teleren/devto huggingface dataset:
DeepCode’s Top Findings #2: Java/Python Hard-Coded Password
Tags: staticcodeanalysis, deepcode, python, java
Published: 2020-01-07 17:17:54

Hey,

**Language:** Java/Python
**Defect:** Password / Login (Category Security 2)
**Diagnose:** Hard-coded literals are used as parameters in functions known to be password protected

See an [example](https://www.deepcode.ai/app/gh/elastic/elasticsearch/27c24e238dd87c6e0669f63a8030b0f205c0b5e0/_/%2Fx-pack%2Fplugin%2Fcore%2Fsrc%2Fmain%2Fjava%2Forg%2Felasticsearch%2Flicense%2FCryptUtils.java/java%2Fdc%2FHardcodedSecret~javax.crypto.spec.PBEKeySpec/code/) in Java here.
**UPDATE (1/7/2020):** *CISCO* hard-coded credentials [here](https://nvd.nist.gov/vuln/detail/CVE-2019-15977) CVE-2019–15977 and [here](https://nvd.nist.gov/vuln/detail/CVE-2019-15975) CVE-2019–15975.

**Background:**
DeepCode learns from open source repositories. As an example, we know what are typical sources of passwords or secrets in applications. Typically, functions that read in from a protected configuration store. We trace the flow this data takes through open-source applications and are able to identify typical sinks or users of these secrets (e.g., database or API logins). After we identified these sinks, we can now enforce that no secret data results from a source that is not protected, such as a hard-coded constant in your source code.

Obviously, having your passwords hard-coded in your application is a bad practice. The Common Weakness Enumeration lists it twice: Both CWE 259 [Use of Hard-Coded Passwords](https://cwe.mitre.org/data/definitions/259.html) and CWE 798 [Use of Hard-Coded Credentials](https://cwe.mitre.org/data/definitions/798.html). OWASP also [lists it](https://www.owasp.org/index.php/Use_of_hard-coded_password).

Besides the risk of leaking password information to your dev team or anyone else having access to your source code, it makes it extremely hard to change the password for the operational side. I guess it is a no-brainer to not plaster secret keys into files they do not belong in. ‘nough said.

But there is another interesting aspect to this. We see quite some false positives with this bug. The reason is that it might be legitimate to use the functions with a hard-coded password in testing or when both systems interacting are trusting each other by default. Yes, we can have discussions now if this practice is legitimate or not. But, let us accept it for now. Obviously, false positives are something we would like to prevent as much as possible. So, what shall we do?

We decided on the strict side of things. We accept some false positives but rather report possible issues. If you want to prevent false positives, we offer two ways: (1) With the .dcignore file (see [here](https://medium.com/deepcode-ai/new-feature-visual-studio-code-extension-and-dcignore-676a55341acc) ) or (2) by adding a comment in your file (see [here](https://www.youtube.com/watch?v=sjDuDqUy7pw) ). Better safe than sorry. So, give it a run at [deepcode.ai](https://deepcode.ai) …

CU

0xff
What's your internal technical documentation like?
Tags: internaldocumentation, frontend, backend, documentation
Published: 2020-01-07 17:17:12

I am really interested in how engineering teams do their internal technical documentation especially frontend teams. Is there a particular structure or is it just READMEs?

The main focus here is seamless on-boarding of new team member(s).

E.g for backend team, our doc structure is typically:

- Overview (about the project, structure of the team etc)
- Getting Started (how to setup, environments quirks etc)
- Database (Info about the collections/tables, decisions behind designs, structure etc)
- Cloud Functions/APIs (Self explanatory)
- Best Practices (Testing, style guide)


So, what's it like at your workplace? Please share.

Thanks!
Headdress: Home Page by Karim coda
Tags: codepen, css, html, javascript
Published: 2020-01-07 17:15:31

<p>Headdress: Home Page by Karim coda 
I create this with HTML, CSS and some libraries as like :
-font awesome
-bootstrap
-normalize
adding nav bar smart with HTML, CSS and using some icons from font-awesome and using a beautiful font from font google.   </p>

{% codepen https://codepen.io/karim-coda/pen/ZEYKwdZ %}
OpenNMS Meridian 2019.1.2 (Earth) Released
Tags: releases, meridian
Published: 2020-01-13 17:46:05

---
title: OpenNMS Meridian 2019.1.2 (Earth) Released
published: true
date: 2020-01-07 17:13:55 UTC
tags: Releases, Meridian
canonical_url: https://opennms.discourse.group/t/opennms-meridian-2019-1-2-earth-released/938
cover_image: https://i.imgur.com/74fmzvG.png
---

Release 2019.1.2 is the third release in the Meridian 2019 series.

It contains a number of alarm classification bug fixes and performance improvements, flow enhancements, and more.

