teleren/devto huggingface dataset:
You need to learn docker... security!
Tags: docker, beginners, security
Published: 2023-05-08 22:25:10

Docker has so many usages and applications. It's pretty safe as long as you run your processes as non-privileged users, but, in practice, basic container security is often skipped.

## The Docker paradox

Paradoxically, using Docker should increase the level of security, as you don't run applications on the host directly but in isolated containers instead.

The problems come when some frameworks or manual [mis]configurations do not limit the capabilities used by these containers, sometimes allowing root privileges only for convenience, just to make the whole thing work.

It should remain pretty rare now, but if a container requires the `--privileged` flag or uses the default setup, it's usually a red sign.

The appropriate flag is `--user` associated with an unprivileged or limited account.

## Avoid the Docker escape

Escaping from a misconfigured Docker environment is a classic scenario in CTFs (Capture the flag events) and penetration tests.

It's not uncommon such vulnerable containers interact with the kernel as root, hence the high risk.

## Best security practices

While [the OWASP cheat sheet for Docker Security](https://cheatsheetseries.owasp.org/cheatsheets/Docker_Security_Cheat_Sheet.html) is not the only resource available, it's one of the best ones, as it uses simple words to explain complex concepts and gives practical recommendations.

## Dev teams need magic

Theoretically, you're supposed to take the best decisions, ensuring you're not doing it wrong, and mastering all technologies you use.

In practice, critical mistakes happen all the time, even when you care, and it's not a question of "rookie vs. Jedi," as many devs often rely on other layers' magic to deliver. That's pretty much how it works.

You can't anticipate all the risks, but before fetching any git repository or copy/pasting some random Dockerfile, remember basic principles like **the least privilege**.

Programs that run **as you** get the same privileges, and it's even more sensitive if it asks for root access.

Root privileges are not always evil, but many apps simply ask way more rights than necessary.

## Wrap up

In a nutshell, be "root-less." While this problem is not specific to Docker, and the proper configuration might require efforts and tests, it's required for **both** compliance and security.
Object.seal() vs Object.freeze()
Tags: javascript, webdev, programming, react
Published: 2023-05-08 22:09:08

seal() and freeze() are one of the important methods in Object namespace. 

## Seal

With Object.seal we can prevent new properties from being added, or existing properties to be removed.

However, you can still modify the value of existing properties.

**Q) Which of the following will modify the person object?**
```javascript

const person = { name: 'Lydia Hallie' };
Object.seal(person);

```

1. person.name = "Evan Bacon"
2. person.age = 21
3. delete person.name
4. Object.assign(person, { age: 21 })

**Answer: 1**

## Freeze
The Object.freeze method freezes an object. No properties can be added, modified, or removed.

However, it only shallowly freezes the object, meaning that only direct properties on the object are frozen.

**Q) Which of the following will modify the person object?**
```javascript
const person = {
  name: 'Lydia Hallie',
  address: {
    street: '100 Main St',
  },
};

Object.freeze(person);

```
1. person.name = "Evan Bacon"
2. delete person.address
3. person.address.street = "101 Main St"
4. person.pet = { name: "Mara" }

**Answer: 3**
Sloan's Top *5* Newbie Memes of the Week
Tags: beginners, career, codenewbie
Published: 2023-05-08 21:58:05

Listen up! Welcome to [CodeNewbie Team's](https://dev.to/codenewbieteam) very official, very anticipated... **Newbie Memes of the Week!** 

Here are some of our favorites from this week:


![Tweet from @VishalMalvi_: "Theory is when you know everything but nothing works. Practice is when everything works but nobody knows why. In programming, theory and practice are combined: NOTHING WORKS AND NOBODY KNOWS WHY."](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/o73kkgxqobj1dvmzpnw7.jpg)


![Picture of a man crying and holding his hand over his face, "When the computer asks "Are you a robot?", maybe, he just wants to find his family?"](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/pp7tiaa2tbf2d7pi00qa.jpg)


