Mahmoud

A Federal Appeals courts says Davino Watson, a U.S. citizen, has no right to damages awarded to him by a lower court after Immigration and Customs Enforcement (ICE) imprisoned for over 3 years as a deportable alien then dumped him without explanation in Alabama, leaving him with no means to get home to New York.

From NPR:

There is no right to a court-appointed attorney in immigration court. Watson, who was 23 and didn't have a high school diploma when he entered ICE custody, didn't have a lawyer of his own. So he hand-wrote a letter to immigration officers, attaching his father's naturalization certificate, and kept repeating his status to anyone who would listen.

Still, Immigration and Customs Enforcement kept Watson imprisoned as a deportable alien for nearly 3 1/2 years. Then it released Watson, who was from New York, in rural Alabama with no money and no explanation. Deportation proceedings continued for another year.

Watson was correct all along: He was a U.S. citizen. After he was released, he filed a complaint. Last year, a district judge in New York awarded him $82,500 in damages, citing "regrettable failures of the government."

On Monday, an appeals court ruled that Watson, now 32, is not eligible for any of that money — because while his case is "disturbing," the statute of limitations actually expired while he was still in ICE custody without a lawyer.

In a press release issued last week, the Edward Hopper House announced that it will be receiving over 1,000 artifacts and memorabilia documenting Edward Hopper's family life and early years. The collection "consists of juvenilia and other materials from the formative years of Hopper's life and includes original letters, drawings from his school years ... photographs, original newspaper articles, and other items that allow visitors to experience firsthand how Hopper's childhood and home environment shaped his art."

Above you can find Exhibit A from the collection. A picture that young Hopper, only 9 years old, drew on the back of his 3rd grade report card. A sure early sign of his talents.

Portions of this archive will be available for viewing this fall. If you're in Nyack, New York, pay the Edward Hopper House a visit.

Follow Open Culture on Facebook and Twitter and share intelligent media with your friends. Or better yet, sign up for our daily email and get a daily dose of Open Culture in your inbox. 

If you'd like to support Open Culture and our mission, please consider making a donation to our site. It's hard to rely 100% on ads, and your contributions will help us provide the best free cultural and educational materials.

via Art Daily/@TedGioia

Related Content:

How Edward Hopper “Storyboarded” His Iconic Painting Nighthawks

Edward Hopper’s Iconic Painting Nighthawks Explained in a 7-Minute Video Introduction

The Museum of Modern Art (MoMA) Puts Online 75,000 Works of Modern Art

9-Year-Old Edward Hopper Draws a Picture on the Back of His 3rd Grade Report Card is a post from: Open Culture. Follow us on Facebook, Twitter, and Google Plus, or get our Daily Email. And don't miss our big collections of Free Online Courses, Free Online Movies, Free eBooks, Free Audio Books, Free Foreign Language Lessons, and MOOCs.

Archaeologists excavating a Hittite city on the border of Turkey and Syria found a broken jug that, upon restoration, revealed a smiley face. At 3,700-years-old, it could be the oldest smiley face drawing ever found. From Smithsonian:

According to ​Zuhal Uzundere Kocalar​ at Turkey's state-run news service, the Anadolu Agency, the researchers did not notice the smiley face until restorers put the fragments of the round, off-white jug with a small handle and short neck back together.

“We have found a variety of cubes and urns. The most interesting of them is a pot dating back to 1700 BC that features an image of a 'smile' on it,” Nicolo Marchetti, an archaeology professor at the University of Bologno in Italy, tells Kocalar. “The pot was used for drinking sherbet [sweet drink]. Most probably, [this depicts] the oldest smile of the world.”

The post Metamorph-Assist appeared first on The Perry Bible Fellowship.

it’s small but it made a little positive difference for a lot of people. thank you microsoft or whatever.

One of our jobs here in Shopkick’s infrastructure team is to save everyone time, without sacrificing security. During a recent hackathon, we decided it would be fun to replace some of our internal systems using http basic authentication with something a bit more - how shall I put it - from this decade. Fortunately, Bitly’s oauth2_proxy provides a fairly easy way to do just that, allowing us to leverage Google authentication with OAuth, which we were already using elsewhere.

We had a few issues to contend with in starting this.

