teleren/devto huggingface dataset:
Como realizar uma análise dinâmica (DAST) com a Veracode em aplicações não publicadas?
Tags: dast, veracode, appsec, development
Published: 2023-06-23 21:56:35

E colaboração aos posts anteriores sobre análise dinâmica (DAST) 

* [O que é um DAST](https://dev.to/m3corp/o-que-e-dast-14d7)
* [Como fazer um DAST pelo Portal Veracode](https://dev.to/m3corp/como-fazer-um-dast-pelo-portal-11n4) 

Iremos entender nesse post, a importância de se utilizar o Internal Scanning Management [ISM] para realizar análises DAST em aplicações que estão fechadas para Internet.

---
#### ISM (Internal Scanning Management)

É um agente/endpoint que trabalha como uma espécie de Proxy Reverso dentro da rede da empresa. O objetivo dele é simplificar as análises DAST em aplicações que não estão publicados ainda, exemplo: ambientes de desenvolvimento e/ou homologação que não podem ser alcançáveis pela Internet.

Conforme a ilustração abaixo demonstra, o agente/endpoint estará rodando como um serviço dentro de um servidor interno que possui comunicação interna com as aplicações (Web ou API) e, realiza uma comunicação segura para Internet (porta 443) até seu Tenant na Veracode, permitindo que os scans sejam performados de forma segura.


![arquitetura ISM](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/mjymhwwwyzpetj6nbxq8.png)

---

#### Qual importância do uso do ISM?

1. Como boa prática, é recomendado realizar os testes de segurança "mais cedo possível", ou seja, em etapas antes da publicação para que os times tenham a possibilidade de saber antecipadamente se alguma vulnerabilidade crítica seja conhecida e corrigi-la antes que um atacante possa explorá-la. Geralmente os ambientes de desenvolvimento, homologação ou staging por exemplo, estão fechados para Internet o que impede que qualquer um fora da rede interna, onde as aplicações rodam, possam "enxergar" e realizar algum tipo de teste.

2. De modo geral, todo Web Scanner atua enviando requisições diretamente nas aplicações, com objetivo de simular as principais ações de um cyber criminoso. As aplicações recebem e processam certas requisições que podem não ser corretamente interpretadas e causar algum tipo de desfiguração.
O DAST da Veracode possui inteligência suficiente para enviar requisições de modo a não prejudicar a usabilidade das aplicações, mas, sempre há algum risco do alvo não processar corretamente as requisições.

---
#### Conclusão

Sempre que possível, utilize um endpoint/agent ISM para fazer as análises dinâmicas em ambientes não produtivos para que você possa ter maior segurança nos testes e principalmente conheça os riscos antecipadamente.
Day 769 : Canvas
Tags: hiphop, code, coding, lifelongdev
Published: 2023-06-23 21:46:52

_liner notes_:
- Professional : Logged into my computer to some messages about some changes to the new API I've been working on. These are different changes than what I ran into yesterday. So, I'm going to hold off on my updates until I get some more info from folks next week. Rest of the day, I refactored and cleaned up a demo application for a new feature and started working on a blog post for it.

- Personal : Bought some tracks on Bandcamp and put together my Tweets to post. Did some research on a possible update alternative to using HTML Canvas, but I don't think it'll be able to do what I need. Went through a section of the tutorial. Then I fell asleep.

![Look into a canyon in Fjaðrárgljúfur, Iceland with a river running through moss covered mountains](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/a8uqe8v7l9ezmso2ew2x.jpg)

Going to put together the playlist and get the artists' social media accounts stuff for the radio show tomorrow. I want to also finish up the HTML Canvas tutorial and start implementing it into my side project. Maybe end the night watching some anime.

Have a great night!

peace piece
Dwane / conshus
https://dwane.io / https://HIPHOPandCODE.com
{% youtube 4BmWtEc1aHg %}
Foreign Data Wrappers in PostgreSQL
Tags: apache, postgres, postgressql, bitnine
Published: 2023-06-23 21:44:26

In this article, we will discuss two of the most interesting and practical features in PostgreSQL. Namely, **Foreign Data Wrappers (FDW)** and **Parallel Query**.

