Business documents often require special handling. Enter Electronic Document Interchange, or EDI. EDI is more than simply transferring files using email or http (or ftp), because these are documents like orders and invoices. When you send an invoice, you want to be sure that:

1. It goes to the right destination, and is not intercepted by competitors.
2. Your invoice cannot be forged by a 3rd party.
3. Your customer can’t claim in court that they never got the invoice.

The first two goals can be accomplished by HTTPS or email with S/MIME, and in some situations, a simple HTTPS POST to a web API is sufficient. What EDI adds is the last part.

This article does not cover the messy topic of formats for the files exchanged. Even when using a standardized format like ANSI or EDIFACT, it is ultimately up to the business partners. It is not uncommon for business partners to use an ad-hoc CSV file format. This article shows you how to configure Fedora to send and receive in an EDI setup.

Centralized EDI

The traditional solution is to use a Value Added Network, or VAN. The VAN is a central hub that transfers documents between their customers. Most importantly, it keeps a secure record of the documents exchanged that can be used as evidence in disputes. The VAN can use different transfer protocols for each of its customers

AS Protocols and MDN

The AS protocols are a specification for adding a digital signature with optional encryption to an electronic document. What it adds over HTTPS or S/MIME is the Message Disposition Notification, or MDN. The MDN is a signed and dated response that says, in essence, “We got your invoice.” It uses a secure hash to identify the specific document received. This addresses point #3 without involving a third party.

The AS2 protocol uses HTTP or HTTPS for transport. Other AS protocols target FTP and SMTP. AS2 is used by companies big and small to avoid depending on (and paying) a VAN.

OpenAS2

OpenAS2 is an open source Java implemention of the AS2 protocol. It is available in Fedora since 28, and installed with:

$ sudo dnf install openas2
$ cd /etc/openas2

Configuration is done with a text editor, and the config files are in XML. The first order of business before starting OpenAS2 is to change the factory passwords.

Edit /etc/openas2/config.xml and search for ChangeMe. Change those passwords. The default password on the certificate store is testas2, but that doesn’t matter much as anyone who can read the certificate store can read config.xml and get the password.

What to share with AS2 partners

There are 3 things you will exchange with an AS2 peer.

AS2 ID

Don’t bother looking up the official AS2 standard for legal AS2 IDs. While OpenAS2 implements the standard, your partners will likely be using a proprietary product which doesn’t. While AS2 allows much longer IDs, many implementations break with more than 16 characters. Using otherwise legal AS2 ID chars like ‘:’ that can appear as path separators on a proprietary OS is also a problem. Restrict your AS2 ID to upper and lower case alpha, digits, and ‘_’ with no more than 16 characters.

SSL certificate

For real use, you will want to generate a certificate with SHA256 and RSA. OpenAS2 ships with two factory certs to play with. Don’t use these for anything real, obviously. The certificate file is in PKCS12 format. Java ships with keytool which can maintain your PKCS12 “keystore,” as Java calls it. This article skips using openssl to generate keys and certificates. Simply note that sudo keytool -list -keystore as2_certs.p12 will list the two factory practice certs.

AS2 URL

This is an HTTP URL that will access your OpenAS2 instance. HTTPS is also supported, but is redundant. To use it you have to uncomment the https module configuration in config.xml, and supply a certificate signed by a public CA. This requires another article and is entirely unnecessary here.

By default, OpenAS2 listens on 10080 for HTTP and 10443 for HTTPS. OpenAS2 can talk to itself, so it ships with two partnerships using http://localhost:10080 as the AS2 URL. If you don’t find this a convincing demo, and can install a second instance (on a VM, for instance), you can use private IPs for the AS2 URLs. Or install Cjdns to get IPv6 mesh addresses that can be used anywhere, resulting in AS2 URLs like http://[fcbf:fc54:e597:7354:8250:2b2e:95e6:d6ba]:10080.

Most businesses will also want a list of IPs to add to their firewall. This is actually bad practice. An AS2 server has the same security risk as a web server, meaning you should isolate it in a VM or container. Also, the difficulty of keeping mutual lists of IPs up to date grows with the list of partners. The AS2 server rejects requests not signed by a configured partner.

OpenAS2 Partners

With that in mind, open partnerships.xml in your editor. At the top is a list of “partners.” Each partner has a name (referenced by the partnerships below as “sender” or “receiver”), AS2 ID, certificate, and email. You need a partner definition for yourself and those you exchange documents with. You can define multiple partners for yourself. OpenAS2 ships with two partners, OpenAS2A and OpenAS2B, which you’ll use to send a test document.

