveyed that we will support your well being, we have constraints and still we try our best. Planned their work  to allow them leave home by 8:30 pm or have setup to Work from Home.  We need to answer questions from male employees for this partial support to women.

For my team, there was female candidate for interview for automation engineer and I observed that she was pregnant (already father to 2 children). J performed extremely well in the interview and answered beyond my expectations and her current salary was too low with our offering.  Asking her to wait, I went to my HR(female) & recruitment mgr(child) and said “she is pregnant and she is best fit for role”. They said “Hire for talent”. HR influences in large way in creating culture of organization towards women employees. 

I went back and shared with her our interest and said ” I have seen my wife pregnant.  Are you pregnant?”. She answered yes and asked  how she can travel from Vijaya Nagar in this state. She shared that her company is in ITPL and our office was half the distance compared to her office. I asked next bold question” When is baby due date?”. This date fell 2 weeks before release, there was (>) 5 months from day she can join  I hired her.

This girl learnt learn C# and write code in C# using Visual Studio in first month. She did all this independently with  little supervision with my team lead. Her work impressed me to keep in touch for long time, even after both left company, she went abroad and searched for a job coming back to Bangalore. Today I will hire her again if she looks for a job. Jothi taught me to never look at things like pregnancy in job interview.

In my own startup. S , started as fresher, after an year she got married, she became pregnant too.. We switched off elevator beyond 1 hour in morning and evening. The pregnant employee was permitted to come to the 3rd floor office by elevator. If you are attentive to your actions, you can create exceptions every where. 

When she left of maternity leave, we paid salary across her maternity months.  Thanks to Guru who would keep S’s salary first aside, even in tricky times. When she came back, there was an unfortunate scenario for her to leave. S was given gift and asked to get things right and join back. There was clarity in thought that paying her maternity days was right thing to do as employer. Allowing her to  leave was right thing as that is what is expected from a  parent in her situations.  Being parents, we could relate to S as parents.  Your colleagues drive and influence your approach towards women. 

To end, We see more people beyond women with need on humanity to support them fairly and equally to enable them get a fair life, differently enabled people. As part of my product marketing role in 2nd startup, I proposed an innovative way to make NGOs to use our product. GN, my partner allowed creation of  campaign to provide our product offering free for differently enabled students. While we obtained a lot of learning about our learning software and it opened new opportunities, GN decided to walk the talk by hiring 3 differently enabled people in office. The whole office learnt how to work with them and how we make them feel in our interactions. Thanks GN for humble experience that gave me confidence to work with NGOs and organizations working  with differently able students.

On one side, when companies like SAP offer day care centers and special support for female employees, picture is not rosy across IT employees. These are experiences heard from employees, friends and neighbors.

Female employees, mothers in small companies are scheduled calls at 8:30 PM to 9:30 PM or from 9 PM to 10 PM. What would happen to their children sleeping habit?

Female employees in ITPL areas can be found on BMTC VOLVO buses even after 9 PM when roads get deserted. I see girls who stay in one of our apartments coming late. I am happy with women walking on road in night. If female employee is not ready to care for her safety in Bangalore famous for its Pratibha case, how will it strike to manager (male) to think of female employee needs? 

Both male and female employees in India attend calls between 6:30 PM and 8:30 PM. Assume that these Indians can attend from home, when do they spend time with their children? Mostly, you would see their American colleagues would do best to have all things to  protects his personal time. Do Indians not need personal time?.

I know houses where fathers lock their rooms because child would not allow them to take calls. when my girls were young, they come and sit on my lap across client call. I used to inform that she is listening and my daughters rarely shouted/screamed. May be a rare case. Today in home calls, when people ask to ON webcams, I do not or at times I hear that I look dull, I ignore and focus on agenda.  I and my daughter share study room. .

To note, at closing time of call at 9:30 PM, lead/manager asks team member to send minutes of meeting  or send email with some details or perform a small change and wants the same immediate, sharing that would help them be more productive. My question is ” why they fail to understand that employee took call in personal time? How fair it is of them to assign work and ask for  completion in personal time?

How to test application implementing ML algorithm?