A table that is located on a remote server in SQL is known as a _foreign table_. In PostgreSQL, the tool used to manage foreign tables using SQL are known as **Foreign Data Wrappers (FDW)**

The foreign table from the remote server can be accessed after installing the required extension and tweaking the appropriate settings. Furthermore, even join operations can be executed with foreign tables that are located in different servers which are like the local tables.

Here is a brief overview of how the **FDWs** perform:

- The analyzer generates a query tree from the input SQL.

- A connection to the remote server is made using the executor/planner.

-  In case the _use_remote_estimate_ option is turned on, which is switched of by default, the planner will execute the EXPLAIN command that helps the user by generating a cost estimate for each plan path.

- Next, the executor will transfer a plain text SQL statement to the remote server and will consequently receive the results.

- Lastly, the received data is processed by the executor if necessary. E.g. the executor will perform a join processing in case a multi-table query is executed.


There are also a number of useful multi-table operations in PostgreSQL that can be used to perform various functions.  Some of which are:

- **Sort operations:**
  Sort operations such as ORDER BY are processed on the local server. The local server fetches all the required rows from the remote server before the sort operation is executed. 

- **Aggregate functions:**
  Similar to sort operations, aggregate functions are also processed on the local server. Some examples of aggregate functions include: AVG() and COUNT(). The executor sends the relevant query to the remote server and then retrieves the relevant query results.
The Internals of PostgreSQL: Chapter 2: Process and Memory Architecture
Tags: bitnine, postgressql, summary, database
Published: 2023-06-23 21:21:39

This post summarizes Chapter 2 of the book "The Internals of PostgreSQL".
Postgre SQL is a relational database management system that works on client / server multi-process architecture. It consists of a single host, and various types of processes work together in postgreSQL to manage a database cluster.
The PostgreSQL server is a parent process that monitors the entire database cluster: It starts background processes, allocates shared memory, and awaits client connections. The server communicates on a specific network port (Default: 5432), and can run multiple instances on the same host by using different port numbers.
Postgres Processes are the backend processes spawned by the server. Their job is to handle incoming queries from clients that are connected. The communication between the client and process is done through a TCP connection, which eliminates as soon as the client disconnects. Every backend process operates on a single database, and the parameter "max_connections" determines the maximum number of concurrent client connections. The default value to it is 100.
Background processes handle various tasks such as Background writer, checkpointer, autovaccum, WAL Writer, and so on. All these functions are discussed in the upcoming chapters.
The memory architecture in PostgreSQL is simple: Local memory areas are allocated by each backend process, and a shared memory area is used by all processes of the postgreSQL server. In addition, PostgreSQL allocates memory for access control mechanisms, transaction processing, and other purposes. The details of both the local memory area and the shared memory area will be discussed in upcoming sections.
In a nutshell, PostgreSQL has a multi-process architecture: the server is the parent process, and backend processes handle client queries. It employs both local and shared memory areas to helo manage data and provide concurrency control.
How to host a static website with Azure storage Account
Tags: azure, storageaccount, staticwebsite, cloudcomputing
Published: 2023-06-23 20:57:58

#Prerequisite 
Install sublime text on your system
Download a static website template file with HTML code (e.g. CeeVee template)
#To Enable a Static Website in Azure 
Create an azure storage account in your azure portal
![Storage account](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/zuxhle4a88hetgmmo956.JPG)
Click on the static website on the storage account overview
![static website in azure](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/sjynx5k7i85c81ccn5bi.JPG)
Switch from disable to enable, Enter the index document name as Index.HTML and error document path as error.HTML and save
![Enable static website](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/nzje30mwkzzlsa66xrbk.JPG)
A container “$web” is automatically created and it is where the web page will be hosted
![azure container](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/czl1anxs3qjlb052w2vo.JPG)
#To edit the HTML File template 
Open the file template with the sublime text
Edit the file template to suit your specification and save.
![HTML File](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/r9ovnuvplxbrnjosp3v3.JPG)
Image of the edited file from the browser.
![CeeVee template](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/msfkkq2z6r6dn8ybq2xm.JPG)
#To upload the static website HTML file into the $web container  
Click on $web container created, click on upload on the top right hand tab to upload the edited file template and Click on upload
![Upload to the container](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/frczzuk8hvrb5o30woay.JPG)
The file is uploaded successfully.
![file uploaded to container](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/r8i521o2yuvfswckpbai.JPG)
The URL generated can be copied to the browser to view the uploaded file and also SAS can be Generated to grant limited access to the storage account for specific period of time.
![Generate SAS](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/vfxqoopwl3lf7ghye834.JPG)
RxJS Operators: auditTime
Tags: rxjs, javascript, typescript, webdev
Published: 2023-06-23 20:46:12

