teleren/devto huggingface dataset:
New Relic Interactive Application Security Testing (IAST) - Data Sheet
Tags: security, devops, coding
Published: 2023-08-08 22:59:11

Hi, Devs! 

New Relic Interactive Application Security Testing (IAST) enables DevOps and security teams to focus on real security risks, remediate issues faster across the application lifecycle, and ship secure code with speed and confidence.

Accurate, fast IAST. Ship code faster with unmatched detection accuracy of security risks. 

**Benefits**

⭐ See everything and eliminate blind spots

⭐ Enhance security testing accuracy

⭐ Focus on what matters with proof-based exploit validation

⭐ Accelerate remediation efforts

⭐ Scale at will


##[Download the datasheet to learn more about the benefits and capabilities of New Relic IAST.](https://newrelic.com/resources/datasheets/iast?utm_source=devto&utm_medium=community&utm_campaign=global-fy24-q2-IAST-ebook)
Configure Grafana Cloud SAML to work with JumpCloud
Published: 2023-08-08 22:54:44

## JumpCloud SAML
```
Display Label: Grafana Cloud

IdP Entity ID: JumpCloud
SP Entity ID: https://bla.grafana.net/saml/metadata
ACS URL: https://bla.grafana.net/saml/acs
SAMLSubject NameID: email
SAMLSubject NameID Format: urn:oasis:names:tc:SAML:1.1:nameid-format:emailAddress
Signature Algorithm: RSA-SHA256
Sign Assertion: < checked >
Default Relay State: https://bla.grafana.net/
Login URL: https://bla.grafana.net/login
Declare Redirect Endpoint:  < checked >
IDP URL: https://sso.jumpcloud.com/saml2/bla1

User Attributes:
Service Provider Attribute Name: displayName ; JumpCloud Attribute Name: fullname
Service Provider Attribute Name: mail ; JumpCloud Attribute Name: email
Service Provider Attribute Name: username ; JumpCloud Attribute Name: username

GROUP ATTRIBUTES:
Include group attribute: group
```

## Generate certificate
Use [official guide](https://grafana.com/docs/grafana/latest/setup-grafana/configure-security/configure-authentication/saml/#certificate-and-private-key)

## Grafana Cloud SAML
```
General settings
Display name for this SAML 2.0 integration: JumpCloud
Allow signup: < checked >
Auto login: < checked >
Single logout: < unchecked >
Identity provider initiated login: < checked >
Relay state *: https://bla.grafana.net/
Max issue delay: 90s
Metadata valid duration: 48h

Key and certificate
Signing and encryption key and certificate (required): Base64-encoded content
Private key: < upload key.pem file from step Generate certificate>
Certificate: < upload cert.pem file from step Generate certificate >
Sign requests: < checked >
Signature algorithm: RSA-SHA256 (default)

Connect Grafana with Identity Provider
IdP's metadata: URL for metadata ; Copy Metadata URL from JumpCloud

User mapping
Name attribute: displayName
Login attribute: username
Email attribute: mail
Groups attribute: < blank >
Role attribute: group
Org attribute: < blank >

Role mapping
Editor: developers
Admin: admins
Skip organization role sync: < unchecked >
Allowed organizations: < blank >
Name identifier format: Email address

Test and enable
Hit button "Save and Enable"
```

## Nuances
* Make sure that `displayName` has text as Grafana SAML not accept empty value. This means that in JumpCloud you should have `fullname` set
* Example on how added multiple roles:
```
role_values_admin = DevOps,Admins
role_values_editor = Build,"Extra Engineering"
```
* `IDP URL` should be unique for all applications on your JumpCloud account
OAuth 2.0 Simplified
Published: 2023-08-08 22:42:06


![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/lzcmc06if9m0p7ihnx14.PNG)OAuth 2.0 is a powerful and secure framework that allows different applications to securely interact with each other on behalf of users without sharing sensitive credentials. 

The entities involved in OAuth are the User, the Server, and the Identity Provider (IDP).

What Can an OAuth Token Do?

When you use OAuth, you get an OAuth token that represents your identity and permissions. This token can do a few important things:

Single Sign-On (SSO): With an OAuth token, you can log into multiple services or apps using just one login, making life easier and safer.

Authorization Across Systems: The OAuth token allows you to share your authorization or access rights across various systems, so you don't have to log in separately everywhere.

Accessing User Profile: Apps with an OAuth token can access certain parts of your user profile that you allow, but they won't see everything.

