William Matsuoka

Stata and the Twitter API (Part II)

3/4/2016

OAuth

Why Care Block:
You can Tweet things in an automatic fashion directly from Stata

Oh man, things are about to get real juicy – this is the final reveal of the Twitter API and I couldn’t think of a better time to do this. After all, we’ve made a complete mess out of Stata with our unruly bitwise operators, unending computer security algorithms, and un-um… unfortunate time-based C-plugins. Well, my Stata friends, this is how to do anything with Stata and the Twitter API.

Let’s post! Seriously, let’s tweet about things using Stata. This method can be used not only to tweet, but also to send direct messages, retweet things, and like (favorite) others’ tweets. If you’re like me, you don’t really use Twitter that well and I’m sure my 40 followers (I rounded up) would agree. But wouldn’t it be great to find a way to reach thousands of Twitter followers based off of hashtags or messages or even emoji? If the answer is no, fine, that’s my best attempt at convincing you but still feel free to read on.

Let’s bring together everything we need to send a Tweet out on the internet:

Stata: Check
cURL: Check
Our Library: Check

And what does our library now consist of? (FYI: there’s some new stuff here)

Base64 Encoding

Easy way to turn readable stuff into unreadable stuff for humans but it’s not so bad for computers. This takes all alphanumeric characters plus the plus and the “/” (which equals 64 characters to choose from), converts 8-bit chunks into 6-bit chunks which end up receiving the specific character. Sometimes equal signs are added, but you already know that.

See post on Base64 Encoding

Bitwise Operators and Security Methods

We’ve got bits dressed to the nines: shifting operators, rotating operators, logical operators, overflow methods, and all kinds of methods to translate from base 2 to base 16 to base 10.

These feed into our HMAC-SHA1 algorithm, which was awful to develop… this seriously has to go in the “lots of effort, little reward” category.

See post on Bitwise Operators and HMAC-SHA1

Stata Plugins

We needed time - I mean we all do – in seconds since 1970 based off of Greenwich Time. We could have just accounted for our respective time zones (unless you’re located in GMT+0 of course), but why not use this as a great learning opportunity?

See post on Plugins

Nonce

Once? None? Scone? What’s a nonce? Simply put, it’s a random 32 character word containing all alphanumeric symbols. Twitter’s example shows this being Base64 encoded, but all it has to be is a random string. vqib2ve89dOnTusESAS26Ceu9TcUES2i – see? Easy, just make sure you change the characters each time.

Percent Encoding

What%27s%20percent%20encoding%3F

Based on the UTF-8 URL Encoding standards, we need to replace certain characters that would otherwise cause complications in a URL. Don’t worry though, we’ve got a function for that. Just know that valid URL characters are all letters and numbers as well as the dash, the period, the underscore, and the tilde.

twitter-programs-lib.do
File Size:	10 kb
File Type:	do

Download File

Send Out the Tweets

Twitter has some fabulous documentation for their API so it’s fairly easy to find the method that you want to do. These processes can be generalized and used across many of these methods so we are by no means limited to just tweeting. For tweets (hereon referred to as status updates to be consistent with Twitter’s documentation), we use the base or “resource” URL:

https://api.twitter.com/1.1/statuses/update.json

Remember, status updates can only be 140 characters and Twitter will actually shorten URLs for you, but still keep in mind your character limits!

All statuses must be percent encoded, so let’s go ahead and create our status local; we’ll also store our base URL while we’re at it.

local b_url "https://api.twitter.com/1.1/statuses/update.json"
local status = "Sent out this tweet using #Stata and the #Twitter #API – http://www.wmatsuoka.com/stata/stata-and-the-twitter-api-part-ii tells you how!" 
mata: st_local("status", percentencode("`status'"))

We then take all of our application information: consumer key, consumer secret, access token, and access secret and store these as locals as well.

local cons_key "ZAPp9dO37PnzCofN2Nm8n8kye"
local cons_sec "kfbtARFpBIdb515iaS48kYZjWhLoIdbEiAINDVX0c3W3e0fgWe"
local accs_key "1234567890-YFklDWGuvSIGLYPMnAfOZgLgLsMXjKIHqaIr1F5"
local accs_sec "LYvHWfTS6LXjtDPVXchs6dXUG52l41j4HmicYwjr8aStw"

For this section, we will be creating all of our necessary authentication variables. The first step to creating our secret signing key is to make a string that contains our consumer secret key, concatenated with an ampersand, concatenated with our access secret key. We’ll also include all the necessary locals we talked about earlier.

local s_key    = "`cons_sec'&`accs_sec'"
mata: st_local("nonce", gen_nonce_32())
local sig_meth = "HMAC-SHA1"
// If you don't make a plugin, just make sure you do seconds since 1970
// probably using c(current_date) and c(current_time) - [your time zone]
plugin call st_utm
local ts = (clock(substr("`utm_time'", 4, .), "MDhmsY") - clock("1970", "Y"))/1000

Now it’s time to create our signature. We start by percent encoding our base URL. For our signature string, we include the following categories:

Oauth_consumer_key - `cons_key’
Oauth_nonce - `nonce’
Oauth_signature_method – “HMAC-SHA1”
Oauth_timestamp - `ts’
Oauth_token - `accs_token’
Oauth_version – “1.0”
Status – Whatever we want our status to be (percent encoded of course)