![Stock picture of a man and woman wearing business clothing interviewing another man in a suit. Caption reads, "We're looking for someone age 22-26 with 30 years of experience".](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/87zv4yp9s0nbw9li7nl7.jpg)


!["Me on Friday: I'll stop here and pick up where I left off on Monday. Me on Monday: Picture of an elderly white man wearing a longsleeve black shirt with his head in his hands, looking confused at a Mac laptop".](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/t9mey0gv7ebqyuzeejj8.jpg)


![Four-squared meme of Bart Simpson slowly retreating inside a bush. First Frame: "Can someone" (Bart is fully outside the bush). Second Frame: "Help me with" (Bart is halfway inside the bush). Third Frame: "...Nevermind" (Bart is almost all the way behind the bush). Fourth Frame: Bart is fully outside the bush, there is no text.](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/uilgfgznwak8hxlr6i5a.jpg)


**How is your week going so far? Drop us your fav memes you have added to your meme folder below!**

[ALSO, in case you missed last week's thread, you can find that here!](https://dev.to/codenewbieteam/sloans-top-4-newbie-memes-of-the-week-45e2).
Day 746 : Show and Prove
Tags: hiphop, code, coding, lifelongdev
Published: 2023-05-08 21:58:01

_liner notes_:
- Saturday : Woke up and finished up some stuff to prepare for the radio show. Had a solo show this week so I wanted to make sure that I had enough to talk about. Did the show and had a good time. The recording of this week's show is at https://kNOwBETTERHIPHOP.com

![Radio show episode image of King Charles III wearing a crown and holding 2 scepters with the words May 6th 2023 Fed Up](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/y1whu6fqj9u4y5c5t6jo.jpg)

- Sunday : Did my study sessions over at https://untilit.works Worked on a quick side project and got it to a good point. Also did some work on my main side project. Ended the night watching some anime.

- Professional : Started the week off pretty productive. Sent out a message to get some clarity about what I found when updating some documentation so that I make sure I understand things. I also showed some folks the demo application I made to showcase some behaviors that were unexpected to me to see if they were done that way for a reason I may not see. I like to have a working demo for others to check out so that I can show and prove what I'm seeing.

- Personal : Did some work on my side project. I decided that I need to add some more functionality to the dashboard, so I started working on that. The good news is that the new stuff I need to do, is a slight change from I have already. So it will be at least a good refresher and reinforcement of the code and a chance to maybe do some refactoring.

![Snow covered mountains in the distance with green pastures in the foreground with a river running through the center in Torres del Paine National Park in Chile under blue skies with large white clouds.](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/axr9opa9nszapmlrt0x8.jpg)

I think I've got a clearer path forward for my side project. I was going back and forth on what to do. I've picked one and started down that path. Going to work on that more. Maybe got through some tracks. Definitely aiming to end the night watching some anime. Got an early meeting tomorrow so no late night sessions for me. haha.

Have a great night!

peace piece
Dwane / conshus
https://dwane.io / https://HIPHOPandCODE.com
{% youtube yvCzo2w2s_s %}
i built a react library for adding leaderboards to your app in minutes
Tags: react, npm, tailwindcss
Published: 2023-05-08 21:52:52

yo, what's up 👋

i'm dylan - a high school senior and a software builder.

in the last two days i've built the first version of [flywheel](https://www.myflywheel.app/) - a react library with one component (for now) - a dynamic leaderboard that’s hooked up to your app’s data and ranks items the way you want them to be ranked.

i made a quick demo of me going from `create-react-app` to a fully working leaderboard in 4 minutes lol: 

{% embed https://www.loom.com/share/97547d8f94c44989aebca0be8af71200 %}

-----------------------------

how i got here is a pretty long story lol. here's a quick TL;DR if you're interested

i built + launched the original version of flywheel at a hackathon in san francisco on february 1st.

it used to be a platform where founders could join a leaderboard w/ their founder friends based on their number of users - but then game devs and community builders started asking me to build leaderboards for them lol.

the more i thought about it and the more people i talked to the more i realized that adding leaderboards to your app can be a real pain - especially if you need it fast for a small project or a hackathon. i esp felt this pain since i was building the leaderboard manually for the original product.

so i built a web app where you could fill out a couple of inputs and get a link to a leaderboard you could share with your users/players/friends for them to join.