To perform testing of software programs, one arrives at a set of tests steps to test programs and test data to be provided at each of testable step and the expected output from the program based on the test data and test step. If the actual output from the program is same as expected output, we declare that program is functioning fine.  The working of the program gets tested for correctness for boundary and exception scenarios of both program and data input.

Having spec algorithm’s, coded algorithm’s, unit tested algorithm and tested them as part of application in my earlier days, I want to understand how people test mobile learning programs. This is my current understanding which I want to improve.

Coming to software testing of machine learning program, directly applying conventional software engineering process may not work. It is challenge to detect errors, faults and defects in machine learning program that takes arbitrary input to generate program’s output and to determine whether the program’s output is correct or reliable for the data inputs. Are ML programs non-testable?

Should testing of machine learning program focus less on whether ML algorithm learns well and focus more on whether application using the algorithm implements the specification and fulfills the user’s expectations?

First, start to understand the problem domain and suitability of algorithm in the problem context based on potential range of data inputs arriving in real time, in terms of real world data sets. Thinking of data sets can start with following data-set characteristics. Small vs large, repeating vs non-repeating values, missing vs non-missing attribute values, repeating vs non-repeating attribute labels,  predictable vs non-predictable attribute values, attributes that take non-negative values only , attributes that can also take negative value and the precision required for floating point numbers.

Second, test working of algorithm and third is to test algorithm providing data inputs.

  • Are you implementing algorithm? Design a series of primitive tests for various sub-parts of the algorithms, and an end-to-end test testing the final output or algorithm behavior.
  • Are you making use of some algorithm? Understand the algorithm and required validation for user inputs to ensure getting best possible results and how to arrive in the problem context, whether the algorithm results are sensible or not.
  • Check  upper bound reports on time and space used by the algorithm and get a measure of efficiency in terms of size or complexity of its input (Big O notation).

Think in terms of unit tests and regression tests for machine learning programs.

  • Add unit tests to your code and have approximate testing of your expected results
  • Create multiple data-sets with different difficulty levels like easy, difficult and adversarial. Whenever code changes to add a feature or fix a bug, run code against all of these data-sets to ensure that expected outputs lie in a reasonable error range and do not break existing functionality.

Arrive at criteria to determine meaning of correctness, working with domain specialists.

Discuss, Decide and determine margin of errors or correctness percentage beforehand to testing machine learning program. For example, if program interprets 75% of test data correctly, the programs is considered to be good enough. Remember that it might not be possible to demand test validation of 100% correctness as the intent of machine learning is to tolerate ambiguity.

Testing would benefit with software engineers ability to provide a data set generator, tools that would help to compare the output results and their correctness based on the data inputs.  You need to have methods to capture and view trace options that are inserted in to the ML program and tools to analyse traces to debug, test and validate intermediate results in specific steps of the algorithm.

Land your start-up flight in mid of journey.

Although the world is full of suffering, it is also full of the overcoming of it.- Helen Keller

Today, I hear a lot of  talk in media encouraging entrepreneurship as a credible career choice. Indian government supports for start-ups is new and wasn’t always like this. Generations before us were taught to find a ‘good job’, stay as long as you can and retire as soon as possible. Has everything changed? No.  On transition from a job to entrepreneur, one needs more attention to be aware of the risk and evaluate loss of leaving a steady job. This blog is not about transition from corporate job to start-up and if you are one, the articles of Saras Sarasvathy are of immense value.

Ignorant of lean-start-up concept in my first start-up days(2011), we performed quick research experiments on field with real customers. MVP was more an idea on head. More than Lean start-up, I recommend entrepreneurship principles starting with Affordable Loss in articles of Saras Sarasvathy.

When first start-up has not moved towards success and you are in state of limbo, there is a risk of falling in to trap of increasing eagerness to take more risks driven by your state of non-success.  Looking backwards, I question whether I invested sufficient time and thought to evaluate my decision to do second start-up initiative.  I became aware of this risk during my second start-up initiative via session of Saras with iSpirit. One area where risk applied to me was my failure to get my wife consent on the second initiative.