Note how they’re in alphabetical order by category – it is very important that you organize your string in this order. This is how it looks:

local sig = "oauth_consumer_key=`cons_key'&oauth_nonce=`nonce'&oauth_signature_method=`sig_meth'&oauth_timestamp=`ts'&oauth_token=`accs_tok'&oauth_version=1.0&status=`status'"

Then, percent encode the signature string and base URL:

mata: st_local("pe", percentencode("`b_url'"))
mata: st_local("pe_sig", percentencode("`sig'"))

This next step is why we spent an ungodly amount of time on bits and hashes! We need to transform our signature string into a Base64 encoding of the HMAC-SHA1 hash result with our message being the percent-encoded signature base hashed with our secret key. Sorry if that's a mouthful, but we can see what that translates to below.

local sig_base = "POST&`pe'&"
mata: x=sha1toascii(hmac_sha1("`s_key'", "`sig_base'`pe_sig'"))
mata: st_local("sig", percentencode(encode64(x)))

Finally, we’re almost done with Twitter and can move on to other more important things! First let’s make sure to post our Tweet because, after all, that's what we're here for.

!curl -k --request "POST" "`b_url'" --data "status=`status'" --header "Authorization: OAuth oauth_consumer_key="`cons_key'", oauth_nonce="`nonce'", oauth_signature="`sig'", oauth_signature_method="`sig_meth'", oauth_timestamp="`ts'", oauth_token="`accs_tok'", oauth_version="1.0"" --verbose

Now we can marvel at how much time we spent learning about something 99% of us don’t really care about. This is for you, 1% - this is all for you.

Sent out this tweet using #Stata and the #Twitter #API – https://t.co/iX3kBd2VFu tells you how!
— William Matsuoka (@WilliamMatsuoka) March 4, 2016

PS: Want to add emoji? Go to this site, find the URL Escape Code sections, and add the result to your status string!

Ex: %F0%9F%93%88 = Chart with Upward Trend

3 Comments

Stata and the Twitter API (Part I)

2/29/2016

6 Comments

Application-Only Authentication

Why Care Block:
Um, you can scrape your own Twitter data - what's not to love about narcissistic self-reflections? Also, happy leap day!

This is it – the culmination of all of our hard work and it’s broken up into two posts. The first (this one) shows us how to get Twitter data, and the second shows us how to post things on Twitter using Stata and our API library.

This post is brought to you thanks to an openness and willingness to share information. In today’s day and age, it’s ridiculous to try and hide information or impede the transfer of knowledge to others. I recently experienced first-hand the negative result openness can have on those who wish to obfuscate information. I guess these certain individuals are incapable of adapting, sharing, and participating in the global community – perhaps it’s not their fault if they feel threatened, but this does not excuse what I believe to be an original sin when it comes to technology. Sure it’s difficult to produce new things and sometimes even more difficult to scrap projects you’re emotionally attached to, but to abandon creativity and sequester change is the antithesis of this post. I’m sure many of you have dealt with an issue similar to this in your line of work, please don’t give up the good fight. If this sounds familiar, well this post is dedicated to you.

Just like the last Fitbit API post, all corresponding variables are color-coded for your convenience. The first thing we need to do is set up an application with the Twitter API. Once you enter all the necessary information, go to the “Keys and Access Tokens” tag to get your Consumer Key and Consumer Secret. FYI, all information provided below is fake, sorry to disappoint.

Below the Application Settings section is the “Your Access Token” section which contains the Access Token and Access Token Secret which we will use to get our basic tweet data and search for other interesting things.

Just like our Fitbit API, we need to first get an Authorization Token by sending a cURL request that takes the Base64 encoded consumer key and client secret. First let’s set up our variables:

local cons_key "ZAPp9dO37PnzCofN2Nm8n8kye"
local cons_sec "kfbtARFpBIdb515iaS48kYZjWhLoIdbEiAINDVX0c3W3e0fgWe"
local accs_key "1234567890-YFklDWGuvSIGLYPMnAfOZgLgLsMXjKIHqaIr1F5"
local accs_sec "LYvHWfTS6LXjtDPVXchs6dXUG52l41j4HmicYwjr8aStw"

Note: we will not be using the access key or secret until the next post

And create our encoded consumer information string (recall encode64 is available through this post):

encode64 "`cons_key':`cons_sec'"
local client64 = r(base64)

Now we simply send our request to Twitter:

!curl -k -i -H "Content-Type: application/x-www-form-urlencoded" -H "Authorization: Basic `client64'" --request POST --data "grant_type=client_credentials" https://api.twitter.com/oauth2/token --output "token.json"

Be sure to parse the access token from our outputted token.json file (perhaps this would be a good place to enter error handling methods), I stored the value in the global macro $token. Finally, send one more request that contains the query you’re looking for:

!curl -k -i -H "Authorization: Bearer $token" --request GET "https://api.twitter.com/1.1/statuses/user_timeline.json?count=100&screen_name=_belenchavez" --output "output.json"

In this case, we were able to pull the top 100 things from @_belenchavez’s timeline using the statuses API. For more information about what you can do with the application only authentication, check our Twitter’s documentation here. Otherwise, take a look at this frequency cloud of my commonly Tweeted/Re-Tweeted hashtags of 2016 thanks to wordclouds.com. It even looks somewhat like the Twitter logo!

6 Comments

Stata Plugins: the C-Sweet

2/17/2016

2 Comments

I thought I’d take a quick break from the latest series on building the Twitter API Library to bring you a message sponsored by Stata Plugins! Okay, we’re not officially sponsored by Stata and, legally speaking, we’re not sponsored by anyone. Technicalities. Maybe someday you’ll wish to plug your brand [here], but even I think that’s highly unlikely – so let’s just get right to plugins.