Remember, OAuth 2.0 is all about keeping you and your data safe while making your online experiences seamless and hassle-free across different applications and services.

Over to you: Imagine you have a magical power to grant one wish to OAuth 2.0. What would that be? Maybe your suggestions actually lead to OAuth 3.
Perl tags program
Tags: perl, vim, opensource, programming
Published: 2023-08-08 22:30:46

Recently, I got some free time to tinker with some side projects. One of which is a Perl based tags program for VIM. It's a work in progress. The idea is to explore regular expressions and parsing out source files of different languages which I think Perl is good at. Feel free to check it out on my [github](https://github.com/OXKernel/ptags)
My Mini Project
Tags: webdev, beginners, ruby, programming
Published: 2023-08-08 22:19:02

It has been an insightful, fun, challenging road through DPI's Tech Prep course. I have finally made it and completed the last section, which is the mini project section. I wanted to write about my thoughts while completing the mini project.

**My first idea**

My first idea for my API web application was to create a page that used a U.S. state data API. It would be a fun site with useless facts about any state the user entered. Unfortunately the JSON file I wanted would cost me $20/month. To avoid any hassles with canceling my plan at the end of the month and giving a company I do not know about my credit card information I pivoted and went with a free lorem ipsum API. 

**My lorem ipsum idea**

Now that I had access to a free working API, it was time to get to work. The lorem ipsum API I was using had a lot of options for the user. The user could decide between the length of the paragraphs, headers, unordered/ordered list, description list, and block quotes. While working through that I found out that there was a bacon ipsum API as well and a hipster ipsum API. I decided I would have all 3 options available for my user. 

**My first hiccup**

I was progressing through my form section with little problems. I decided to use checkboxes instead of text boxes, it would be easier for the user and look better. Unfortunately when I switched the text boxes to checkboxes it broke my app. When the checkbox was clicked everything went well. The problem was when the user was selective with the options. A "key not found" error would appear. I tried everything, from adding a value attribute to the input tag to using if statements with a nil option when not selected. Nothing seemed to work and since I did not know how to properly write my problem down in google. I could not successfully troubleshoot through my problem. Luckily text boxes worked perfectly fine so I decided to move forward with them. Once the main page was completed with the regular lorem ipsum, the two other ipsum pages were very identical. 

**Overall**

Overall I am happy with my web app and when I styled the app it solidified my feelings. I would have liked to work with an API that required a private key and had layers in the JSON file to really understand what it is like working with API's. As a result I have reviewed the API material and taken detailed notes so, that when I have to work with a more complicated API I will be prepared. 

[Here is a link to my mini project](https://loripsum-api-miniproject-techprep.onrender.com)

_Please allow ~30 seconds for render to kick start and host my site_
Twitch Announces Blaze Ban on Streaming: 'Protect Our Community'
Tags: news, github, chatgpt
Published: 2023-08-08 22:15:26

From [ATLZ ](https://atlz.online/) - This Wednesday, August 2, Twitch announced that it is adding two more betting sites to the platform's block list: Gamdom and a very popular one in Brazil, Blaze, which sponsors numerous influencers such as Felipe Neto, Jon Vlogs, Bruno "Nobru" and even the number 10 shirt of the Brazilian team Neymar.

The change came because of the streaming platform's gambling policy. With that, these two sites will no longer be able to be publicized in lives. In the note released by the company, which belongs to Amazon, it was informed that the objective "is to protect our community, address predatory behavior and make Twitch safer".

In October of last year, Twitch put into effect a policy against gambling, when casino sites, slot machines, roulettes or any other type of unregulated betting in the United States and other countries became prohibited from broadcasts. from the platform.

With that, Blaze and Gamdom, the newest blocked by Twitch, join Stake, Rollbit, Duelbits and Roobet, who were previously on the list. In addition, it is prohibited to share code in the chat that leads to the websites, as well as to provide a banner with a link and even talk about bookmakers, as well as display them during the lives.

"We consider many factors in determining whether a site is permitted, including whether the site includes security protections such as deposit limits, waiting periods, and age verification systems," Twitch said in a statement. "We also take into account whether streamers use or encourage VPNs to avoid geoblocking and whether the site is licensed in the US or other jurisdictions that provide sufficient consumer protections," the site continued.
Disabled: true vs Readonly: true in Rails
Tags: ruby, rails, html
Published: 2023-08-08 21:00:35

***What did i want to accomplish:***

I had a rails form where i wanted one of the required fields to auto fill with some values.
```ruby
<% if @issue.safe_attribute? 'subject' %>
<p> <%= f.text_field :subject, value: @issue.project.name, :size => 80, :maxlength => 255, :required => true %></p>
<% end %>
```
The goal being, a user editing the form should not be able to edit this specific field.