• We use nginx for SSL termination and reverse proxying our internal sites.
• We want to make things more, not less, secure.
• The transition had to be as seamless as possible.
• We had to accommodate the WebSocket protocol for Jupyter notebook.
• We had to be able to finish the work in a single 24-hour hackathon.

You only need two things to make this work: oauth2_proxy and nginx (1.5.4+ for auth_request support). Building a simple Go application like oauth2_proxy is fairly easy, but if you prefer to grab the precompiled binary you can find one on the GitHub releases page. Either way, all you need is the oauth2_proxy binary. In the examples here, we are running oauth2_proxy on the same hosts as nginx, but that is not a requirement.

The configuration file for oauth2_proxy is fairly simple:

email_domains = [
    "shopkick.com"
]
upstreams = [
    "http://<FOO>.shopkick.com"
]
cookie_secret = "<REDACTED COOKIE SECRET>"
cookie_secure = true
provider = "google"
client_id = “<REDACTED_CLIENT_ID>.apps.googleusercontent.com”

Certain configuration values are better left set as flags at runtime. Here are some that we set:

• -set-xauthrequest - sets the X-Auth-Request-User and X-Auth-Request-Email headers which can be passed through by nginx
• -client-secret - sets our client-secret at runtime, rather than in the config file
• -authenticated-emails-file - sets the path to a newline-delimited list of external email addresses that are permitted to authenticate

Once you have your config in place, run oauth2_proxy like this:

$ oauth2_proxy -set-xauthrequest \
-config <CONFIG_FILE> \
-client-secret <REDACTED_SECRET> \
-authenticated-emails-file <EMAIL_LIST_FILE>

The rest of your configuration is in nginx. As mentioned before, make sure you are using 1.5.4+ or something with auth_request support. Following are some example configurations.

Here is an example with WebSocket support, for Jupyter notebook in our case.

server {
    listen 0.0.0.0:443 ssl;
    server_name foo.shopkick.com;
    location /oauth2/auth {
        internal;
        proxy_pass http://127.0.0.1:4180;
    }
    location /oauth2/ {
        proxy_pass http://127.0.0.1:4180;
        proxy_set_header Host $host;
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header X-Scheme $scheme;
        proxy_set_header X-Auth-Request-Redirect $request_uri;
    }
    location / {
        auth_request /oauth2/auth;
        error_page 401 = https://foo.shopkick.com/oauth2/sign_in;
        proxy_pass http://foo:8080/;
        proxy_set_header Host $host;
        # Jupyter requires WebSockets, so we have to add these lines
        # in order for terminals and notebooks to function.
        proxy_http_version 1.1;
        proxy_set_header Upgrade "websocket";
        proxy_set_header Connection "Upgrade";
        proxy_read_timeout    86400;
    }
}

Example passing X-Forwarded-User and X-Email headers, based on the information provided by oauth2_proxy's -set-xauthrequest command-line flag.

server {
    listen  0.0.0.0:443 ssl;
    server_name bar.shopkick.com;
    proxy_headers_hash_max_size 2048;
    proxy_headers_hash_bucket_size 128;
    location / {
        auth_request /oauth2/auth;
        error_page 401 = https://bar.shopkick.com/oauth2/sign_in;
        proxy_set_header Host $host;
        proxy_set_header HTTP_X_FORWARDED_SSL on;
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header X-Forwarded-Proto $scheme;
        auth_request_set $user   $upstream_http_x_auth_request_user;
        auth_request_set $email  $upstream_http_x_auth_request_email;
        proxy_set_header X-Forwarded-User  $user;
        proxy_set_header X-Email $email;
        proxy_pass http://bar:80;
    }
    location /oauth2/auth {
        internal;
        proxy_pass http://127.0.0.1:4180;
    }
    location /oauth2/ {
        proxy_pass http://127.0.0.1:4180;
        proxy_set_header Host $host;
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header X-Scheme $scheme;
        proxy_set_header X-Auth-Request-Redirect $request_uri;
    }
}

And finally, an example using a non-standard port for https.

server {
    listen  0.0.0.0:4443 ssl;
    server_name baz.shopkick.com;