Do you know C? I wouldn’t say I know it very well, but that sure as hell shouldn’t stop us – this is a great learning opportunity! If you know the language, please feel free to skip to the next paragraph. Still here? Excellent! That means you’re like me and aren’t too concerned with lower level programming languages (that’s code for a language that’s a lot more explicit – it doesn’t look like English anymore). After all, a statement such as:

regress price mpg

is much easier to understand than this great (albeit extremely technical) Stata Blog post showing us what’s actually going on behind the scenes so to speak. Now, I actually have some training in Java, but honestly I have to tribute my smooth transition into C to Mata. Mata is a wonderful extension to Stata and I highly recommend picking it up if you haven’t already. It can be difficult to transition to Mata if you simply use Stata and there seems to be a lack of literature pertaining to learning Mata. I’ll point you to UCLA’s code fragment on Mata or Bill Gould’s Mata Matters/Mata the Missing Manual resources if you wish to learn more. The observation is: Mata prepares you for C because it’s extremely similar to the C language and a great transitional language from Stata to C. What’s the point though, right? Well, Mata enables you to be quicker and do complicated things directly from your do-file. Learning C, while sometimes unnecessary if your job is strictly to do quick analysis, will make it so that you can blow your colleagues away by showing them how your new program reduced the return time of a command from .8 to .6 seconds. Sorry again colleagues.

Troubleshooting is difficult and I hope to have a video available soon, but not today. So what’s a practical application for plugins? Directly related to the Twitter API posts, we need Stata to provide us with the time. “That’s dumb” you’d say. Just use - c(current_time) -. Fine, but now we need time in UTC which by the way is combination of the acronyms Coordinate Universal Time (CUT) and the French Temps Universel Coordonné (TUC). So how about:

clock(c(current_time) , "hms") – (TimeOffsetfromGMT)*60*60*1000

Close! But we’re also extremely lazy and want the computer to figure out which time zone we’re in (regardless of whether we have internet connection or not) and it needs to work in batch mode! Okay okay, enough with the requests! Basically, the question is how can we take the computer’s internal UTC time information? That’s where Stata plugins come in handy.

At a high level, what we’re going to do is tell Stata: “Hey Stata, go ahead and talk to the computer. Ask it what the current UTC time is and place the result in a local macro that we can call later. Thanks!”

Because I have a 64-bit system, it seems that the simple things tend to get a little complicated. I compile the file in Visual Studio (x64) and I also have the 64-bit version of Stata installed. Here’s the main file st_utc.c which should be compiled with the two necessary Stata files stplugin.c and stplugin.h. In other words, it worked for me but unfortunately I give no guarantees that it will work seamlessly on your end. Please edit as necessary.

So what’s going on here? Well, the beauty of this file is that we can load whatever libraries we need – here we included the time library so that we can access time variables directly from our stata_call routine. Note how we declare our error handling variable to be of type ST_retcode. We are able to call SF_display which prints the contents of a variable or string to the Stata console and SF_macro_save which allows us to access the contents of the variable buf (our time string) directly from the Stata local `utc_time’ thanks to the stplugin.h header.

After compiling st_utc.dll, you can either rename it st_utc.plugin and place it in your personal ado directory for easy access, or keep it as a dll and specify the location of the file using the option using() as shown below:

program st_utc, plugin using(st_utc.dll)
plugin call st_utc

And it’s that easy! Or so it seems. There are a lot of technical errors that you have to keep in mind from operating systems, to Stata versions (look to older plugin interface versions with older versions of Stata), to whether you really want to spend the time debugging your compiled code. It’s well worth getting it to work at least once! The important take away here is that any Stata user can greatly extend the capabilities of Stata; we haven’t even talked about javacall yet. So the next time a non-Stata user tries to assert their software package dominance by saying: “oh, Stata couldn’t do “x” so I had to use some otheR package”, bet them $20 they’re wrong. Most of the time, they don’t know what they’re talking about and you’ll have $20 to spend on some sweet Stata swag (seriously, we’re not sponsored by Stata).

2 Comments

HMAC-SHA1 in Stata

2/10/2016

5 Comments

Why Care Block?
Security and the Twitter API – You need this if you want Twitter to work with Stata

I applaud all of you who have made it this far, but unfortunately things are going to get super boring! Well, besides applause I’d also like to take a sentence to thank you for reading this content: whether you’re reading this out of boredom, coercion, to make fun of it, or you just have a general interest, I’d like to extend my gratitude.

Switching back to the good stuff, today we’re talking about hash functions. Think hash browns *delicious* - they’re sliced, diced, and fried to a golden brown; drenched or drizzled with hot sauce or ketchup (I prefer Cholula and Tabasco) and resembles nothing like the raw potato it once was. Now, take your hash browns and try to reconstruct the original potato. “No!” you’d say, “That’s really hard.” Keep in mind this post is about security, from a non-cryptographic scientist or security expert, so anticipate a lot more potato metaphors because that’s about all I know about security.

This post is really about making the Twitter API work within Stata without any outside plugins or packages. To do so, we must find a way to recreate the HMAC-SHA1 algorithm which is quite difficult without our previous toolset we designed, so make sure you’ve gone over the bitwise operators. Once we’re on the same page, we can start getting into this hash function in order to send requests using Twitter’s API so that you can retrieve you beautiful, crispy hash brown data in return.