**but users wanted more control.**

they wanted to not only embed the leaderboards in their frontends but to have more granular access to the columns + props that the leaderboard used.

so i shipped this!

-----------------------------

the library is fully [open-source](https://github.com/dylanintech/flywheel-leaderboard) btw.

also s/o to tremor and tailwind - i'm using them for the skeleton + styling of the leaderboard cards (for now).

lmk what you think!

i'm working w/ a couple co's to test the components w/ their data and am gonna be iterating quickly. this is just `v0.0.9`!

**p.s. i also wrote up some docs in case you're looking for a more technical dive into flywheel :)**

---------------------
*written with ❤️ and 🍵 by [dylan](https://twitter.com/dxlantxch) (a fellow dev)*
Getting SOC2 in Kubernetes
Tags: kubernetes, soc2, security, cybersecurity
Published: 2023-05-08 21:35:10


![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/s2o9tee67xu1wqxsmetg.png)

Diving into the World of SOC 2 Compliance in the Era of Cloud Native Technologies

If you're in the business of handling customer data, you're likely familiar with the term SOC 2. This crucial audit report focuses on the non-financial reporting controls of a Service Organization, particularly relating to system security. Based on the AICPA's Trust Service Criteria, SOC 2 is designed to help users assess and address the risks associated with service providers, ensuring customer data is secure and organisations are adhering to the latest cybersecurity standards.

However, adopting cloud-native technologies, such as containers and Kubernetes, introduces new compliance challenges when it comes to SOC 2. Containers, known for their ephemeral nature, can be stopped, destroyed, rebuilt, and replaced, making it difficult to identify compliance status and when a container no longer complies.

To navigate this complex landscape, let's explore some key components of SOC 2 compliance:

CC 6.1: This component emphasizes the importance of logical access security software, infrastructure, and architectures to protect information assets from security events. A crucial aspect of CC 6.1 is standardizing your infrastructure configuration.

CC 6.6: This component involves implementing logical access security measures to protect against threats from sources outside the system boundaries. It focuses on vulnerability scanning of infrastructure and application containers. Since Kubernetes is an open-source technology, packages and containers running core Kubernetes workloads may introduce known vulnerabilities. Hence, inspecting containers to inventory risk is critical for SOC 2 compliance.

CC 6.8: This component highlights the need for controls to prevent or detect and act upon the introduction of unauthorised or malicious software. In the context of Kubernetes, this includes monitoring cluster access, locking down RBAC and network policies, and leveraging deployment policies to prevent untrusted containers from running.

CC 7.1: This component emphasises detection and monitoring procedures to identify changes to configurations that introduce new vulnerabilities and susceptibilities to newly discovered vulnerabilities.

CC 7.2: Focused on continuous monitoring of the system, CC 7.2 aims to identify any anomalous activity or behavior that may affect an entity's ability to meet its objectives.

In summary, SOC 2 compliance is of paramount importance for organisations dealing with customer data, and the emergence of cloud-native technologies adds a layer of complexity to achieving it. By understanding and implementing key components like logical access security, infrastructure standardisation, vulnerability scanning, and continuous monitoring, organisations can successfully navigate this challenging landscape and ensure customer data remains secure.