The [c](https://i.ytimg.com/vi/psiq5imRIj8/maxresdefault.jpg)odename for 2019.1.2 is *[Earth](https://en.wikipedia.org/wiki/Earth)*.

##### Bug

* possible issue in JCIFS Monitor - contiously increase of threads - finally heap dump (Issue [NMS-12407](http://issues.opennms.org/browse/NMS-12407))
* Wrong links in the Help/Support page (Issue [NMS-12418](http://issues.opennms.org/browse/NMS-12418))
* Classification Engine reload causes OOM when defining a bunch of rules (Issue [NMS-12429](http://issues.opennms.org/browse/NMS-12429))
* Cannot define a specific layer in topology app URL (Issue [NMS-12431](http://issues.opennms.org/browse/NMS-12431))
* Classification UI: Error responses are not shown properly (Issue [NMS-12432](http://issues.opennms.org/browse/NMS-12432))
* Classification Engine: The end of the range is excluded, which is not intuitive (Issue [NMS-12433](http://issues.opennms.org/browse/NMS-12433))
* Ticket-creating automations are incorrectly enabled by default (Issue [NMS-12439](http://issues.opennms.org/browse/NMS-12439))
* Enable downtime model-based node deletion to happen when unmanaged interfaces exist (Issue [NMS-12442](http://issues.opennms.org/browse/NMS-12442))
* Improve alarmd Drools engine performance by using STREAM mode (Issue [NMS-12455](http://issues.opennms.org/browse/NMS-12455))

##### Enhancement

* Refactoring of the Cassandra installation instructions (Issue [NMS-12397](http://issues.opennms.org/browse/NMS-12397))
* Allow telemetry flows to balance across Kafka partitions (Issue [NMS-12427](http://issues.opennms.org/browse/NMS-12427))
* Add system test for IpfixTcpParser (Issue [NMS-12434](http://issues.opennms.org/browse/NMS-12434))
* Associate exporter node using Observation Domain Id (Issue [NMS-12435](http://issues.opennms.org/browse/NMS-12435))
Fun with Homebrew casks
Tags: homebrew, cask
Published: 2020-01-07 03:31:58

---
title: Fun with Homebrew casks
tags: homebrew,cask
published: true
---

*This post was originally published at [nicholascloud.com](https://www.nicholascloud.com/2020/01/fun-with-homebrew-casks/).*

One of my favorite utilities for OSX is [Homebrew](https://brew.sh/), a package manager that lets you easily install programs from the terminal.

One of my favorite *pastimes* is thumbing through the [Homebrew Cask](https://github.com/Homebrew/homebrew-cask/tree/master/Casks) recipes to find new programs and utilities to install. Some are pretty nifty, like [Zotero](https://www.zotero.org/) which manages research bibliographies. Or [Electric Sheep](https://electricsheep.org/) which harnesses the power of your "sleeping" devices to crowdsource digital artwork. Or [Finicky](https://github.com/johnste/finicky), which lets you specify which of your web browsers you want to open specific links. (Maybe you use Brave for normal browsing but want to open all google.com links in Chrome.)

Unfortunately the Cask recipe files have no real descriptions, so I usually just fish through them and dig out the homepage links of any Cask recipe file that has an interesting name. It's kind of like a digital treasure hunt.

To make things even more fun, I cloned the `homebrew-cask` repo and came up with a simple shell script that will randomly choose a recipe and open its homepage for me.

```bash
find ~/projects/homebrew-cask/Casks -type f | \
shuf -n 1 | \
xargs cat | \
ack homepage | \
awk '{print $2}' | \
xargs open
```
To GIF or not to GIF?
Tags: blog, gif, ux, webdesign
Published: 2020-01-07 16:30:02

---
title: To GIF or not to GIF?
published: true
description: Should blog posts use GIF's?
tags: blog, GIF, ux, webdesign
cover_image: https://thepracticaldev.s3.amazonaws.com/i/ew0j0z5tw6qjxx6xtdu1.gif
---

Are GIF's really useful in blog posts?

Recently I've noticed that the use of GIF's in blog posts is increasing (also here, in DEV.to) but does this have sense?

GIF's are good for explaining things during tutorials or to show some animations, but adding memes GIF's to your blog post, just to divide the content, can be very painful for the readers. It isn't simple to read fast while something is moving on top and bottom of the paraghraph.

Also, it impacts in the page weight.

What do you think about GIF's abuse?
Semantic UI lists
Published: 2020-01-07 16:16:58

Hello everyone

I was just looking at available elements of the Semantic UI CSS framework and I noticed they use DIVs as list elements. [Link](https://semantic-ui.com/elements/list.html)

Does anyone know if there is a good reason for this instead of just using semantic UL element and styling it, especially given the framework's name? Am I missing something here?
Login Form Using Skeleton CSS
Tags: css, html, skeletoncss, ux
Published: 2020-01-07 16:13:12

What is Skeleton CSS?