The Fuss

HMAC-SHA1 is the type of procedure we’re trying to reproduce from the Wikipedia article available here. I didn’t care much for it. It didn’t explain what it is, what it was really doing, or why we should care at a simple level so that someone less savvy (like me) could understand just what the fuss is all about. Both HMAC and SHA1 are procedures. HMAC stands for Hash Message Authentication Code and is the procedure we use to combine a message with a secret key whereas SHA-1 stands for Security Hash Algorithm 1, which was made by the NSA and is used to break a message into a corresponding hash string with a fixed block size. Together, they make sure that the integrity of the data hasn’t been compromised and that you’re not sending your raw secret message over the internet…series of tubes. The nice thing about the SHA-1 algorithm is that very slight changes, say replacing a single character in the message, dramatically changes the resulting hash so that it’s difficult to crack (though apparently not secure enough for today’s standards). Remember, HMAC is the main procedure to combine a secret key with the message and SHA-1 is just the type of hash function implemented; but you probably don’t care that much and just want to see the code. So let’s get started!

The SHA-1

SHA-1 has a lot of destructive procedures, a lot of breaking bits into smaller bits, and a lot of the previously developed bitwise functions. Let’s see a quick example of this in action.
Say I have the string phrase "The Ore-Ida brand is a syllabic abbreviation of Oregon and Idaho" and I want to run the SHA-1 Function on it.

mata: sha1("The Ore-Ida brand is a syllabic abbreviation of Oregon and Idaho") 
The results is (hex): 156a5e19b6301e43794afc5e5aff0584e25bfbe7
In Base64: FWpeGbYwHkN5SvxeWv8FhOJb++c=

Good luck figuring out the original string from the Base64 encoding. Now remember, this is not a post about theory or reasoning behind the SHA-1 procedure; this post is about making it work. Therefore, the advanced Stata user who wishes to replicate/improve this code might find this next section interesting. Here are some of my observations regarding repackaging the SHA-1 function.

Mata is incredibly fast, but much slower than the C-code equivalent due to all bits being interpreted as strings and converted back to bytes.
All bytes are subject to integer overflow – if adding two base 2 integers exceeds 2^32, the number acts as an odometer, reverting to zero before counting up again.
While the Wikipedia makes a lot of reference to the “big-endian” integer, the resulting link has a lot of information we might not care about. For our purposes, “big-endian” means that it has left-padded zeros.
Say we needed the number 55 to be “big-endian” 16-bits. Well, 55 is 110111 in base 2 and, since this is only 6 numbers, we’d need it to have 10 preceding zeros.
If your integer padded message length final message is greater than 512 bits, you need to break it out into as many 512-bit sections as necessary to only have 512-bit chunks.
Initialize your “h” variables once (this should be a given). Each time we feed a block through our chunk-making process, overflow-add the “h” variables to the previous values until you run out of blocks.

The HMAC

Compared to SHA-1, the HMAC procedure is a walk in the potato fields… it’s easy as potatoes… I’m running out of references here. Did you know that the potato was the first vegetable to be grown in space? If astronauts could do that with potatoes, we can certainly make HMAC-SHA1 work with Stata. There’s really just a three step process at play. The HMAC procedure takes two inputs: a key and a message.

If the key is longer than the blocksize (64 in this case) run the SHA-1 function on the key; if it’s shorter, left pad the key with 0x00 (- char(0) -); if it’s the same length, just keep the key.
Create the outer key pad (64 * “\”) and the inner key pad (64 * “6”), convert these to their base 2 representation, and use the exclusive or bitwise operator on the key pad and the key.
Concatenate the inner key pad with your message (inner key pad first) and run the SHA-1 function on the resulting padded message. Take the outer key pad and concatenate the result of your first SHA-1 with the outer key pad (outer key pad first) and run the SHA-1 function on this step. Now we’re technically done!

The Conclusion

Well, this post (and the previous one) has been filled with a little more technical jargon than I planned. I like to keep these posts fun and poignant, but this material is for the dedicated and serves as a reference for those who want to expand Stata’s capabilities (even if it takes a little longer than expected). This new Mata function allows Stata to perform the HMAC-SHA1 procedure which is vital for enabling Twitter requests through Stata so that the entire process can be contained within one do-file. Here’s an example of the function in action:

. mata: hmac_sha1("Secret Key", "Message to be sent")
  d5052c13e868ea7c932be9279752e9e67c8195bd
. mata: hmac_sha1("Secret Key", "Message to be Sent")
  f67f5f90132583de85abf0d61fed2a2144be1f04

You can see how the examples show that slight changes in the message dramatically change the output. Feel free to download the process below. All subroutines are included for your convenience. Good luck!

hmac-sha1.do
File Size:	6 kb
File Type:	do

Download File

5 Comments

Building an API Library

2/5/2016

2 Comments

Bitwise Operators (aka Bits, Bits, Bits Part II)

Did you know that Mata supports bitwise operators? Well, it actually doesn't – in the typical sense. But that won't stop us from making it work. You see, Mata can handle data extremely well, and with a little finesse, can be forced to do things it wasn't really made to do. Yes it's going to be slow, and yes it's probably not very useful to the average user, but let me try to convince you how great using Mata really is!

For those who don't know, Mata is a lower level language than Stata – many of Stata's complex functions are actually written in Mata because it's really quite fast. Mata mimics a lot of C's syntax, but also simplifies things so you don't feel like you have to explicitly declare everything. In previous posts we've exploited the power of the - inbase() - function and we will make ample use of that today.