For more, see:
{% embed https://www.youtube.com/watch?v=fHnxk3dxAZ8 %}
Book Reading Gadgets
Tags: webdev, bootstrap
Published: 2023-05-08 21:32:44

The [Book Reading Gadgets](https://bookreadinggadgets.com/) is all about book reading accessories that will help you make reading more comfortable. Some of these items include book page holder, book lights, book holder pillow, husband pillow, reading chair, and book stand. All these reading accessories help to make reading easy and enjoyable.
WebAssembly time travel debugger!
Tags: webassembly, node, typescript, react
Published: 2023-05-08 21:25:51

I've just updated the **interface** of my main project, a **WebAssembly 'Time Travel' debugger** (it has immutable states!) to Material UI https://mirkomassa.com .You should check it out!
![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/6ku217ox57lijbtg9k14.jpg)
![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/18apckf8qa8e4ex2tt5w.jpg)
![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/8sjjauat845dr0fszi86.jpg)
![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/wt9bnvraf7ebhf92lbe3.jpg)

Front-end source code: https://github.com/MirkoMassa/wasmmts-gui
Back-end source code: https://github.com/MirkoMassa/wasmmTS
Climbing the Ladder: Corporate Experience as a Stepping Stone
Tags: career, programming, productivity
Published: 2023-05-08 21:10:33

In the past, a wise mentor once told me that working in a corporation could provide invaluable experience before diving into entrepreneurship. Heeding this advice, I decided to spend some years in the corporate world before embarking on my own business venture. This decision turned out to be beneficial in numerous ways:

**Cost Awareness:** In a corporate setting, I learned the financial aspects of product development, from budgeting to managing resources. This experience enabled me to make informed decisions when it came to allocating funds for my own business.

**User Experience (UX) Focus:** I was exposed to the significance of user experience in product design and development. This insight helped me create products tailored to the needs and preferences of my target audience, ensuring their satisfaction.

**Networking with Professionals:** Working in a corporation allowed me to collaborate with and learn from seasoned professionals. Their guidance and expertise were invaluable resources that I could apply to my own entrepreneurial pursuits.

**Safe Environment for Experimentation:** With a stable job and income, I could explore side hustles and passion projects without the pressure of relying solely on their success. This environment allowed me to take risks, learn from failures, and refine my ideas without jeopardizing my financial stability.

**Time Investment:** While dedicating several years to working in a corporate environment may seem like a sacrifice, the experience I gained was invaluable. It equipped me with the necessary skills, knowledge, and network to confidently start my own business and navigate the world of entrepreneurship.

Looking back, I'm grateful for the time spent in the corporate world. The lessons learned have undoubtedly contributed to my success as an entrepreneur, and I believe this path has been worthwhile for me.

[But I made one step forward and I build a game that will incorporate all this experience and make it available for everyone.](https://devmanager.carrd.co/)
SOC2 Checklist
Tags: cybersecurity, security, learning, startup
Published: 2023-05-08 21:02:24


![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/kcmzcmrs9tw8sl7q68sk.png)




Embarking on the journey to become SOC 2 compliant can seem daunting, but it's an essential process for organizations that provide systems or services to user organizations. SOC 2 reports showcase an organization's commitment to securing their systems and services according to the AICPA's Trust Services Criteria (TSCs).

Contrary to popular belief, there isn't a one-size-fits-all checklist for SOC 2 compliance. Organizations must carefully consider which of the five TSCs – security, availability, processing integrity, confidentiality, and privacy – apply to them based on their services and user organizations' needs. Each organization must collaborate with their service auditor to create a tailored approach to satisfying the TSC requirements.

Before diving into the SOC 2 audit process, organizations must determine whether they require a Type I or Type II report. Type I reports focus on the design of controls at a specific point in time, while Type II reports cover a period of time and the operating effectiveness of controls. For first-time audits, Type I reports can be a quicker option.

When selecting a CPA firm to perform the audit, make sure they specialize in information security and have auditors with IT experience, such as CISAs or CISSPs. Costs can vary depending on factors such as the audit's scope, the number of TSCs included, and the organization's size.

A readiness assessment can help organizations prepare for the SOC 2 audit by identifying any gaps requiring remediation before starting the examination. These assessments may not follow a standard checklist, but they provide valuable insight into what the audit process will entail and allow organizations to address potential issues beforehand.