If you're like me, your first thought would be to add `disabled: true` to the code. This disabled the field but it was triggering validation errors saying `the field can't be blank`.

After reading about the `disabled` option, i realized disabled elements are not submitted with the form(thus triggering validation) while `readonly` as its name says it, cannot be modified by a user interaction.

[More info here
](https://developer.mozilla.org/en-US/docs/Web/HTML/Attributes/readonly)
***How did i accomplish it:***
Replace `disabled: true` with `readonly: true`

Result:
```ruby
<% if @issue.safe_attribute? 'subject' %>
<p> <%= f.text_field :subject, value: @issue.project.name, readonly: true, :size => 80, :maxlength => 255, :required => true %></p>
<% end %>
```

Moral of the story: Should've taken HTML course seriously😉
Which Tech Trends Missed the Mark?
Tags: discuss, watercooler
Published: 2023-08-08 22:06:38

In the ever-evolving world of tech, some gadgets were hyped to be revolutionary but turned out to be quite amusing instead. 

Can you recall any tech gadgets that turned out to be more comical than cutting edge? Share your favorite tales of tech trends gone awry.

Follow the DEVteam for more discussions and online camaraderie!

{% embed [https://dev.to/devteam](https://dev.to/devteam) %}
Day 800 : Step by Step
Tags: hiphop, code, coding, lifelongdev
Published: 2023-08-08 21:38:28

_liner notes_:
- Professional : Pretty chill day. Had a meeting with a coworker about a project that I created awhile ago. Met with my manager to show them what I've been working and get some feedback and plan out the rest of the week. Worked on updating some documentation and finished up what I could. I've got a couple of questions I asked the engineering team to get some clarification. Also responded to some community questions and pair programmed with a team member.

- Personal : Went through some tracks for the radio show and worked on my side project.

![View from top of a mountain with large stone rocks in Rosishniy Reserve, Ukraine with mist in the valley of the green mountain range at sunset](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/ldw6wtfawxdqt09pgr8c.jpg)

Going to grow through more tracks for the radio show. For my side project, I need to work on some of the live streaming part of the site. I'm getting close to the finish line, I think. Step by step.

Have a great night!

peace piece
Dwane / conshus
https://dwane.io / https://HIPHOPandCODE.com
{% youtube KI6voHh69B8 %}
Disallow GPT Bot from Scraping our Blog Posts
Tags: watercooler, openai, gpt3, discuss
Published: 2023-08-08 19:49:31

Lately, we can bloc GPT bots from scraping our pages for a site that we control, by setting the following lines [in the `robots.txt` file](https://platform.openai.com/docs/gptbot):

```
User-agent: GPTBot
Disallow: /
```

I, myself, found out this from a [tweet](https://twitter.com/GergelyOrosz/status/1688829094249615360?s=20) from Gergely Orosz:

![Bloc GPT Bot tweet from Gergey](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/ub9qg7ddrc18v4xwio20.png)

My stance on this is similar to what Gergely is saying. GPT offers no citation to the information it provides. While I did update the `robots.txt` file on my personal website, I am also cross-posting to DEV. If we look at the [`robots.txt`](https://dev.to/robots.txt) from DEV.to, we can notice that it does not have the same rule for GPTBot.

There are thousands of people posting to DEV, many of whom have different views about scraping information for LLM training. I'm in no position to request changes that will affect how the site works. I'm just curious of what is the opinion of other fellow authors about scraping your article for ML training.

# Does updating your `robots.txt` actually solve something?

Obviously not. Adding this statement to your site is just a hint, a request for a bot to please not scrape your data.
This won't stop huge LLM bots (including GPT) to get the information it wants.

So, I'm curious about what do other people think about this topic?
A Journey Through Key Features in Each Version of PostgreSQL (Continue)
Published: 2023-08-08 19:46:14

This blog article follows on earlier [one](https://dev.to/salarzaisuhaib/a-journey-through-key-features-in-each-version-of-postgresql-5cm1) and we will go through the other remaining PostgreSQL versions.