Say we have a text file containing the word "Chunk". While we see a word, the computer sees numbers which correspond to each letter – otherwise known as ASCII. Mata's - ascii() - function can help us find this representation:

This is a simple way of converting our text into numbers, but how about into bytes? Typically, bytes are displayed in base 16:

But now we want to see each bit. Remember, I'm not a computer scientist, so you can trust me when I say this really isn't all that bad for those of you who haven't been exposed to this stuff. Just know that each of these bytes contains 8 bits. Each bit can either be on or off (1 or 0) which means that there’s a total possible bit combination of 2^8 = 256 per byte. Let's look at what Stata shows us when we look at everything in base 2:

Notice, I added a zero and a one at the end of the text string "chunk" for illustrative purposes. Why are these values not 0 and 1 respectively? That’s because the digits are also ASCII characters (digits 48 and 49). We can get the values of zero and one by using the - char() - function. For fun, we'll also look at values two and three as well.

Well, because there are technically 8 bits per byte, we need to pad each output with zeros so that the total length is 8 bits. For example: the value "3" can be written as "11" in base 2, but is the same "00000011" so that we can imagine all 8 bits. We can easily accomplish this in matrix form.

Notice the use of the colon operator? It's by far one of my favorite operands (not that I have that many) because it does the same operation on each element of the matrix, which makes the overall statement extremely succinct! The statement above just says: "Give me some zeros, exactly 8 minus how every many numbers we had, and append the original statement to the end to make sure every element has exactly 8 digits."

We should probably make this into a function, since we’ll use it a lot. So let's make the size of the padding an input as well.

mata:
string matrix padbit(string matrix x, real scalar padnum)
{
        string matrix y
        y = "0" :* (padnum :- strlen(x)) :+ x
        return (y)
}
end
mata: padbit(chunk, 8)

Logical Operators

And, Or, Not, Xor – These are easy to implement. You can think of these functions as truth tables if you want, but really, you're just comparing each bit to the respective bit of another byte.

For example: I have two bytes (they need to be of the same length): 00111100 and 10101010. If I were to use the And operator, for the result to be true (1), the first bit of Byte 1 must be the same number as the corresponding bit in Byte 2 (=). The following illustration helps demonstrate this idea:

The Or operator implies that either bit could be a 1 for the output to be true:

Not works with only one byte and says to flip all the bits (make all 1's 0's and all 0's 1's):

Finally, Xor (the exclusive or) states that Byte 1 and Byte 2 must have opposite values to be true. So if the first bit of Byte 1 is a zero, the first bit of Byte 2 has to be the opposite for the outcome to be true:

Had enough logic yet? I certainly have... so I won’t go into any of the functions anymore, but I’ll make these available for you to download so you won't have to worry about the logistics:

bitwise-mata-functions.do
File Size:	2 kb
File Type:	do

Download File

Shifts and Rotations

The second thing we need to handle when dealing with bitwise operations are methods to move the bits. There are two main ways to shuffle bits around: the shift and the rotation. While they both move the position of the bits, a shift actually destroys bits and replaces trailing values with zeros, whereas the rotation just moves the shifted value to the opposite side of the bit. Therefore, we can think of the shift as a way to destroy information and a rotate as a way of hiding information. Let’s see this in action:

Note: this animation was made using - twoway scatteri -

It's interesting to follow, though not all that interesting if it doesn't have a practical application. If you're like "honestly, I don’t know nothing about bit functions", I'll say - well I've got the one you. How about a way to easily encrypt your files so that you can hide your sensitive stuff in plain sight? First find a file and read it in:

// Read in File to Copy
fh  = fopen("Building an API Library.docx", "r")
eof = _fseek(fh, 0, 1)
fseek(fh, 0, -1)
x = fread(fh, eof)
fclose(fh)

Convert the file characters to the ASCII decimal value then convert this number into the base 2 representation (don't forget to pad the bits). From here, we can use our bitwise operations before converting this number back to base 10 and finally back to characters:

// Run Bitwise Not
y = padbit(inbase(2, ascii(x)), 8)
for (i=1; i<=cols(y); i++) {
        y[i] = bitnot(y[i])
}
y = char(frombase(2, y))

Lastly, write your newly altered file using Mata. This is obviously very basic, but a great way to hamper nosy coworkers.

// Write the Results to File
fh = fopen("Copy.docx", "w")
fwrite(fh, y)
fclose(fh)

But really, we're doing this with the ultimate goal of gaining access to Twitter data using Twitter's API. This is just step one of a three part series and if you're lost so far. there's plenty of time to see the motivation for this post in the next step. I promise it gets more interesting, yet I hope I've shown some of Mata's potential and how you can easily bring in the concepts to your own do-files.

2 Comments

Stata and cURL

1/3/2016

4 Comments

The Fitbit API and OAuth 2.0

Why Care Block:
OAuth 2.0 is in use for most API's, from Fitbit toFacebook, Instagram to Twitter.
cURL works seamlessly with Stata's syntax and allows for sending HTTP requests – in English, we can take advantage of a lot of good resources.

Setting It Up

Welcome to part two of the three part series regarding Fitbit Heart Rate data. Quick recap: part one showed us how to encode strings in Base64, which we will use today.

I think it's safe to say that people are fascinated by themselves and their day-to-day biology that usually goes unnoticed. The trend of wearable technology seems to be thriving and shows little sign of a slowdown. Fitbit, in particular, has exploded in popularity as one can be seen sported by President Obama on the latest episode of Comedians in Cars Getting Coffee. Now I have to mention that I don’t think I’d have this interest if it were not for Belen, first for introducing me to the Fitbit and second for being such great competition in our respective daily step goal challenges.