    # Redirect to HTTPS when HTTP request comes in
    error_page 497 https://$host:4443$request_uri;
    location / {
        error_page 401 = https://baz.shopkick.com/oauth2/sign_in;
        auth_request /oauth2/auth;
        proxy_pass http://baz:4443;
        # Note that here we are passing $http_host instead of $host.
        # $http_host contains the port information, which in this
        # case is critical for the redirect URL that google hands
        # back after a successful authentication.
        proxy_set_header Host $http_host;
    }
    location /oauth2/auth {
        internal;
        proxy_pass http://127.0.0.1:4180;
    }
    location /oauth2/ {
        proxy_pass http://127.0.0.1:4180;
        proxy_set_header Host $host;
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header X-Scheme $scheme;
        proxy_set_header X-Auth-Request-Redirect $request_uri;
    }
}

While all of the above uses Google as the OAuth provider, everything here should work with any other supported provider: Azure, Facebook, Github, Gitlab, LinkedIn, or MyUSA. Just remember to set your provider flag or config setting.

Happy authenticating! And don't forget to subscribe!

"What are plugins?" and other proceedings of the inaugural PyCon Comparative Plugin Systems BoF.

Update: This BoF and post inspired [a talk I gave at PyGotham 2017][pygotham2017].

Within the programming world, and the Python ecosystem in particular, there are a lot of presumptions around plugins. Specifically, we take them for granted. "It's just a plugin." "Oh, another plugin library?"

So for PyCon 2017, I resolved to dismiss the dismissals by revisiting plugins, and it may have been the best programming decision I've made all year.

Why plugins?

For all types of software, open-source or otherwise, the scalability of development poses a problem long before scalability of performance and other technical challenges. Engaging more developers creates code contention and bugs. Too many cooks is all it takes to spoil the broth.

All growing projects need an API for code integration.

Call them plugins, modules, or extensions, from your browser to your kernel, they are the widely successful solution. Tellingly, the only thing wider than the success of plugin-based architecture is the variety of implementations.

Python's dynamic nature in particular seems to encourage inventiveness. The more the merrier, usually, but at some point we cloud a tricky space. How different could these plugin systems be? How wide is the range of functionalities, really? How does a developer choose the right plugin system for a given project? For that matter, what is a plugin system anyway? No one I talked to had clear answers.

So when PyCon 2017 rolled around, I knew exactly what I wanted to do: call together a team of developers to get to the bottom of the above, or at the very least, answer the question,

"What happens when you ask a dozen veteran Python programmers to spill their guts about plugins?"

Setting examples

Our group leapt into action by listing off plugin systems as fast as we could:

• stevedore
• twisted.plugin
• Mercurial extensions
• pytest plugins (pluggy)
• gather
• venusian
• pluginbase
• straight.plugin
• pylint plugins
• flake8 plugins
• raw setuptools entrypoints
• zope.component
• Django command extensions
• SQLAlchemy dialects/DBAPIs
• Sphinx extensions
• Buildout extensions
• Pike
• Dectate and Reg
• Others that came and went a little too fast to jot down

With our plate heaping with examples like these, we all felt ready to dig into our big questions.

Taxonomizing

For our first bit of analysis, we asked: What practical and fundamental attributes differentiate these approaches? If we had to create a taxonomy, what characteristics would we look for?

Generalizability

You'll notice our list of example plugin systems included several very specialized examples, from pylint to SQLAlchemy. Many projects even use totally internal plugin systems to achieve better factoring.

Bespoke plugin systems like pylint's are a valuable reference for anyone looking to account for patterns in their own system, especially generic systems like pike and stevedore.

Discovery

A plugin system's first job is locating the plugins to load. The split here is whether plugins are individually specified, or automatically discovered based on paths and patterns.

In either case, we need paths. Some systems provide search functionality, exchanging explicitness for convenience. This can be a good trade, especially when plugins number in the double digits, or whenever less technical users are concerned.

Install location

Closely related to discovery, our next differentiator was the degree to which the plugin system leveraged Python's own package management facilities. Some systems, like venusian, were designed to encourage pip install-ing plugins, searching for them in site-packages, alongside the application itself.

Other systems have their own search paths, locating plugins in the user directory and elsewhere on the filesystem. Still other systems are designed for plugins inside the application tree, as is the case with Django apps.

Plugin independence

One of the most challenging parts of plugin development is finding ways of independently reusing and testing code, while keeping in mind the code's role as an optional component of another application.