The timeframe for becoming SOC 2 compliant depends on various factors, including the type of report, available resources, and the readiness assessment results. Type I reports can be quicker, potentially taking just a few months, while Type II reports require the chosen period to elapse before issuing the report.

Maintaining SOC 2 compliance is an ongoing process. Organizations must be diligent in upholding their internal controls and continually monitoring and updating their policies and procedures. By collaborating with service auditors and leveraging compliance monitoring tools, organizations can ensure that their systems and services remain secure and compliant, instilling confidence in their user organizations and stakeholders.

Fore more, see this video from KPMG:
{% embed https://www.youtube.com/watch?v=vPmbzEKAHmM %}
Understanding PHP aliases
Tags: php, beginners, programming
Published: 2023-05-08 20:29:11

You might not know that PHP allows creating aliases in various ways.

## Why use class aliases?

`class_alias` is pretty straighforward:

```PHP
class MyClass {}
class_alias('MyClass', 'MyAlias');
$obj = new MyAlias();
```

[Source: PHP doc - class-alias](https://www.php.net/manual/en/function.class-alias.php)

You can use it to handle multiple versions of the same apps and manage deprecations.

If you maintain a library and want to modify the namespaces or refactor entire parts of the code, it can be nice to avoid bad breaking changes.

These are definitely not the only usages, but you might need it.

## `class_alias` vs. `use`

Imports are a bit different and rely on the `use` keyword:

```PHP
use MyClass as AnotherClassName;
use function myFunction as myFunctionAlias;
```

It works with various structures, like constants, functions, classes, interfaces, traits, enums and namespaces.

[Source: PHP doc - importing](https://www.php.net/manual/en/language.namespaces.importing.php#language.namespaces.importing)

It's a great feature that sometimes allows better readability and prevents bad collisions.

## Inbuilt aliases

Some PHP functions can be called with multiple names. Here is [the list](https://www.php.net/manual/en/aliases.php).

The main reason is backward compatibility, and the core team discourages similar usages in custom scripts, but it's sometimes necessary.

## The big caveat and a few warnings

Aliases can be convenient but should be used sparingly. Otherwise, it might create more problems than it solves (less readability, confusions).

If you are doing imports with the `use` keyword, be careful, especially if you include other files.

These files won't inherit the parent imports automagically, which could result in fatal errors if you try to call some utility you have imported in your parent script.

It's a typical issue you might struggle to solve, so be aware of that rule.

## Can we alias a variable?

Yes, and it's called a reference:

```PHP
$a = "freeze";
$b = &$a;
```

[Source: PHP doc - references explained](https://www.php.net/manual/en/language.references.php)

The `&` symbol is used to explicitly create such reference.

_N.B.: Note that, due to the way PHP stores objects in memory, it's not exacly the same for this particular type._
Dev Digest
Published: 2023-05-08 20:08:43

Ut wisi enim ad minim veniam, quis nostrud exerci tation ullamcorper suscipit lobortis nisl ut aliquip ex ea commodo consequat. Duis autem vel eum iriure dolor in hendrerit in vulputate velit esse molestie consequat, vel illum dolore eu feugiat nulla facilisis at vero eros et accumsan et iusto odio dignissim qui blandit praesent luptatum zzril delenit augue duis dolore te feugait nulla facilisi.
QRfy - Dynamic QR code generator
Published: 2023-05-08 20:05:59

With QRfy, you can generate custom QR codes with your favorite logo, frame, and colors. With your QR Code Generator, they'll be ready in just 5 minutes. You can create all kinds of QR codes, from a QR for your web page to a QR for your professional vCard, or upload a PDF or Video document. You can create as many QR codes as you need and forget about having to print a QR code again when you change the content because our QR codes are dynamic. What are you waiting for to try it?

[https://qrfy.com](https://qrfy.com)