This blog is about landing the flight in mid of start-up journey, without reaching the planned destination. There is less traction from customers. You run out of money. Your partners decide to continue in start-up mode. Your attempt to aqua-hire did not happen too. Your ability became limited to act with little or no money to sustain and wait for another year.  You explored consulting and found the money inflow is less for family. Whatever is the reason, you decided to obtain a paying job. What next?

First step is to realize “Whether you like it or not, your personal life has changed. Be prepared to be alone”.  You spent waking hours to turn your dreams and plans into reality and were less in touch with your friends and relationships continuing in stable jobs during entrepreneurship.  You developed relationship with like-minded entrepreneurs, and supported their initiatives.

When you decide to transition back, the entrepreneur group seemed to keep distance using focus questions. They are right to safeguard their focus and attention to their dream or do not want to be distracted on their success focus in their start-ups. Failure is as good a distraction as much as success. You observe that cherished relationship in friends and entrepreneur groups continue and there is support.  All relationships that did not mature gets tested during transition.

You need to take care of yourself before you can take care of others. I failed to take care of myself and feel some guilt still.   Today I can realize a huge desire in me for someone to take care of me in my difficult times, when I wrote this blog Have I “Moved on with life” from mother’s loss? to kill silence and loneliness around me. My wife was also upset with my start-up journey and was ashamed to cry with her with the fear that she would break and I would become paralyzed in action. Both my children eased my pain with their love, started spending more time with them than anything else. My volunteering activities played significant role to create feeling of self-worth to myself. My first assignment after getting job was to bring my wife and children fully back in to my life.

Second step is to Cry out loud for your state for which you are solely responsible. The realization that I am stepping out of start-up race made me look things like failure in competition.  How long to cry alone? I called and people help from distance. No one is expert to support people in pain and suffering.  An early drink with my CTO (close his startup in 1990s) helped me to prepare myself to extent and was not fully helpful as he had the clarity to decide to continue the journey in start-up mode. If you need, call me and I am happy to give you company & revive old memories. I think this is needed to get out of guilt and plan another dream worth your chase and Get on with your next step.

Third step is to acknowledge the concern that it may be scary for recruiters, bosses and co-workers to interact with start-up entrepreneur. Start-up made you act like a hacker and hustle or be like a pirate. Who would want to work with a pirate? And once you were/are a pirate, you are a pirate for life. I realized this quite late after joining a job.

Fourth Step is to do some soul searching and come to terms with what it means to give up working for yourself. Get comfortable with your transition so that you can pitch your skills with conviction. I had limited time to perform this. In this aspect, I was doing transition to start-up to job similar to shifting between two jobs. I continue to suffer from the guilt/doubt whether I would be able to take best care of my children what I and my wife dreams in my current state and constraints.

Hell is for real. Crawling out and getting a life back is not a fantasy. Be prepared to do this alone. Any support is bonus.  I am still in process of that.

While it is sad and very difficult to do something else after a start up, you need to focus on your learning from a start-up to hear a NO without taking it personally and to sell stuff. So think yourself as the product, think of compelling reasons why someone would hire you, and meet them and let them know.

  • Worst outcome .. They say NO.
  • Best outcome .. You have the job and career you want.

Build confidence that you moved from corporate to start-up and you can move back also. You need a compelling story to explain the transitions. Many like me are unsure of how to talk about entrepreneurial ventures that flopped. You need to build strength to crawl through this hell. Seeing media articles, I have not estimate effort needed to get to a career job. Simply, I realized my unpreparedness in my job search and  learnt following.