In some systems, like Django's, the tailoring is so tightly coupled that reusability doesn't make sense. But other approaches, like gather's, keeps plugin code independently usable.

Dependency registration

Almost all plugins work by providing some set of hooks which are findable and callable by the core. We found another differentiator in whether and how plugins could gain access to resources from the core, and even other plugins.

Not all systems support this, preferring to keep plugins as leaf participants in the application. Those simplistic setups hit limits fast. The next best, and most common, solution is to simply pass the whole core state at the time of hook invocation, providing plugins with the same access as the core. It works, but the API becomes the whole system state.

More advanced systems allow plugins to publish an inventory of dependencies, which the core then injects. Higher granularity enables lazier evaluation for a performance boost, and more explicit structure helps create a more maintainable application overall.

Drawing a line

With our group feeling like we were approaching the nature of things, we reversed direction, asking instead: What isn't a plugin system?

Establishing explicit boundaries and specific counterexamples proved instrumental to producing a final definition.

Is eval() a plugin system? We thought maybe, at first. But the more we thought about it, no, because the code itself was not sufficiently abstracted through a loading or namespacing system.

Is DNS a plugin system? It has names and namespaces galore. But no, because code is not being loaded in. Remote services in general are beyond the boundary of what a plugin can be. They exist out there, and we call out to them. They're callouts, not plugins.

A definition

So with our boundaries established, we were ready to offer a definition:

A plugin system is a software facility used by a running program to discover and load code, often containing hooks called by the host application

But, by this definition, isn't Python's built-in import functionality a plugin system? Mostly, yes! Python's import system is a plugin system.

• For discovery it uses sys.path, various "site" directories and ".pth" files, and much more.
• For installation, it uses site-packages, user .local directories, and more.
• As far as independent reusability, virtually every module can be made its own entrypoint.
• As for dependency registration, every module is tossed into sys.modules with the others, but also has access to import and sys, making roughly every module an equal partner in application state.

Python's import system is a powerful one, with a plugin system of its own. But finders, loaders, and import hooks aren't Python's plugin system. For that, you need to look to the site module.

Motivation

With our hour nearly up, all these proximate details still needed to be distilled into an ultimate motivation behind plugins. To this end, we returned to one of software engineering's fundamental principles: Separation of concerns.

We want to reason about our software. We want to know what state it is in. What we all want is the ability to say, "the core is ready, proceeding to load modules/extensions/plugins." We want to defer loading some code so that we can add extra instrumentation, checks, resiliency, and error messages to that loading process. If something misbehaves, we can do better than a stack trace and an ImportError.

Python's import system is a plugin system of sorts, but because we use it all the time, we've already used up most of the concern separation potential of import. Hence, all the creativity around plugin systems, seeking a balance between feeling native to Python, while not still successfully separating concerns.

In conclusion

So now we have achieved a complete view of the Python plugin system ecosystem, from motivation to manifestation.

By numbers alone, it may seem on the face like there are more than enough Python plugin solutions. But looking at the motivation and taxonomy above, it's clear that there are still several gaps waiting to be filled.

By taking a holistic look at the implementations and motivations, the PyCon 2017 Plugins Open Session ended with the conclusion that even Python's wide selection could use expansion.

So, until next year, go forth and continue to build! The future of well-factored code depends on it.¹

How to animate cube in Houdini

A friend of my friend (XAPKOHHEH) just made this.
I’m totally into Houdini the last Months - I had to share 

EDIT
while this is extremely funny, still, it’s showing perfectly what is Houdini capable of. Made in 1 day :o
Note: he shared source file in the description - if interested 

Until recently the cataloged satellites totaled 67 in number. But only the innermost 15 of these orbit Jupiter in a prograde sense (in the direction of the planet's spin). The rest are retrograde, and are likely captured objects - other pieces of the solar system's solid inventory that strayed into Jupiter's gravitational grasp.

That population of outer moons is mostly small stuff, only a few are 20-60 kilometers in diameter, most are barely 1-2 kilometers in size, and increasingly difficult to spot.

Now astronomers Scott Sheppard, David Tholen, and Chadwick Trujillo have added two more; bringing Jupiter's moon count to 69.

