Coronavirus DIY Facemask from CEO Ed Schipul

No worries if face masks are running out in stores, because there is always a solution to everything. Here is a DIY Facemask guidance from our CEO Ed Schipul. Because we care about you and your loved ones.

Rough cut comparison of the DIY coronavirus mask and the original.

From the article: https://www.eschipul.com/2020/03/coronavirus-diy-facemask-test/

“In Houston the Coronavirus (COVID-19) response has been quite aggressive. And as the third largest metro area in the US, it should be. I get it. Mostly we are quarantined in place except for grocery store runs and emergency needs. (And we can walk the dog, but that’s about it.)

This led to research on what we could do and turned up two interesting pieces of knowledge about the coronavirus. 

A) How long is the coronavirus contagious or viable by surface. As in how long can it be there and still infect you?”

A truly rustic looking diy coronavirus mask

Regards,

Ed.

Prepare Your Organization for Potential Quarantines with the Outbreak of CoronaVirus Pandemic

CoronaVirus COVID-18 ESRI Graph

Dear Tendenci Community,

A summary of content is found here to help you and your communities prepare for potential quarantines brought on by CoronaVirus ( COVID-19. )


https://www.tendenci.com/articles/help-your-organization-prepare-for-potential-coronavirus-quarantines/

Some reminders of functionality you have RIGHT NOW via Tendenci – The Open Source AMS

Screenshot of Tendenci Social Services Feature Emergency Responder.
https://www.tendenci.com/help-files/tendenci-functionality-to-help-with-crisis-response/

Utilize the Emergency Response and Social Services Functionality built into your Tendenci site:

  1. Use the Emergency Announcement Module to immediately put a notice at the top of every page of your site. 
    https://www.tendenci.com/help-files/tendenci-emergency-announcement/
  2. Review all of the built in preparedness and communication functionality that is in Tendenci summarized here:
    https://www.tendenci.com/help-files/tendenci-functionality-to-help-with-crisis-response/
  3. Use the newsletter module to get messages out to everyone registered on your site fast. 
    https://www.tendenci.com/help-files/sending-a-newsletter-in-tendenci-quick-overview/
  4. Your site also integrates with many other tools like threaded discussions via Discus or displaying your LinkedIn banner and twitter feed. Use the best tool and integrate: https://www.tendenci.com/works-with/
  5. Use Ad-Hoc queries directly against your database for outlier data that may not have been forseen for a given crisis. This is on your Tendenci site at /explorer/ and there is a great starter helpfile on django explorer reporting here https://www.tendenci.com/help-files/how-use-django-sql-explorer-tendenci/

Please stay safe. Because the Puppy Loves You!

Puppy Loves You

Regards, 
Team Tendenci

Security in the Tendenci SaaS Cloud at AWS

Kibana OSSEC Tendenci

Cyber Security is based on Prevention, Monitoring, and Incident Response

Associations are part of the fabric of society. We take it seriously. And we also understand there are no “perfect” or “completely secure” systems. Not even air-gapped.

To guard our SaaS AMS clients’s sites we use redundant systems. These include SSL encryption, application isolation, containers, layers of AWS (Amazon Web Services) VPC, Security Groups, ACLs, Route53 DNS, custom AMIs, virus scanners, malware scanners, pentesting, auditing and more. All of these activities generate redundant logs which need to be monitored. To do that we run what is called the “ELK Stack” or now the “Elastic Stack“.

Network Monitoring with OSSEC Logstash ElasticSearch and Kibana

Cyber Security starts with Project Management

A Cyber PM, upon initial completion, never ends. It requires constant vigilance. The process of Cyber Security can be further explained as:

  1. Architecture – Start with Security In Mind
  2. Passive Cyber Defense – Systems that are in place
  3. Active Cyber Defense
  4. Cyber Intelligence Gathering
  5. Response

** Note: There is a longer explanation on our site at https://www.tendenci.com/security/

There are many resources available for cyber security training. We encourage you to look them up and take an active role in keeping your web site, company, family and country secure from cyber attacks!

For the expanded full version of the basics of cyber security in the Tendenci SaaS cloud, view at https://www.tendenci.com/security

Tendenci Transparency Report – Why isn’t Wild Apricot Posting One?

red bird

Yup, AMS transparency reporting is critically important. And perhaps also equally a bit boring. After all, you are looking for what is MISSING.

In Tendenci – the Open Source AMS’ latest transparency report, yup, nothing has changed. Yea!

And given Tendenci AMS is fully open source and still building for the future , well, it’s pretty clear what our position is. We believe in open source and transparency.