  • Employers want to hire people interested to be there in job. You are already in disadvantage position not being in a job. You need to present yourself as someone pulled towards the company and not pushed out of constraints or money. I have done classic mistake “ If we scaled and been successful, I might not be here”. Talk to them how working for clients in start-up is similar to working within organization, meeting deadlines and attending to company needs.
  • Hiring managers may be averse to hear negative things. Failure is still perceived negative. If you fail to frames story in terms of what is drawing you to the job in question, to that company, to that industry, and focus on what went wrong with the start-up, you may find interviewers listen carefully to what you say. Some may be happy about what you said and some may be jealous of what you said. At last, they need to make a hiring decision of “Yes” or “No” and they may end with decision “May Be”. That is not in your favour and the resume gets lost in the email maze.
  • Explain move back to corporate with no apologies. Can your reframe Failures as Lessons? If  your start-up did not get traction, you did not get additional funding, describe your learning about launching new products and this can be reason for corporate to hire.
  • Talk Less, Answer only question Nobody wants to hire a start-up guy. Describe your start-up job like you were an employee instead of a co-founder. You are not in interview for a job to become entrepreneur. The other party may provide no brownie points for having been an entrepreneur. Take one or two lines to why you need to keep going. Do not try to explain what went wrong or be defensive to admit that something did go wrong. Try to keep yourself away from the past.  Ask yourself whether  one goes for a date and spend the first dinner talking about ex-date.

You have realized that the fact that you failed is not attractive.  What may become attractive is the experience gained by doing a start-up.  I have become self-aware that entrepreneur’s failure is more visible and likely to come up during an interview.

You need a resume. The purpose of the resume is to get you to the interview. Do not expect the resume to get you to job. It cannot do that. So anything that helps you Stand Out and get that call-back for interview is fair.

Do not market being founder of a failed start-up. Market how you got customers to experiment product, what made them perform so, how you recruited people to the team and how did you get press coverage without spending money.  How did you get attention of large corporations and involved in performing business development with them.  How did you self-train yourself on product management? Effectively market what you won.

While searching for a job, do not start with question “what job will I get with this experience?” May be start with question “What job I want to go out and get?”  The second question is more close to what your start-up probably took you closer to it, not further.

You need to apply to jobs that best suits your talents. What you were good prior to your start-up may have changed unless your role in start-up was similar to your previous job. But for that first you need to recognize what are you best at?

  • If you are software person and choose to be CTO (same discipline), then your skills may be considered more valuable if technology in start-up continues to be hot.
  • If you are software person and performed multi-disciplinary role in start-up, it is challenge for you to project your skills, when things have not succeeded. You spend less time in technical areas compared to corporate expectation. This changes perception of others as multi-disciplinary skill and make them observe that you are not expert in technical areas.

When you have more than 15 years of experience, be prepared to fact that probability to hire senior resource is driven by culture of company, team culture, and budget of hiring manager. Most of them may not have budget or may not be able to decide whether to invest their budget hiring you, as one needs to acknowledge the perception of hiring manager to hire someone attempted to start a business. When you are not from IIT, only few in India would be able to appreciate value in someone with failed start-up experience.

Talking to friends who continued in corporate jobs help to some extent. Some genuinely try to build my resume for you to become employable. Be aware that your skills and style of articulation that were your strengths in start-up may not be apt in interview and can overpower the spot on your resume, interview and upset your hiring chances. This was all after a friend said across lunch “While I admire you, I am going to recommend that you to purchase villa for a crore to have EMI payment of 1 lakh. This would help you to keep your mouth shut in job and be ready for corporate”.

Prepare yourself to talk on interview. Bucket your experience in to a couple of categories.

  • What did you accomplish at your start-up? Did you build a solid team, sign good deals, build a good product, secure and learn from community? Is this what is in your resume?
  • If you can go back to time when you started, What would you perform different? Which of your original assumptions turned out to be false? Where you spend time that you should not have and where else you should have focused?
  • Identify and share what was exciting part of your role in start-up.
  • In each context, be prepared to say what you would perform differently to prevent making the mistake again. Be prepared to discuss in interview. Do not think answer for first time in interview. In areas where you had success, try to get external validation, if possible on LinkedIn.

I am still not clear how much others receive or what they perceive when I describe to  demonstrate the guts and drive to start something or experience gained working rapidly in variety of disciplines, fact that you do things, not just talk about them.  Remember the start-ups may not have money, which is your need.