RxJS is a JavaScript library that enables the creation of asynchronous and event-based programs. The main type is the `Observable` and a suite of functions and operators are provided to make it easier to work with the data coming through. This series will detail those operators (and a few stand-alone functions) and provide examples of their use.

In this post, we’re going to cover the `auditTime` operator.

## What does it do?

The `auditTime` operator is similar to the `audit` operator. Rather than providing an observable to control the handling, we provide a time in milliseconds. When the time has elapsed the last emitted value will be sent through the pipeline.

## Example

```tsx
import { auditTime, interval } from 'rxjs';

interval(1000)
    .pipe(auditTime(5000))
    .subscribe(x => {
        console.log(x);
    });
```

We’re using `interval` to send a value through every second. We’ve configured `auditTime` to only allow a value every 5 seconds. So if we run this we’ll see:

```bash
4
9
14
19
24
```

It’s important to note here that `auditTime` won’t send out the last value *every* 5 seconds. The timer only starts when a new value comes in. We can demonstrate this behaviour with a change to the above example. Rather than using `interval` we’ll create our own subject and send a value out after 10 seconds.

```tsx
import { Subject, auditTime, interval } from 'rxjs';

const value$ = new Subject<string>();

value$
    .pipe(auditTime(5000))
    .subscribe(x => {
        console.log(x);
    });

setTimeout(() => value$.next('First Value'), 10000);
```

When we run this we will only see the value logged out after 15 seconds. Calling `value$.next('First Value')` gave the value to `auditTime` and started the timer running. Once the 5-second timer on `auditTime` completed it sent the last (and in this case only) value through the rest of the pipeline.

This behaviour makes this useful when dealing with high-throughput observables that don’t need every value handling. A good example of this is user input. If we’re using RxJS to listen for input into a text field, we don’t want to respond to every keypress as the user is typing. Using `auditTime` the first keypress will start the timer running and we’ll process the input at regular intervals as the user is still typing. 

The source code for this example is available on GitHub:
{% embed https://github.com/drownedintech/rxjs-operators %}
The 14th Day of the 100 Days of Code challenge
Published: 2023-06-23 16:34:26

Sadly, took an even longer break. Not a code-less break though, I had to do a lot of exams while working on the final Internet Development project at school, which I had to do two of because the teacher said my first project looked like I bought it off someone.

So, nothing but code. I've been coding the past few days for a couple of hours a day, but I didn't want to consider them as part of this challenge as for me this is about documenting my growth, and sadly, these days weren't all that productive even though there was a lot of coding.

Now is the summer break, so I wanna improve my sleep schedule while working on projects.

As for projects, I created an application that can book restaurant reservations over the phone, but I couldn't actually call anyone using Twilio because I couldn't get Twilio to stream the call to my application. When I do manage to do this though, it will only take about 4 lines of code to make it work when calling restaurants through Twilio.

Now I'm working on another project that's related to Whisper, since the majority of the latency in the restaurant reservation booking application is coming from the time it takes to transcribe what the other party in the call says.

As for the iOS projects, I plan to make them later on in the future. What I'm focusing on now is getting my hands dirty with AI.

That's about it,
happy coding and promise that there will be nothing but consistency coming!

The small project demo is available on Twitter!
#DEVDiscuss: What's the Future of Careers in Web Dev?
Tags: webdev, devdiscuss, career, ai
Published: 2023-06-23 20:00:00

Hey Devs, happy Friday 🦥💚

As always, it's been an eventful week in the tech industry. We've got a lot to talk about! And today I want to discuss **whether or not web devs should think about diversifying their skill sets** due to industry changes and advancements in AI.