What other MAJOR AMS can you self deploy on the servers of your choice? In the data center of your choice? In the country of your choice? With the encryption and firewall restrictions of YOUR CHOICE. That’s the beauty of open source.

And the price starts at zero. It. Is. Fully. Open. Source.

What is Wild Apricot’s transparency report? After all, they are recently touted as the new kid on the block. Welcome! Yet what is their position on transparency?

Disclaimer in defense of Wild Apricot – in all fairness, AMS systems take a solid 10 years to write. They really are doing a great job catching up, I’m only addressing transparency in this post.  Plus at Tendenci, we love a good strong new competitor adding value for NPOs/NGOs and Associations. We love that they are leveling up. All we’re saying is, let’s see their transparency reports? Why not be open source?

And yes, that is a challenge. Step up people!

Regarding Open Source – hey, why not support local: Tendenci pricing starts at ZERO ($0.00). Many people host in the Tendenci Cloud at AWS because we’re a good fit. Yet, our hosting pricing might not work for you in your country, right?

If so, then why not support a local developer in your community? Help build your home country’s tech sector by supporting your local developers!

Back to the business stuff – we have updated our latest transparency report. No changes. (check mark in the “no changes=good” column folks!)
https://www.tendenci.com/transparencyreporting/

Even though the competition is (mostly) NOT truly free and open source, that doesn’t mean they can’t be responsible and tell you if they have turned over your data. It does mean that any proprietary vendor offering free services is selling your data.

Is your AMS handing over, or monitoring, all of your data? Perhaps to the highest bidder or to the country of origin? You have a right to know.

Seriously, if any sector in the world needs responsible disclosure, it’s the association and non-profit/NGO sector.

Truly AMS (association management systems) / association management software in our opinion. Thus, the small team, and the large community at Tendenci, challenge our competitors to be transparent!

Yes, we understand that warrant canaries aren’t completely cut and dried. But at least a good faith effort? Why are other AMS systems not posting transparency reports?

If the FBI stated that NGOs/NPOs/Associations were the first target of the Russian propaganda campaign to influence the US elections, then I personally take issue with this.

NOTE: Propaganda and motives of foreign countries does NOT mean collusion. Collusion, and hopefully there wasn’t any, is not a topic we are addressing at all. (That’s for the politicians and the courts to figure out. We’re just programmers trying to do good.)

Thus the CHALLENGE to other AMS SaaS providers: Post your Transparency Reports!

Really, we call on all of the alternatives to Tendenci to adopt a transparency reporting policy.

Why not? Even proprietary companies can be transparent, right?

Why hide anything from your clients, open source or not? We don’t get it. End users don’t have to, and shouldn’t, tolerate hidden data disclosure.

Transparency reporting is just one more reason we’re passionate about helping associations and non-profits with their causes! We try to take the high road. Yet now, it’s not just about data collection, data mining, cross site tracking, Russian to popular AMS systems, it’s about just having integrity to tell people what is going on.

Associations, and therefore association management software, is important in every country. That’s why Tendenci is Open Source and currently supports 75 languages!

Yes, stay with your trusted local developer. Just please fast check them and demand access to your code, access to all of your data, demand access to your rights. And yes, demand transparency.

That’s how we roll at Tendenci – brutally open and honest, full access, association management. You know, kind of like WordPress is for blogs and CMS. Open!

At Tendenci, we recognize the value of the work you do. And we believe you deserve OPEN. In fact, we think open is baseline.

We hope you do too. Because Associations matter. You matter. #rockon #demandTransparency #ams #associationmanagement #asae #associationchat

Celebrating International Women’s Day

Today is International Women’s Day. It is great to see the support of so many different companies behind International Women’s Day. Tendenci, which has historically had far more women in the role of Programming Manager, and which currently has far more women than men on our team, we obviously agree.

Google has a great video worth watching on International Women’s Day:

We love y’all.

On a personal note (this is Ed typing) it’s hard to believe it’s been over a year since I photographed the Women’s March in San Francisco in late 2016. Y’all just keep rocking. Please!?

Photos from the Womens March in SF
Women’s March SF 2017

#peace

Tendenci AMS API Integration

Python Rules

OCT 2023 UPDATE: For information on accessing Tendenci data via API please see our GitHub discussion at https://github.com/tendenci/tendenci/issues/1023

For more on The Open Source AMS integration via API visit our AMS API Helpfile

Tendencithe Open Source AMS is unique in that it is fully open source. However at times people would prefer to use an API to pull specific information. For that Django has several API integrations for your Association Management System such as:

django-tasty-pie is a REST based API to your AMS
https://github.com/django-tastypie/django-tastypie
The Django Rest Framework is also something the Tendenci community has been discussing switching to it as well.
http://www.django-rest-framework.org/

API’s aren’t mutually exclusive after all, right? You have options.