While Fitbit does an excellent job at providing a great amount of data available to your fingertips, heart rate data has been particularly elusive. Why? Well, it's probably what people are most interested in when buying the Charge HR and could be used in conjunction with step count to paint a pretty accurate picture of the wearer's habits – hence it's only available using their API. The following provides a mid-level description of how we go about getting access to our own data. Let's start with registering an Application, you can read more about it at https://dev.fitbit.com/docs.

Enter all your personal information, but pay special attention to the sections above. If you want Heart Rate data, you must select the "Personal" box under OAuth2.0 Application Type*. You may wish to give your application Read and Write privileges as well if it's your own personal application. Finally, you can use the Callback URL http://www.wmatsuoka.com/fitbitapi.html or you can use any other site. It's just the redirection site after authentication, more on this in the next section.

First Stage: Code

From here on out, all important variables have been color coded to easily see what's going on.

Find your application's client_id and client_secret by going to "MANAGE MY APPS". Click on your App and you'll see the following information:

Enter this information into the following code snippet below:

local client_id     "BBC123"
local client_secret "9gh68g9fg77ff896ihh7gi8ih768f96i"
local redirect      "http%3A%2F%2Fwww.wmatsuoka.com%2Ffitbitapi.html"

encode64 "`client_id':`client_secret'"
local client64 = r(base64)
                               // This can be ran straight from a browser
local url = "https://www.fitbit.com/oauth2/authorize"                 ///
    + "?response_type=code&client_id=`client_id'"                     ///
    + "&redirect_uri=`redirect'"                                      ///
    + "&scope=activity%20nutrition%20heartrate%20location%20"         ///
    + "nutrition%20profile%20settings%20sleep%20social%20weight"

view browse "`url'"

What's going on here? We store the Client ID, Client Secret, and Callback URL in local macros. The previous post's encode64 appears here, but isn't used until the next section. These locals are passed into a single string which is then passed to your browser using the view browse command. After entering your login information, this is the following result:

Here, I've provided an example of how you would manually input this code into Stata. If you wish for more automation, just know that the code appears in the URL. For example, if your Callback URL is http://www.google.com, then the code would appear as:

http://www.google.com?code=abcdefghijklmnopqrstuvwxyz916

Second Stage: Authorization

Well we did it! We made it to the cURL section. Make sure you've downloaded cURL and can call it from your command prompt (curl --help).

First, we need to know a little bit about the shell command. Shell (which can also be called by typing "!") allows you to send operating system commands from Stata, the advantage of the shell command is that it will wait until the command has finished before resuming the Stata do-file. Alternatively, there's the command winexec – it operates like shell, with the exception that Stata won’t wait for it to complete before moving on to the next do-file command.

In order to pass the code back to Stata after viewing the code in your browser, I like to use the display directive _request(). It halts your code and allows you to enter a value before continuing, storing the value in a global macro.

display "Please wait for browser "                                  ///
    "and enter the code from the redirect URL" _request(code)
if ("$code" == "") exit

local d_client "client_id=`client_id'"
local d_auth   "grant_type=authorization_code"

!curl -i -H "Content-Type: application/x-www-form-urlencoded"       ///
    -H "Authorization: Basic `client64'" --request POST --data      ///
    "`d_client'&`d_auth'&redirect_uri=`redirect'&code=$code"        ///
    https://api.fitbit.com/oauth2/token                             ///
    --output "accesstoken.json"

This asks for your access token, which is necessary to make any request to Fitbit and places the result in the file "accesstoken.json". You can see that it uses your client_id, the Base64 encoded local made in the previous stage, and the code that you entered from the browser. You may change the output file name, but the information contained should be the following:

Response from server:
{
 "access_token" : "eyJhbGciOiJIUzI1NiJ9.eyJleHAiOjE0NTE4MDAyNjksInNjb3BlcyI6Indsb2Mgd3BybyB3bnV0IHdzZXQgd3NsZSB3aHIgd3dlaSB3YWN0IHdzb2MiLCJzdWIiOiIzSzdQVzYiLCJhdWQiOiIyMjlZRFciLCJpc3MiOiJGaXRiaXQiLCJ0eXAiOiJhY2Nlc3NfdG9rZW4iLCJpYXQiOjE0NTE3OTY2Njl9.nO9nHAM2daPPvAMd6wIJgAc7B4KKRXFP6X8Jawy-l8s",
 "expires_in" : "3600",
 "refresh_token" : "4fe7f608a98644205161d85f91f7e3034d8cf463d89f1dd7e89f84b096a2f0ff",
 "scope" : "nutrition sleep settings social weight activity heartrate profile location",
 "token_type" : "Bearer",
 "user_id" : "WMM999"
}

You may parse this file how ever you wish, just make sure to take the access_token and, optionally, the user_id (you can just memorize this value and hardcode it into your requests if the application is only for your personal use). The token lasts for an hour, so you may use it to call multiple requests within the Fitbit's call limit which happens to be 150 requests per hour.