I got this message in my inbox this week:

> Is this the right time to start developing a skill outside of web development? It seems like AI will be taking over web dev jobs soon.

This question reminded me of a post I read a few weeks ago from @codepo8 about how hard it's been to find work as a fronted dev — not specifically related to AI, but it's a similar concern:

{% embed https://dev.to/codepo8/the-ongoing-defence-of-frontend-as-a-full-time-job-3dp2 %}

So, what do you think? What's the future of careers in web dev? Share your thoughts in the comments and let's discuss!

---

_Want to submit a question for discussion, or even ask for advice? Visit [Sloan's Inbox](https://docs.google.com/forms/d/e/1FAIpQLSc6wgzJ1hh2OR4WsWlJN9WHUJ8jV4dFkRDF2TUP32urHSAsQg/viewform?usp=sf_link)! You can choose to remain anonymous._
Demystifying the Internals of PostgreSQL - Chapter 4
Tags: postgres, database, sql
Published: 2023-06-23 19:40:54

Welcome back to our journey into [The Internals of PostgreSQL](https://www.interdb.jp/pg/index.html).
In the last blog in this series, we covered Chapter 3 'Query Processing'.
Now we're going to cover [Chapter 4 'Foreign Data Wrappers and Parallel Query'](https://www.interdb.jp/pg/pgsql04.html). Let's jump right in.

## Foreign Data Wrappers (FDW)
SQL Management of External Data (SQL/MED) is a part of the SQL Standard that was added in 2003. It states that a table on a remote server is called a _foreign table_. PostgreSQL's Foreign Data Wrappers (FDW) use SQL/MED to manage these foreign tables.
Once you install the required extension and configure your settings appropriately, you can begin accessing foreign tables on remote servers. For example, you can use SELECT queries to access foreign tables  stored in different servers.
Many different FDW extensions have been developed and are listed in the Postgres wiki but the only properly maintained one is the postgres_fdw extension which has been officially developed and maintained by PostgreSQL Global Development Group.

To use the FDW feature, you will need to not only install the required extension but also execute setup commands like  CREATE FOREIGN TABLE, CREATE SERVER and CREATE USER MAPPING.
The work flow of the FDW feature in PostgreSQL is as follows:
1. The Analyzer creates a query tree for the given SQL query using the foreign tables definitions. These definitions are stored in the pg_catalog.pg_class and pg_catalog.pg_foreign_table catalogs.
2. The Planner or Executor then connects to the remote server using the appropriate library. For example, postgres_fdw uses libpq to connect to a remote PostgreSQL server, and mysql_fdw uses libmysqlclient to connect to a mysql server.
3. If the *use_remote_estimate* option has been enabled, EXPLAIN commands are executed by the Planner for cost estimation of each plan path. If not, the embedded constant values are used by default.
4. Planner creates a plain text SQL statement from the plan tree. This process is called _deparsing_ in PostgreSQL.
5. Executor sends the plain text SQL statement created by the Planner to the remote server and receives the result.

This section also details how the postgres_fdw extension performs and how it has evolved over the course of multiple versions of PostgreSQL starting with version 9.3. I highly recommend reading through it yourself to understand better as this section contains many examples which can help you better understand how different SQL operations and functions are handled by the FDW.

_This section also includes Parallel Query however it is currently under construction_
What have you been learning?
Tags: discuss
Published: 2023-06-23 18:49:10

---
title: What have you been learning?
published: true
tags: discuss
---

Hey guys, how are you? I hope you are doing great!

So, what was the last thing that you learned or what have you been learning?

By the way, I have been studied about Splunk (https://www.splunk.com)
Are you using the correct rest attributes?
Tags: csharp, webdev, rest, api
Published: 2023-06-23 18:43:55

Hello 👋,

Way back when in my early days of being a programmer, when working in full framework MVC, controller endpoints were just a means to an end. 

All the things were handled in house by our own systems so it wasn't necessarily crucial to provide the most accurate endpoints, just so long as the job got done we were all happy. 