###PostgreSQL Version 13:

PostgreSQL 13 included numerous new features aimed at improving efficiency, safety, and accessibility:

####1.	Incremental Backup:
This version added incremental backup functionality, which reduced the backup window and storage needs.

####2.	Parallel Vacuuming:
Parallel vacuuming was implemented, which improved the efficiency of vacuum operations, which are critical for database health.

####3.	Enhanced Security:
PostgreSQL 13 included a few security upgrades, including the capacity to avoid password reuse and enhanced authentication techniques.

###PostgreSQL Version 14:

PostgreSQL 14's effectiveness features are being refined further, enabling database operations more effective. Among the important enhancements are:

####1. Efficient Hash Join:
 The use of "batched" hash joins improves the speed of join operation, particularly in data storage settings.

####2. Logical Duplication: 
Increase in performance of logical replication make it an extra appealing alternative for synchronization of data across different databases.

####3. Role administration Enhancements:
PostgreSQL 14 adds additional versatility and control to role and permission administration, improving access for users monitoring.

####4. Enhanced Monitoring:
Improved monitoring utilities provide more details about the performance of databases and activity.

###PostgreSQL version 15:

PostgreSQL 15 advances, allowing efficient data structure and query performance.

####1. Data Mask:
PostgreSQL 15 offers data masking, which protects sensitive details by confusing specific data shards, assisting to comply with rules governing privacy.

####2. GIN Indexes:
By letting indexes to include commonly used columns, the addition of wrapping Generalized Inverted Index (GIN) functionality increases search speed.

####3. BRIN Rating Enhancements:
Block Range INdexes (BRIN) embrace enhanced efficiency, especially when searching huge datasets.
 
####4. Procedural languages:
PostgreSQL 15 provides functionality for new procedural languages, allowing you to write more persistent procedures and distinct functions.

###Conclusion:
PostgreSQL's path has been one of ongoing innovation and improvement. PostgreSQL has addressed the increasing needs of designers, administrators, and users with each new version, giving greater performance, sophisticated capabilities, and improved usability. As we've seen, key characteristics introduced with each version have played an important part in developing the database system's capabilities, providing PostgreSQL a dependable and versatile choice for a variety of applications. PostgreSQL is a cornerstone in the field of relational databases, setting the standard for open-source database management systems as it evolves.
Demystifying Exploitable Bugs in Smart Contracts
Tags: 100daystooffload, smartcontract, security, solidity
Published: 2023-08-08 19:42:58

I have read through the paper, [Demystifying Exploitable Bugs in Smart Contracts (pdf)](https://github.com/ZhangZhuoSJTU/Web3Bugs/blob/main/papers/icse23.pdf), written by [Zhuo Zhang](https://twitter.com/i2huer), Brian Zhang, Wen Xu and Zhiqiang Lin. This paper was released late in February of 2023.

Exploitable bugs in smart contracts are a major security concern. Despite the development of many bug finding tools, exploitable bugs and real-world attacks are still trending.

The paper presents a systematic study of 516 unique real-world smart contract vulnerabilities in 2021-2022. Further  they categorize these bugs into seven types, and study their root causes, distributions, difficulty to audit, consequences, and repair strategies.

Here are my take away from the findings in this paper.

* Smart contract vulnerabilities differ from the ones in traditional software. In many cases it's functional bugs which has the side effect to result money loss. Therefore it's important to have deeper domain knowledge of the contract to find vulnerabilities.

* Exploitable bug is a vulnerability in a smart contract that can be exploited by a malicious actor to steal funds.

* We can categorize bugs into two bags, machine auditable bugs (MABs), which can be automatically detected by existing tools, and then there are, machine unauditable bugs (MUBs).

* Tools and human auditor have not met the demand.
* Four kind of categories that automatic tools can find bugs in, Fuzzing, Static Analysis, Verification and Symbolic Execution.
* Many techniques rely on simple or hand-coded oracles which may not be good enough to find functional bugs.
* A large portion of exploitable bugs in the wild, around 80%, are not machine auditable.
* A majority of exploitable bus are difficult to find.
* Machine unauditable bugs can be divided into 7 groups
  * Price oracle manipulation
  * Erroneous accounting
  * Id uniqueness violations
  * Inconsistent state updates
  * Privilege escalation
  * Atomicity violations
  * Implementation specific bugs
* About 85% of the MUBs are in the first six groups above.
* Accounting error and Price oracle manipulations seems to popular to exploit.
* Price oracle manipulation is hardest to find among the MUBs.
* Id uniqueness vioaltions are easiest to fin among the MUBS.
* Flash loans can enable an attack vector.
* An unexpected call sequence can evade the access control.
* The examples of showing symptoms and repair strategies for, price oracle manipulation, erroneous accounting, and privilege escalation bugs.