What I can perform within my control was following

  • Follow behaviour of servant leadership, being humble and  be respectful
  • Look for a small company to get a job, where you can be big, or work directly under the CEO/CTO if possible.
  • If you end up in a big corporate, you are below someone who is there for no reason at all, and your entrepreneur critical eye just leads you to frustration.
  • No one wants to hire someone who carries an aura of failure about them. Plus hiring someone with the entrepreneurial bug is a persistent flight risk
  • Stop attributing problems to external things. Don’t beat yourself up if you don’t make massive progress. If you make these regular incremental improvements, your life improves dramatically within not too long

This transition is life event. That means that this would play its role in the next job interview also.  Realize that how others will interpret life event depends almost solely on how you present it. If it is your great shame, then yes, people will see your great shame.

When you get a job and get salary credited, it is really weird feeling to see a paycheck come in every month for just showing up; that excites you for a bit, then the itch to get back to real action almost kills you. To handle my itch, I continue to write my blog and volunteer for non-profits, be a spring board to bounce and discuss ideas for entrepreneur friends and connect them via my network.

Like having children, Working for society and community is a life event or choice. You cannot get freedom from social bug, once you are bitten. Entrepreneurship is same, it is a life choice, you can give up on a career but the entrepreneurial bug is forever.

Good Read “Work Rules” by Laszlo

After reading book “Work Rules!: Insights from Inside Google That Will Transform How You Live and Lead” by Laszlo. I wanted to recommend book to others.  May be  availability of pirated copy of book indicated its real popularity.

Some of authors points connect with my own experiences in my startup job or running a startup.

  • Choose to think of yourself as founder and act like one.
  • Can you think of your work calling, with a mission that matters
  • Given limited resources, invest your dollar in recruiting.
  • if you believe people are fundamentally good and worthy of trust, you must be honest and transparent with them.
  • Most people who are performing poorly know it and want to get better. It’s important to give them that chance.
  • Find ways for people to shape their work and the company.Eliminate status symbols
  • Split rewards conversations from development conversations.
  • Help those in need; Put your best people under a microscope.
  • Invest only in learning courses that you can prove changes people’s behavior.Have your best people teach
  • Celebrate accomplishment, not compensation.Reward thoughtful failure.
  • Find ways to say yes.The bad stuff in life happens rarely. Be there for your people when it does.
  • Admit your mistake. Be transparent about it


XML Schema, DTD, and Entity Attacks – Part 1

Today, developers have access to powerful XML parser and XML technology enabled the developers to offload the marshalling issues. No more they are required to perform  custom serialization.  There exists a generic approach to handle different data structures and simple-easy approach to transform XML documents into business objects.

While highly generic and dynamic components made life easy for developers, they  also serve as the foundation for XML parser based attacks. This includes DoS – Denial of Service Attacks, inclusion of local files into XML documents, port scanning from the system where the XML parser is located, overloading of XML-Schema from foreign locations.

To start with, it has become easier to generate XML document in windows machine and consume in Linux machine, and there is possibility that implementation of libraries that generates XML may not be same as the ones ones that parse uploaded files.

A quick recall on XML and its elements. XML is a standard for exchanging structured data in textual format. Format of XML document is defined by either Document Type Definition (DTD) or XML Schema. A XML document is Well-formed if document adheres to the XML syntax specification and is valid if document adheres to the DTD or XML schema. When used incorrectly, these document definition and validation features can lead to security vulnerabilities in applications using XML.

A quick recall on DTD and its constituents. A DTD is a declarative syntax used to specify how elements and references appear for a document of a particular type. The document can be checked whether it is well-formed using a DTD. In addition, entities can be declared in the DTD to define variables (similar to textual macros) to be used later in the DTD or XML document.  To resolve external entities, an XML parser consults various networking protocols and services (DNS, FTP, HTTP, SMB, etc.) depending on the scheme (protocol) specified in URLs. External entities are used to create dynamic references so that any changes made to the referenced are automatically updated in the document.