That being said, everything was a [HttpGet] or an [HttpPost]. 

Needed data? Use a get.
Creating data? Use a post.
Updating? Post.
Delete? Post.

You get the picture. Gets and Posts everywhere all day long. 

But as I progressed in my career and curiosity I began to use other controller attributes such as Put and Delete. 

Not only did these help, at a glance, to see which method did what in spite of, good or bad, naming conventions; it also made consumption of these endpoints more understandable to front end engineers and external third parties. 

The added benefit of using these attributes is that no other targeted rest request type will be allowed to hit that endpoint.

That being said I think it's crucial to know these rest request attributes.

## Http Get
Attribute Usage: `[HttpGet]`
When To Use: When retrieving a collection of data, or a single item of data from some type of storage. 

## Http Post
Attribute Usage: `[HttpPost]`
When To Use: When creating a new item to be added to a stored data location.

## Http Patch
Attribute Usage: `[HttpPatch]`
When To Use: When you want to override or update parts of some existing data or object.

## Http Put
Attribute Usage: `[HttpPut]`
When To Use: When you want to completely override or change an entire piece of data or object.

## Http Delete
Attribute Usage: `[HttpDelete]`
When To Use: When you want to delete an object.

These may seem straight forward, but for me, Put vs Patch has always been one that I need to look up from time to time as they're used less often. 

I see misuse of these attributes (the biggest offender being Post to do all udpates, deletes, and creates.

And no, the world won't collapse if you use Get and Post over the other options but; we should all strive to build better together and in the evermore connected world, we must make our intentions as clear as we can with our tools. 

Thanks everyone!
What is Promise.all() in Typescript?
Tags: angular, typescript
Published: 2023-08-30 18:53:51

---
title: What is Promise.all() in Typescript?
published: true
date: 2023-06-23 18:30:00 UTC
tags: Angular,Typescript
canonical_url: http://www.codetolive.in//angular/typescript/What-is-promise-all-in-typescript/
---

The Promise.all() function accepts a collection of promises as input and returns an array of results when all of the provided Promises resolve, or rejected when any Promise is rejected. It is useful for aggregating all the promises and retrieving the results at the same time. It is typically useful when you want to load all the data at once before starting the desired functionality.

Promise.all() will reject any of the input promises immediately.

**_Code:_**

```
promiseall.component.ts:

import { Component, OnInit } from '@angular/core';

@Component({
  selector: 'app-promiseall',
  templateUrl: './promiseall.component.html',
  styleUrls: ['./promiseall.component.css']
})

export class PromiseallComponent implements OnInit {

  approach1: any[] = [];
  approach2: any[] = [];
  
  ngOnInit(){
    debugger
    this.executePromiseApproach1();
    this.executePromiseApproach2();
  }

  getCustomerData(customerId: Number) {
    return new Promise<Number>((resolve, reject) => {
      resolve(customerId);
    });
  }

  executePromiseApproach1(){
    let customDataPromises:Promise<any>[] = [];
  
    customDataPromises.push(this.getCustomerData(1));
    customDataPromises.push(this.getCustomerData(2));
    customDataPromises.push(this.getCustomerData(3));
    
    return Promise.all(customDataPromises).then((result: any[]) => {
      console.log(result);
      this.approach1 = result;
    });
  }
  
  executePromiseApproach2(){
    const promise1 = new Promise((resolve, reject) => {
      setTimeout(resolve, 1000, 'sample');
    });
    
    const promise2 = Promise.resolve(1000);
    const promise3 = 500;
    
    Promise.all([promise1, promise2, promise3]).then((result) => {
      console.log(result);
      this.approach2 = result;
    });
  }
}

promiseall.component.html:
<p>
    Promise.all() approach 1: {{approach1}}  
</p>
<p>
    Promise.all() approach 2: {{approach2}}  
</p>

```

**_Result:_**

- Promise.all() approach 1: 1,2,3
- Promise.all() approach 2: sample,1000,500

Download the above example source code from Github - [Download](https://github.com/negaboys/codetolive_angular_examples "Codetolive Angular examples")