Overall, I found this paper to be very informative and well-written. It is a valuable resource for researchers and practitioners who are interested in securing smart contracts.

Read it and also checkout the [Web3Bugs](https://github.com/ZhangZhuoSJTU/Web3Bugs/tree/main) GitHub repository.

Happy reading!
I need help with my research 🙏🏻
Tags: help, research, languages, programming
Published: 2023-08-08 19:20:50

Hello everyone, my name is Jood aka @devjood on X. I want help with my research on programming languages I want as many programmers as I can to answer [my google form](https://forms.gle/DGVChuRbBAeyoAtJ9) It doesn’t collect any emails it doesn’t take more than two minutes please help out and share it with anyone who knows about programming and programming languages I appreciate your help and thank you all 🥹🙏🏻💙
ToastJS and Fetching with React apps
Tags: react, javascript, frontend, programming
Published: 2023-08-08 19:05:23

You can add your react app and make fetching

**Installation**

Follow the instructions to install ToastJS-React

```
npm install toastjs-react
```
**Usage**

Add ToastJS-React CSS file to your index.js.

You must add your app components or elements between

```
import { ToastContainer } from 'toastjs-react'
import 'toastjs-react/index.css'
return (
 <ToastContainer maxMessageCount={5} position="center">
  <App />
 </ToastContainer>);
```
You can limit your max toasts in your projects using below.

Change Your Maximum Toast

maxMessageCount={5} // Optional, default = 10

Change Your Toast Position

```
position={"left"|"right"|"center
```
You could have many toasts in your screen. ToastJS-React is going to add them to a queue. It will show them in order.

For example:

You have 8 toasts. And you set your max toast = 5 then firstly you are going to see 5 toasts until they become to fade out. Next,

you are going to see other 3 toasts.

```
// Import useGlobalMessage Hook
 import { useGlobalMessage } from 'toastjs-react';
 
 // Call It In Your Component
 const toast = useGlobalMessage();

 // And Show It!
 toast.show({
    type: "success",
    message: "You have been added your item succesfully.",
    autoCloseWithTimeout: true,
    timeout: 2000,
});
```


![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/npkylo55lgb6ov4u7h88.png)

Also, you can make fetching

```
fetchingOptions?:{
           promise: Promise<any>
           errorComponent: (response?:any)=>React.ReactElement
           successComponent: (response?:any)=>React.ReactElement
           response: (response: object, hasError: boolean) => void
   }
```
If you want to learn a lot, visit to https://www.npmjs.com/package/toastjs-react?activeTab=readme
Apache Age: AgeSQL cli installation
Published: 2023-08-08 17:41:23

AgeSQL serves as a command-line interface (CLI) client tailored for PostgreSQL, enhancing its capabilities by seamlessly integrating Cypher queries alongside conventional SQL. This innovative tool harnesses the Age extension's power within PostgreSQL, enabling the execution of graph queries directly within the database.

The core objective of AgeSQL revolves around crafting a CLI tool that mirrors the user experience of the well-established PostgreSQL CLI (psql). It goes beyond by delivering comprehensive features for efficiently managing graph databases. Furthermore, AgeSQL encapsulates Cypher commands, simplifying their integration and utilization within the PostgreSQL environment.
**Postgres-15**
Install postgres v15 from source code in your system
`https://github.com/postgres/postgres.git`
make sure to checkout the v15 branch before installtion

then install age from the github and run it with postgres 11-12-13 version 
`https://github.com/apache/age.git`
now clone AgeSQL repo 
`git clone https://github.com/AGEDB-INC/AgeSQL`

then 
`cd AgeSQL`
Export the path to PostgreSQL 15, replacing /path/to/postgresql with the path to your installation and enable PGXS:

```
export PATH=/path/to/postgresql/15/bin:$PATH
export USE_PGXS=TRUE
```

then run  the script

```
sudo make
```
[Apache-Age:-https://age.apache.org/](https://age.apache.org/)
[GitHub:-https://github.com/apache/age](https://github.com/apache/age)