Perfect for your pirate base/villain lair/secret Space CIA prison/unsettling scientific experiments lab/taco stand.

In 2012, Michael Lewis gave a commencement speech at Princeton University, his alma mater. In the speech, Lewis, the author of Liar’s Poker, Moneyball, and The Big Short, talks about the role of luck in rationalizing success. He tells the graduates, the winners of so many of life’s lotteries, that they “owe a debt to the unlucky”. This part near the end is worth reading even if you skip the rest of it.

I now live in Berkeley, California. A few years ago, just a few blocks from my home, a pair of researchers in the Cal psychology department staged an experiment. They began by grabbing students, as lab rats. Then they broke the students into teams, segregated by sex. Three men, or three women, per team. Then they put these teams of three into a room, and arbitrarily assigned one of the three to act as leader. Then they gave them some complicated moral problem to solve: say what should be done about academic cheating, or how to regulate drinking on campus.

Exactly 30 minutes into the problem-solving the researchers interrupted each group. They entered the room bearing a plate of cookies. Four cookies. The team consisted of three people, but there were these four cookies. Every team member obviously got one cookie, but that left a fourth cookie, just sitting there. It should have been awkward. But it wasn’t. With incredible consistency the person arbitrarily appointed leader of the group grabbed the fourth cookie, and ate it. Not only ate it, but ate it with gusto: lips smacking, mouth open, drool at the corners of their mouths. In the end all that was left of the extra cookie were crumbs on the leader’s shirt.

This leader had performed no special task. He had no special virtue. He’d been chosen at random, 30 minutes earlier. His status was nothing but luck. But it still left him with the sense that the cookie should be his.

This experiment helps to explain Wall Street bonuses and CEO pay, and I’m sure lots of other human behavior. But it also is relevant to new graduates of Princeton University. In a general sort of way you have been appointed the leader of the group. Your appointment may not be entirely arbitrary. But you must sense its arbitrary aspect: you are the lucky few. Lucky in your parents, lucky in your country, lucky that a place like Princeton exists that can take in lucky people, introduce them to other lucky people, and increase their chances of becoming even luckier. Lucky that you live in the richest society the world has ever seen, in a time when no one actually expects you to sacrifice your interests to anything.

All of you have been faced with the extra cookie. All of you will be faced with many more of them. In time you will find it easy to assume that you deserve the extra cookie. For all I know, you may. But you’ll be happier, and the world will be better off, if you at least pretend that you don’t.

You can watch Lewis’ speech as delivered on YouTube:

I wonder if hearing that moved the needle for any of those grads? I suspect not…being born on third base thinking you hit a triple is as American as apple pie at this point. (via @goldman)

unapologeticexistence:

zainazahira:

universalequalityisinevitable:

Peter Joseph on structural violence, from this video.

Brilliant

Spot on. Like Coretta Scott King said, I must remind you that starving a child is violence. Neglecting school children is violence. Punishing a mother and her family is violence. Discrimination against a working man is violence. Ghetto housing is violence. Ignoring medical need is violence. Contempt for poverty is violence.

Who is more deserving to be the Belgian monarch: A man who was — literally — born to do the job, or a fast food chain? However silly that question might sound, it’s one that the actual King of Belgium would rather Burger King didn’t ask.

BK is opening its first restaurant in Belgium in June, and to promote the event it’s launched a campaign called “Who is the king?” featuring a cartoon likeness of King Philippe of Belgium, who ascended to the throne in 2013 after his father abdicated.

Reps for the monarch tell Reuters that they are “not happy with them using an image of the king in their campaign.”

Visitors to WhoIsTheKing.be are presented with a cartoon version of the king and a Burger King burger and asked to vote. “Two Kings. One crown. Who will rule? Vote now … ” the site reads.

If you click on King Philippe, a popup asks, “Are you sure? He won’t be the one to cook your fries.”

“We disapprove of this approach,” royal spokesman Pierre Emmanuel de Bauw told the BBC. “Since it is for commercial purposes, we would not have given our authorization.”

After the monarch’s representatives expressed their displeasure, a spokeswoman for Burger Brands Belgium says the company is weighing whether to tweak the advertising. As of May 30, the cartoon king remains.

“We are deliberating on how to proceed,” she told Reuters. “Should we make a change to our campaign we would communicate that.”

170525