Third Stage: Requests

Now that all that security stuff is out of the way, we can actually do work and start pulling our data.

global uid    = "WMM999"
local d       = "2015-12-31"
local fburl   = "https://api.fitbit.com"
local request = "`fburl'/1/user/\$uid/activities/heart/date/`d'/1d/1sec.json"
local output  = "output_file.json"

winexec curl -i -H "Authorization: Bearer $access_token" ///
        --request GET "`request'" --output "`output'"

Here, we store the access token parsed from the previous stage in the global $access_token. I separated the request into separate locals to be easier to change certain values, but it could easily be written as a single string. Finally, we use winexec over shell in this stage, because we can contain this last statement within a loop and execute multiple requests almost simultaneously. The request above stores second-level heart rate data from the last day of the year in the file "output_file.json"; an example of this data will be shown in the next post.

For a full list of requests, check out Fitbit's website. Otherwise, try practicing this method with other APIs - you'll be surprised by what you find!

4 Comments

Encode/Decode/Nintendo 64

1/1/2016

5 Comments

Why Care Block:
Base64 encoding is extremely common when using API services, such as the Fitbit API, but that’s about all I know. It’s necessary to get the job done and isn’t readily available in Stata.

Happy New Year! We're starting 2016 with a bang, including this three part series on acquiring Fitbit data through Fitbit’s API services. 2015 was a great year and marked the start of this website, and I can guarantee that there will be much more content to come. See the new "Why Care Block"? It’s inspired by a Holiday conversation with family and gives a brief synopsis of why we’re even doing this in the first place. With that, let's talk about the topic of the day: Base64 encoding.

Base64 encoding exists for some privacy purpose. That's about all I want to say about Base64 encoding. Let's just look at an example, they’re a lot cooler.

Say for instance we have the phrase: “This is kinda boring…”

By converting every character to ASCII bytes (and by potentially adding padding), converting each byte to base 2, taking the 8-bit representation of the binary character and convert it to a six bits, converting that back to base 10, and using those numbers (they fall between 0 and 63) to look up the corresponding character of the alphabet plus two other characters, we finally arrive at the following encoded string:

"VGhpcyBpcyBraW5kYSBib3JpbmcuLi4="

While they mean the same thing, I think the first phrase was a little more accurate. We can encode this second phrase a second time and it gives us:

"VkdocGN5QnBjeUJyYVc1a1lTQmliM0pwYm1jdUxpND0="

Now you can easily send encoded messages to your friend (not plural – I can't imagine that many people would tolerate this type of behavior). I’ve put together a Stata package containing these routines; however, no help file is available upon the first release. Here is a brief overview of the new commands, encode64 and decode64 at work.

We first called encode64 on the string "client_id:123456789" to encode this value in Base64. The result shows under the command, but is also callable through the macro r(base64). We create a local macro that contains this encoded value ("Y2xpZW50X2lkOjEyMzQ1Njc4OQ==") and decode this message to get back to our original string. It's a lot less fun than my old Nintendo 64, but trust me, the results will be extremely rewarding! Feel free to download the ado file below.

encode64.ado
File Size:	2 kb
File Type:	ado

Download File

Part 2: Getting Heart Rate Data with Stata, Fitbit's API, and cURL

5 Comments

Sending an Email with Stata (Outlook Edition)

12/17/2015

6 Comments

For Use with Windows

After about a month using Stata, most early programmers start asking questions about how to expand Stata's functionalities beyond generate and replace. A common workplace question is: "how can I get Stata to send out automatic emails for me?"

A quick Google search yields many answers – most of which requires you to know a thing or two about email servers. After hours of collecting material and trying to send out emails, you'll realize that your work's firewall disallows you to do anything of the sort! Well, if you use Outlook (which is pretty common), you can easily automate sending emails using the following VBScript:

Set Outlook = CreateObject("Outlook.Application")
Set Mail = Outlook.CreateItem(0)
Mail.To = "[email protected]"
Mail.Subject = "Automated Email"
Mail.Body = "Hello Recipient"
Mail.Send
Set Mail = Nothing
Set Outlook = Nothing

But how do we send this out? It's really quite simple. Open up any text editor (though I recommend using Notepad++), copy this code into the text editor, and save this file as "whatever.vbs", and either double click the file or run it by using Stata's shell command.

yourdirectory + "whatever.vbs"

CRLF

This is great for simple emails, but what if we want to make our body a little more complex and less "robotic?" Let me (re)introduce you to ASCII characters 10 and 13. Since we're dealing with Windows for this post, let's switch them around and show char(13)+char(10) which corresponds to \r\n or translated: carriage return + line feed (CRLF). What the heck is a carriage you say? (Likely if you're under 50) Well, it all relates back to typewriters.

The carriage is the tray thing that moves along as you type, and by asking it to "return", you usually will get it shooting back with that distinctive PING sound. Line feed tells the typewriter to move the paper up one line. A carriage return without a line feed would overwrite anything you've typed, and a line feed without a carriage return could start a newline in the middle of a page. Of course, things don't work that way anymore, but hopefully that makes a little more sense!

Anyway, this combination is useful to you if you want to send multiple paragraphs in an email. Even more useful, write out your email body in a text file and let Stata pick up the file for you, and write the body by itself. But more on that in a little bit. For now, let’s talk about writing the actual script.

In Stata, in order to write a script, we must first familiarize ourselves with the file processing commands: file open, file write, and file close. The secret here is that we can use locals to fill out any missing information in the file such as an email recipient, a subject line, or an attachment location. Boom! We have a program.

program define outlook_email
        syntax , to(string) [subject(string) body(string) attachment(string)]
end

Since we always need a recipient for an email "to" is a must, but everything else should remain optional. We want to allow our users to do whatever they want, which might include sending out 10,000 blank emails to a specific person. Why? They probably have their reasons.