OpenAS2 Partnerships

Next is a list of “partnerships,” one for each direction. Each partnership configuration includes the sender, receiver, and the AS2 URL used to send the documents. By default, partnerships use synchronous MDN. The MDN is returned on the same HTTP transaction. You could uncomment the as2_receipt_option for asynchronous MDN, which is sent some time later. Use synchronous MDN whenever possible, as tracking pending MDNs adds complexity to your application.

The other partnership options select encryption, signature hash, and other protocol options. A fully implemented AS2 receiver can handle any combination of options, but AS2 partners may have incomplete implementations or policy requirements. For example, DES3 is a comparatively weak encryption algorithm, and may not be acceptable. It is the default because it is almost universally implemented.

If you went to the trouble to set up a second physical or virtual machine for this test, designate one as OpenAS2A and the other as OpenAS2B. Modify the as2_url on the OpenAS2A-to-OpenAS2B partnership to use the IP (or hostname) of OpenAS2B, and vice versa for the OpenAS2B-to-OpenAS2A partnership. Unless they are using the FedoraWorkstation firewall profile, on both machines you’ll need:

# sudo firewall-cmd --zone=public --add-port=10080/tcp

Now start the openas2 service (on both machines if needed):

# sudo systemctl start openas2

Resetting the MDN password

This initializes the MDN log database with the factory password, not the one you changed it to. This is a packaging bug to be fixed in the next release. To avoid frustration, here’s how to change the h2 database password:

$ sudo systemctl stop openas2
$ cat >h2passwd <<'DONE'
#!/bin/bash
AS2DIR="/var/lib/openas2"
java -cp "$AS2DIR"/lib/h2* org.h2.tools.Shell \
 -url jdbc:h2:"$AS2DIR"/db/openas2 \
 -user sa -password "$1" <<EOF
alter user sa set password '$2';
exit
EOF
DONE
$ sudo sh h2passwd ChangeMe yournewpasswordsetabove
$ sudo systemctl start openas2

Testing the setup

With that out of the way, let’s send a document. Assuming you are on OpenAS2A machine:

$ cat >testdoc <<'DONE'
This is not a real EDI format, but is nevertheless a document.
DONE
$ sudo chown openas2 testdoc
$ sudo mv testdoc /var/spool/openas2/toOpenAS2B
$ sudo journalctl -f -u openas2
... log output of sending file, Control-C to stop following log
^C

OpenAS2 does not send a document until it is writable by the openas2 user or group. As a consequence, your actual business application will copy, or generate in place, the document. Then it changes the group or permissions to send it on its way, to avoid sending a partial document.

Now, on the OpenAS2B machine, /var/spool/openas2/OpenAS2A_OID-OpenAS2B_OID/inbox shows the message received. That should get you started!

Photo by Beatriz Pérez Moya on Unsplash.

How did you learn to talk?

Probably something like this: Your infant brain, a hotbed of neurological activity, picked up on your parents’ speech tones and facial expressions. You started to mimic their sounds, interpret their emotions and identify relatives from strangers. And one day, about a year into life, you pointed and started saying a few meaningful words with slobbery glee.

But many children, particularly those diagnosed with autism spectrum disorder, acquire language in different ways. Worldwide, one in 160 children is diagnosed with ASD. In the United States, it is one in 59 children — and approximately 40 percent of this group is non-verbal.

Learning from superheroes and puppies

Lois Jean Brady and Matthew Guggemos, co-founders of Bay Area-based iTherapy who are speech pathologists and autism specialists, are tackling the growing prevalence of autism-related speech challenges with InnerVoice, an artificial intelligence-powered app whose customizable avatars stimulate social cues. The app animates avatars of superheroes, puppies, stuffed animals and people to help young children who have difficulties with language and expression pair words with meanings and practice conversation.

iTherapy received a Microsoft AI for Accessibility grant in 2018. The program provides grants as well as technology and expertise to individuals, groups and companies passionate about creating tools that make the world more inclusive. iTherapy is using the grant to integrate the Azure AI platform to enhance its generated speech, image recognition and facial animation.

A five-year-old student using Zyrobotics to learn to read at Ranch Santa Gertrudes Elementary. 