[Some content comes from other sites and entire Code snippets].
Injection of a XML fragment  XML generators build the XML documents. Depending on the generator, injection of XML document fragments can be attack.  When more XML generators in the front-end, attacker injects fragments and send to server. Here, you see Injection of a XML fragment into the comment field of a online banking payment form (marked red)

XML injection

Addition of other  file in DTD – Processing external entities, Loading of content from local devices  DTD allows the inclusion of documents XML documents (web.xml) and any other file ( /etc/passwd). External EntitiesThe provided example is to reflect/emphasize the seriousness of the issue as most XML parser may find difficult to parse this file since XML parsers often require the content to be parseable

The attacker includes a short DTD in the document to define the “file” external entity, which references a configuration file local to the vulnerable application. When XML gets evaluated, contents of the configuration file gets included inline for the Designation field. XML parser evaluates the entities occurs within the XML parser, the application receiving this request has no simple way to know that the content in the Designation field was actually not a literal string.

Reference a local file

Once this is done, the attacker needs to ask the application for previously submitted employee profile information and would receive the information along with the desired file contents. In this approach, simple text files can be retrieved.Any XML special characters will generate a parse error and typically blocks inclusion of the entity in the document. The application does not know about the parse error  at the moment of entity inclusion, not during subsequent parsing of the containing XML.

Another similar exploit is “billion laughs” attack, done by defining nested entities within an XML DTD to build an XML memory bomb.

While XML specifications do not require any specific URL schemes to be supported, each XML parser has support for a set of URL schemes. Some  platforms expose all URL schemes supported by underlying networking libraries.By invoking URLs from within XML external entities, an attacker can leverage the system hosting the XML parser to initiate potentially malicious requests to third-party systems. These “server-side request forgery” (SSRF) techniques can allow for attacks against other internal services, even ones local to the machine(not otherwise exposed).

Exploit URL Schemes.png


Here is small write-ups of stalls I visited and could relate better with innovations at stalls@Innofest. Wish that innovation stalls were open for viewing by public,children and youngsters. Captured innovations to share and motivate readers to dream.

Let me start with TeamIndus,prototype design and aerial vehicle. Young guys have been able to innovated on large scale and serve as motivation for all to dream big and achieve.They stand to demonstrate that fundamental innovation can happen in India too.

Kisan Raja , powerAdapter to enable farmers to swtich on motor pumps in the field from his home and save the effort to walk across a long distance.

Visted stalls of 3D printers PRAMAAN and PRAMAAN-Mini. Learnt  what items can be made with 3D printers and raw materials used to create items like keychain, table tops, flower pots. Wish the innovators work to enable audience to relate to product easily, something like create some pre-designed items, make items and share with audience to take home(for charge). Connected audience has ability to share with more people.

vSkin is a wearable glove to creates a sense of touch on the users’ fingers in a virtual setting.  One can feel the hand movements while working with a digital piano or use glove as part of video conferencing calls to perform remote handshake. The innovators are currently in age group of 19 to 22 years.

Tesseract is a Virtual Reality headset. The prototype headset works with content created or stored on a laptop; new ones work with mobile phones also. Wish Tesseract becomes complimentary item with XBox for customers to think about. They have sourced optics from China, acrylic lens from India and manufactured in China.

RideLogik helps with charging base for the smartphone. Wish they provide more value propositions around the vehicle efficiency and performance. Though they can integrate with any vehicle that runs based on electronic control unit, their focus is 2-Wheeler’s. They need to develop channels to reach existing 2-wheeler owners.

Found innovation of insulin pen to enable diabetes patients to take care of their health better more connected at ground level.The innovator has patent filed In India.

Shrishti  has displayed multiple innovative items. Though I am not covering all of them, I would like to cover the chair they have made using old newspaper. This chair can be used for outdoor purpose too and would not spoil in rain.  A means for paperwallas to become furniture makers? Here is my photo on the chair to say that chair was stable with my body weight.

Plugzee is device to turn any audio speaker system into a Bluetooth speaker. The device plugs into the 3.5 mm audio jack of speaker & lets you stream music wireless by Bluetooth pairing with a smartphone. They have leveraged crowd-sourcing to transform innovation to reality. Already started to ship last week- that is nice.

For more innovative items present in the stall, please check Madan article Passion and policy – startups and ministers at InnoFest 2015!

Edited version of this article was posted at http://pn.ispirt.in/innovation-innofest-2015/