File Processing

Want to write a file using Stata? It's very easy to write the VBScript which runs the entire process. For those who are unfamiliar with the file command, it follows three basic steps: open that file (even if it doesn't exist yet), write stuff to that file, and close that file! Let's take a look at some basic syntax below:

The blue denotes these steps, the green is the name that we gave our program to point to which file to write to, and the red denotes the options. Notice that our green "name" is myfile, but it could be anything, yet our physical file name is "testfile.txt". Think of myfile as an id for which file we're writing to (or reading from).

Notice that we just need to put a string followed by _n to write a single line to the file. We then do that again for line two, and for lines three and four. We're able to write lines three and four on the same line, because they contain that _n which calls for an end of line character (in this case CRLF) to be written.

The Body

There are four steps to a making a text file work with VBS:

Get rid of quotes: from " to "+Chr(34)+"
Get rid of apostrophes: from ' to "+Chr(39)+"
Replace CRL characters: from \013d\010d to "+ Chr(13)+Chr(10)+"
Get rid of useless stuff: from +""+ to +

You’ll see that we use filefilter to take care of these four scenarios, creating a single string that contains the entire body of our email (line breaks included). Putting all of this together, we arrive at the final code:

Final Program

********************************************************************************
* Will Matsuoka: 2015-12-17 version 2.0.0 - for demonstrative purposes
********************************************************************************

program define outlook_email
        syntax , to(string) [subject(string) body(string) attachment(string)]
        
* Allow for the subject to contain quotes and apostrophes
        if `"`subject'"' != "" {
                sta_2_vbs `"`subject'"'
                local subject = r(vbstring)
        }
        
        if `"`body'"' != "" {
                preserve
                tempfile f1 f2
                filefilter "`body'" `f1', from(`"""') to(`""+Chr(34)+""')
                filefilter `f1' `f2', from(`"'"') to(`""+Chr(39)+""')
                filefilter `f2' `f1', from(\013d\010d) to(`""+Chr(13)+Chr(10)+""') replace
                filefilter `f1' `f2', from(`"+""+"') to("+") replace
                
                clear
                set obs 1
                gen file = fileread("`f2'")
                local body = file[1]
                restore
        }
        
        tempname myfile
        file open `myfile' using sendemail.vbs, write replace
        file write `myfile' ///
                `"Set Outlook = CreateObject("Outlook.Application")"' _n ///
                `"Set Mail = Outlook.CreateItem(0)"' _n ///
                `"Mail.To = "`to'""' _n ///
                `"Mail.Subject = "`subject'""' _n ///
                `"Mail.Body = "`body'""' _n
        if "`attachment'" != "" {
                file write `myfile' `"Mail.Attachments.Add("`attachment'")"' _n
        }
        file write `myfile' ///
                `"Mail.Send"' _n ///
                `"Set Mail = Nothing"' _n ///
                `"Set Outlook = Nothing"' _n
        file close `myfile'
        
        shell sendemail.vbs
end

program define sta_2_vbs, rclass
        local string = subinstr(`"`1'"', `"""', `""+Chr(34)+""', .)
        local string = subinstr(`"`string'"', `"'"', `""+Chr(39)+""', .)
        local string = subinstr(`"`string'"', `"+""+"', "+", .)
        return local vbstring `"`string'"'
end

Not too terrible, although I do have a few things to note:

For troubleshooting, if your VBScript works, your Stata script should work - in other words, start at your VBScript
There are times where it helps to keep Outlook open, to make sure that your email doesn't just sit in the outbox
If you're trying to run this in batch mode, omit the shell command. Just call the script on the next line of your batch file (since shell doesn't work in batch mode)

6 Comments

<<Previous

W=M/Stata

Welcome

Composer - Writing Music in Stata

Stata and Illustrator - Master of Arts!

Stata and the Twitter API (Part II)

OAuth

Base64 Encoding

Bitwise Operators and Security Methods

Stata Plugins

Nonce

Percent Encoding

Send Out the Tweets

Stata and the Twitter API (Part I)

Application-Only Authentication

Stata Plugins: the C-Sweet

HMAC-SHA1 in Stata

The Fuss

The SHA-1

The HMAC

The Conclusion

Building an API Library

Bitwise Operators (aka Bits, Bits, Bits Part II)

Logical Operators

Shifts and Rotations

Stata and cURL

The Fitbit API and OAuth 2.0

Setting It Up

First Stage: Code

Second Stage: Authorization

Third Stage: Requests

Encode/Decode/Nintendo 64

Sending an Email with Stata (Outlook Edition)

For Use with Windows

CRLF

File Processing

The Body

Final Program

Author

Archives

Categories

W=M/StataWelcome

OAuth

Base64 Encoding

​Bitwise Operators and Security Methods

Stata Plugins

​Nonce

Percent Encoding

​Send Out the Tweets

​Application-Only Authentication

The Fuss

The SHA-1

The HMAC

The Conclusion

Bitwise Operators (aka Bits, Bits, Bits Part II)

Logical Operators

Shifts and Rotations

​The Fitbit API and OAuth 2.0

​Setting It Up

​First Stage: Code

​ ​Second Stage: Authorization

​Third Stage: Requests

For Use with Windows

CRLF

File Processing

The Body

Final Program

Author

Archives

Categories

W=M/Stata

Welcome

Bitwise Operators and Security Methods

Nonce

Send Out the Tweets

Application-Only Authentication

The Fitbit API and OAuth 2.0

Setting It Up

First Stage: Code

Second Stage: Authorization

Third Stage: Requests