“I think for sure that the AI component was the missing link,” says Guggemos of the app. “How do you use words, and what do words mean? What does a symbol represent? How do you use AI to develop problems that require language to solve?”

How a hippo helps teach speech 

AI is also proving an exciting development in speech and language improvement for Zyrobotics, an Atlanta-based educational technology company that was the first beneficiary of the AI for Accessibility program in 2018. Zyrobotics is using Azure Machine Learning to help its ReadAble Storiez educational tool interpret when a student needs assistance.

ReadAble Storiez uses an avatar of a hippo to help students with learning disabilities such as dyslexia and other challenges such as stuttering, pauses and heavy accents.

Ayanna Howard, the company’s founder and professor in robotics, was first motivated to create ReadAble Storiez when watching a teacher use Zyrobotics’ Counting Zoo app with a child. When the teacher turned to her and said, “Can you have this app do more than just read with him? I think it’s fantastic that it helps improve his math – could it also help him improve his reading?”

Howard also found teachers mentioning the challenges of dyslexia in the classroom. “I was like, ‘Oh, what happens if you have a reading disability?’ I then learned that signs of dyslexia in children aren’t picked up until much later, typically when schools start standardized testing. I realized we needed an intervention much earlier and that we could do that with Counting Zoo.”

Learning models that don’t take individualized challenges into account, or don’t address the speech patterns of kids, “tend to fail,” Howard says. ReadAble Storiez employs a custom speech model and a sophisticated “tutor” to convert speech to text and measure accuracy, fluency and the child’s reading improvement.

‘It blew my mind!’

Howard is pleased with the program’s early success. “While they were reading a book, kids were correcting themselves,” she says. “As a technologist, you say your stuff works, but I’m sitting there with the kids and I’m blown away, ‘It really does work!’ It’s thrilling to see that what works in the lab actually works in the real world, in the child’s environment. The [avatar] would provide feedback, and a child would be like, ‘I didn’t say a word right. Can I try again?’ It blew my mind. That was the affirmation. Our solution was on track and on target.”

Brady, who came up with the idea for InnerVoice after studying and writing a book on apps for people with autism, reflects on the impact it has made. She cites an example of working with a student who is non-verbal and used the app to communicate with an avatar of himself.

“He would take a picture of an apple, and an avatar would read it as ‘apple,’ and then he would write it down, ‘apple.’ Until then, I hadn’t even thought of that strategy.”

A mother uses InnerVoice to work on communication skills with her young daughter.  

Brady and Guggemos imagine the benefits of AI-assisted communication beyond their target audience. They are working with people with dementia, head injuries and strokes. “Many communication apps just talk for you,” Brady adds. “Ours spans many aspects of communication for everybody — even English-language learners. Why wouldn’t I try that? It provides a model. There’s a coffee cup on the table, take a picture of it. How do you say that?”

Howard dreams of Zyrobotics helping to close the gap between mainstream learners and students with learning disabilities. To start, this fall Zyrobotics will introduce ReadAble Storiez to classrooms in the Los Nietos, California, school district, where learning disabilities track high. The company will also apply AI to its suite of STEM Storiez, a series of nine interactive and inclusive books that help children ages 3 to 7 engage with science, math, engineering and technology.

The AI for Accessibility program has been instrumental in getting Zyrobotics off the ground with ReadAble Storiez. “If we hadn’t gotten the grant, we’d be in phase zero,” Howard says. “We run on grants to ensure we provide access to learning technologies for all students. We need to be out there for kids that need us.”

The grant gave Brady and Guggemos the technology to take InnerVoice to the next level. “Our kids need this technology,” Brady says. “It’s not a luxury. We want to keep adding the best stuff. Microsoft really propelled us forward in that arena.”

Top image: A young boy at the iTherapy clinic uses InnerVoice chat bot to describe his photo of a Teddy bear. 

Related: 

By Mikey Campbell
Monday, May 13, 2019, 07:07 pm PT (10:07 pm ET)

Facebook-owned WhatsApp on Monday disclosed the recent fix of a VoIP-related vulnerability that allowed nefarious parties to remotely install spyware on both iOS and Android handsets.

Discovered in early May, the now-patched bug in the app’s audio call feature allowed hackers to deliver a spyware payload to target devices, a process that worked even if the WhatsApp call recipient failed to answer.

It took WhatsApp less than ten days to patch the security hole following its discovery, reports TechCrunch. How long the vulnerability existed without detection is unknown, but the company confirmed hackers took advantage of the window to install an unknown number of malicious payloads.