There are legitimate reasons to use an API. Examples include integration between a legacy mainframe system, ecommerce, or a development team that has chosen a different platform such as .NET or PHP.

Tendenci doesn’t meet all of the functional requirements for everyone by design. Instead we work with great technology like machine learningThe open AMS community isn’t focused on reinventing the wheel. It just doesn’t make economic sense for a non-profit, or even a for profit company, to reinvent Amazon.com or Ebay.com. This is particularly true if you are causes-based association or non-profit given the expense.

Does Tendenci AMS work with other providers? Absolutely. Any provider with an API or that supports SSO or RSS or has their own technology like google tag manager.

Non profits don’t have money to waste. Therefore we aligned our product to major industry supported technology.

Our technology stack as of 2018 is:

  1. Tendenci
  2. Django Web Framework
  3. Javascript and jquery
  4. Bootstrap CS
  5. Python Programming Language
  6. Postgres Database with GIS
  7. Docker Containers
  8. Ubuntu

For more on The Open Source AMS integration via API visit our AMS API Helpfile or read up on everything Tendenci Works With. Or if you aren’t into open source, there are definitely alternatives to Tendenci.

If you do pick an alternative, we suggest you consider Security FIRST and go from there.

What a DDoS attack to an Association Looks Like

The following graphs show what a Distributed Denial of Service (DDoS) attack on an association looks like. The names, rates and volume of the association have been blurred for security reasons. We are thankful to AWS for their own defenses in front of ours, which  help us mitigate these issues.

responding to ddos attacks as best we can
active response to mitigate attacks

Note: The  graphic above, is filtered for a 24 hour span for one client. The infrastructure is in place, and highly redundant, so we can monitor and keep our clients safe. For clients in the US or hosted in other countries (we have multiple Tendenci clouds as needed.)

Note 2: Make no mistake – If a bad-actor has the budget – they can and will purchase enough bots to take a site down. This is well documented. Even our resources at AWS are limited in what they can handle. Budget (yes BUDGET) accordingly. 

Equifax Breach via Apache Struts Framework

(This is a cross post from our CEOs personal blog. Note that Tendenci sites do NOT use Apache and the vulnerabilities in Equifax’s implementation of Apache Struts do NOT impact your Tendenci site. Still be aware that nothing is is 100% secure so stay vigilant and be prepared friends!)

As reported last Friday, the 2017 Equifax personal credit reporting agency had a data breach of 143 Million people’s identities. It started in May 2017 and is just now (August 2017) being disclosed. It is going to impact all of us. Sources:

  1. Equifax data leak could involve 143 million consumers
  2. PSA: no matter what, Equifax may tell you you’ve been impacted by the hack
  3. Did Lack of Visibility into Apache Struts Lead to the Equifax Breach?

From the second article on the Equifax breach linked above, this portion really galls me:

… not only are none of the last names tied to your Social Security number, but there’s no way to tell if you were really impacted.

It’s clear Equifax’s goal isn’t to protect the consumer or bring them vital information. It’s to get you to sign up for its revenue-generating product TrustID.

Earlier it was revealed executives had sold stock in the company before going public with the leak. We also found TrustID’s Terms of Service to be disturbing. The wording is such that anyone signing up for the product is barred from suing the company after.

The following phrase alone, if true, combined with Equifax literally trying to monetize their security errors, is what gives capitalism a bad name:

The wording is such that anyone signing up for the product is barred from suing the company after.

I have to believe the Equifax PR team is working for PharmaBro or Putin trying to make them look good in comparison.

Note: Equifax has changed the indemnification, but only under duress imho. Furthermore 30 days free credit monitoring by the company that released your data and then you will have to pay monthly still seems wrong. But to be fair, here is their update:

Questions continue to be raised about the arbitration clause and class action waiver language that was originally in the terms of use for the free credit file monitoring and identity theft protection products that we are offering called TrustedID Premier.
(Editor: well ya, duh!?)

We have removed that language from the TrustedID Premier Terms of Use and it will not apply to the free products offered in response to the cybersecurity incident or for claims related to the cybersecurity incident itself. The arbitration language will not apply to any consumer who signed up before the language was removed.
(Editor: but did you fire the person who did it in the first place?)

I get it. Nothing is secure. If the NSAs hacking tools get stolen and OPM loses all of the data on security clearance checks on our own people, then truly nothing is safe. I get it.