Although WhatsApp did not name a specific company or spyware variant associated with the security breach, a statement on the matter points to Israeli vendor NSO Group.

“This attack has all the hallmarks of a private company known to work with governments to deliver spyware that reportedly takes over the functions of mobile phone operating systems,” WhatsApp said.

NSO develops and markets a well-known and notoriously effective piece of spyware called Pegasus. Typically reserved for government buyers, Pegasus is often used by law enforcement agencies to gain wide access to key device functions and data stores.

Apple has in the past attempted to patch flaws in iOS and macOS leveraged by Pegasus, but NSO continues to uncover and exploit zero-day vulnerabilities in iOS to keep its product functional.

WhatsApp believes only a small number of users were impacted by attacks, noting only advanced and highly motivated actors would be capable of leveraging the bug, the report said.

The company alerted the U.S. Justice Department and various human rights organizations after discovering the vulnerability, and urges users to update their respective app versions to protect against future attacks.

“WhatsApp encourages people to upgrade to the latest version of our app, as well as keep their mobile operating system up to date, to protect against potential targeted exploits designed to compromise information stored on mobile devices,” WhatsApp said in a statement.

Warner Bros. and Legendary’s live-action film, Detective Pikachu, has defied the video game movie curse at the North American box office in its opening weekend, collecting a total of $58 million when it launched across 4,202 venues. Disney and Marvel’s all-star heroes in Avengers: Endgame managed to withstand the pocket monster assault, raking in $65 million in their third weekend in theatres. Locally – and not calculating inflation – this makes Detective Pikachu the biggest ever opening weekend for a video game movie, earning $11 million more than the 2001 Tomb Raider movie, starring Angelina Jolie.

Outside of North American cinemas, Detective Pikachu made $103 million across 62 international territories. China was the movie’s second-biggest audience, bringing in a total of $40 million, and the United Kingdom added a cool $6.6 million to the overall amount ($161 million).

Speaking to Variety, Warner Bros’ head of domestic distribution Jeff Goldstein said he was “giddy” and made it clear it was a “big weekend” for the film. Goldstein said the success was “because of the lighthearted nature of the film” and the fact it didn’t require viewers to be Pokémon fans. Critical reviews so far have been mixed. If you haven’t already, read our own written review or view the above video version.

Have you seen Detective Pikachu in cinemas yet? What did you think of it? Tell us below.

Last week, we announced a new Game of Thrones sweepstakes featuring custom House Targaryen and Night King designed consoles, and you didn’t think we’d just stop there, did you? We’re thrilled to unveil this giveaway will also include a third prize – an Iron Throne designed custom console! The fight to rule from the Iron Throne started nearly a decade ago and launched countless wars, battles and betrayals. It’s almost time to see who will reign victorious over the Seven Kingdoms, and it’s only right we made an epic custom console to honor this moment in television history.

Just like the Iron Throne that sits in King’s Landing, the console features the swords of enemies that surrendered to Aegon the Conqueror. This is only the third custom design created for the newest member of the Xbox One family – the Xbox One S All-Digital Edition. Built for disc-free gaming and entertainment, the Xbox One S All-Digital Edition comes bundled with Minecraft, Sea of Thieves and Forza Horizon 3. This Iron Throne console is truly fitting of the king or queen of Westeros!

Open until May 22, fans just need to RT our official Twitter post or “like” the official Facebook post announcing the giveaway. At the end of the giveaway, only three fans will be able to game with House Targaryen, the Night King or the Iron Throne at their side. What new heights will your gaming reach with “Game of Thrones” at your side? For full giveaway rules, see here.

Fans can also pre-order Season 8 of Game of Thrones on Xbox with Microsoft Movies & TV and receive an exclusive Iron Throne avatar with their purchase. For those who pre-order the “Game of Thrones” Seasons 1-8 Complete Series digital bundle, you’ll get the Iron Throne avatar plus two additional avatars. Full details here.

Don’t forget to tune in to the “Game of Thrones” series finale on May 19 to see what prophecies come to life, which characters will give their lives to their cause, or whom – if anyone – is left as the new ruler of the Seven Kingdoms.

Your favorite characters have killed, schemed, risen back from the dead and much more in their quest to ascend onto the Iron Throne. Don’t miss out, these custom consoles are the ultimate prize for gamers and “Game of Thrones” fans around the world!