What I do not understand is a company as large as Equifax not being prepared for something like this. That Equifax did not announce it promptly. That Equifax executives sold stock before announcing it. That Equifax then attempted to indemnify themselves. That Equifax is using the crisis to sell a monitoring service that you have to pay for after 30 days. A service to monitor YOUR data that THEY lost control of!

This boggles the mind of a PR Professional.

The Internet was not built for e-commerce – it was built for knowledge sharing in a “walled garden”. Therefore keeping sites secure is not possible. Any security professional will tell you best practice is to white-list good guys (selective inclusion) as opposed to trying to find every attack and block it. Therefore the difficulty at a high level is primarily in identifying and blocking bad actors.

I hate to say it folks, but we are playing whack-a-mole with your identity and money.  It will always be an uphill battle to maintain security on the Internet and you will never ever be 100% safe.

As reported by Black Duck (awesome people btw), the specifics of the attack on Equifax are currently easily exploitable on similar sites. This is like Hurricane Harvey – it’s not even close to over.

The Incredible Growth of Python – StackOverflow

growth of python programming language

Python, the language used to program TendenciThe Open Source AMS, continues it’s meteoric rise in the world of developers. And where the developers go is where the rest of us go. Thus Python’s rise matters. And it benefits every Tendenci user, self hosted or hosted with our small company (same software either way).

IEEE Spectrum rates the languages by its readers as follows:

Python has continued its upward trajectory from last year and jumped two places to the No. 1 slot, though the top four—Python, CJava, and C++—all remain very close in popularity.

StackOverflow, a go-to site for pretty much every programmer and sysadmin out there, has a new blog post up on the incredible growth of the Python Programming Language. Python is of course the programming language used in Tendenci – The Open Source AMS. From the Stack Overflow post:

June 2017 was the first month that Python was the most visited tag on Stack Overflow within high-income nations. This included being the most visited tag within the US and the UK, and in the top 2 in almost all other high income nations (next to either Java or JavaScript). This is especially impressive because in 2012, it was less visited than any of the other 5 languages, and has grown by 2.5-fold in that time.

They have numerous charts to back up the data, but these two in particular paint a telling picture.

From Stack Overflow – the current tag questions viewed:

Growth of Python Programming Language
StackOverflow – The Incredible Growth of Python

Perhaps even more impressive is the projection on the continued growth of Python. Just WOW!

growth of python programming language
Python – Incredible growth with developers

The above graphs should give you confidence in your choice of using Tendenci as your AMS as the developers are not only there, but growing. Given Tendenci is fully open source (this is different from “free trial” AMS systems which are NOT actually FOSS (Free and Open Source Software). Wikipedia describes the difference as:

(FOSS means) anyone is freely licensed to use, copy, study, and change the software in any way, and the source code is openly shared so that people are encouraged to voluntarily improve the design of the software.[3] This is in contrast to proprietary software, where the software is under restrictive copyright and the source code is usually hidden from the users.

Many of our competitors who are NOT Open Source and not true FOSS which can sometimes confuse people. I’ll do a future post on examples of sometimes misleading representations by AMS systems that are not “actually” Free and Open Source (FOSS)  as defined on Wikipedia.

The good news is with the growth of Python, it only make sense that developers will look at and many will join in to help the community improve the software as they join associations themselves.

We’ve written about why we chose Python over PHP to develop Tendenci open source several times. Correctly choosing the open source stack gives us, and everyone in the community, confidence to see the trends predicted correctly. It wasn’t rocket science – we just listened to our team, we listened to younger developers, and most importantly we listened to our clients on what the future was/is going to be.

And associations are kind of a big deal and they can’t use minimum viable products.

Why are associations unwilling to accept apps that meet only minimal requirements? Um… because they started as Guilds and go back to Medieval times. From Britannica on Guilds and Trade Associations:

Guildalso spelled gild , an association of craftsmen or merchants formed for mutual aid and protection and for the furtherance of their professional interests. Guilds flourished in Europe between the 11th and 16th centuries and formed an important part of the economic and social fabric in that era.

and Britannica goes on….

… associations are known to have existed in ancient Rome, however, where they were called collegia. These craft guilds seem to have emerged in the later years of the Roman Republic. They were sanctioned by the central government and were subject to the authority of the magistrates.

This is a huge topic of course. Just know that Tendenci is the ONLY top ranked AMS system that is truly FOSS. Unlimited admins, users, contacts – you can self host or if hosted with us we only charge for processing power. Got 1M users and contacts and 50 admins? No problem. And the growth of Python assures your continued freedom from vendor lock-in no matter what.

#peace and happy (Python) programming y’all!