Skeleton CSS is a lightweight CSS framework to design your web page using simple documentation. This is responsive CSS frameworks with a limited component like form, table, buttons, typography, grid and also basic and useful class. This is not a UI based framework, just for a smaller project and you have to write your own custom CSS with minimal features. 

In this Login Form, we used a simple grid class and utilities class to make this user-interface beautiful. Here we modify button classes to own color also we used media queries to make our element responsive and user-friendly. 

Make it yours now by using it, downloading it and please share it. we will design more elements for you.

Demo and download source code:-
https://w3hubs.com/login-form-using-skeleton-css/
OpenNMS Meridian 2018.1.15 (Cyclone) Released
Tags: releases, meridian
Published: 2020-01-13 17:45:03

---
title: OpenNMS Meridian 2018.1.15 (Cyclone) Released
published: true
date: 2020-01-07 16:10:10 UTC
tags: Releases, Meridian
canonical_url: https://opennms.discourse.group/t/opennms-meridian-2018-1-15-cyclone-released/937
cover_image: https://i.imgur.com/74fmzvG.png
---

Release 2018.1.15 is a tiny update containing a logging fix in Provisiond and an update to allow for choosing a layer when linking to the topology UI.

The codename for 2018.1.15 is _Cyclone_.

##### Bug

* Cannot define a specific layer in topology app URL (Issue [NMS-12431](http://issues.opennms.org/browse/NMS-12431))
A strategy for implementing test automation from scratch in a complex system
Tags: software, testing, cucumber, hardware
Published: 2020-01-07 15:56:06

In this article, I'll explore how test automation can be implemented in a complex hardware+software project, from scratch, in a team with low coding skills, by decomposing the problem in small chunks and starting with the basics.

https://www.sergiofreire.com/post/a-strategy-for-implementing-test-automation-from-scratch-in-a-complex-system
Why do you need to set limits for container resource usage?
Tags: docker, devops, system
Published: 2020-01-07 15:08:10

# Why do we need to set limits for container resource usage?

Enforcing resource limits is a critical best practice for running containers on a host or shared platforms like Kubernetes, Openshift...

If a container runs without a resource limitation, it may use all the resources available on the host, producing a disaster in production on a shared platform. This lack of deterministic resource usage could be a big problem for other applications on the host or container orchestrators. 

Setting resources limits will:
- prevent applications from consuming more than their expected resources on the host.
- provide autoscaling controllers critical information needed to add and remove instances of a containerized service based on resource usage.

Setting resources limits for a Docker container is not required by default.
However, every Docker container gets its own Cgroup by default in order to permit you to set resources limits.

Cgroups(Control groups) is a Linux kernel feature for managing and monitoring system resource like CPU, disk I/O, memory and bandwidth usage.
it provides: 

* Resource limiting: a group can be configured not to exceed a specified resource limit.
* Prioritization: one or more groups may be configured to utilize fewer or more CPUs or disk I/O throughput.
* Accounting: a group's resource usage is monitored and measured.
* Control: groups of processes can be frozen or stopped and restarted.

Cgroups partition those resources into groups then assigning tasks to those groups.

## Conclusion:
Providing a stable product in production is a journey, in this brief article we learned the importance of limiting resources usage, the big challenges are to determine the container requirement resources and to configure containerized application runtimes ( e.g: JDK) to stick to the configured resources limits.
Daily Challenge #155 - Royal Arranged Marriages
Tags: challenge
Published: 2020-01-07 14:41:59

---
title: Daily Challenge #155 - Royal Arranged Marriages
published: true
series: Daily Challenge
description: Be the royal matchmaker and arrange marriages for the nobility. 
tags: challenge
---
###Setup
In some fictitious land, there are `n` queens and `n` kings. These members of royalty are single and looking for a heterosexual relationship. 

As the Royal Matchmaker, your job is to pair the nobility with each other. At a ball, each of these individuals have met each other and intermingled. Each queen made a list of their favorite kings, and the kings did the same for their favorite queens. 

Write a function that will arrange marriages according to the romantic preference of these queens and kings. You will receive an `n * m` matrix of integers `queens`, encoding the list of preferences for each queen. A similar matrix `kings` with their preferences. An array of `n` integer with a stable arrangement of marriages. On the `i`-th position of the array should be the number of the king that should marry the `i`-th queen.

These marriages *must* be stable. Infidelity would threaten the well being of the country (and your job). A marriage between two individuals is stable as long as:
- Neither of the two are involved in another marriage. 
- There is no other mutually preferred match. 

###Example
The royalty have made lists that look like this: 
Queen 0: [King 1, King 0, King 2]
Queen 1: [King 2, King 1, King 0]
Queen 2: [King 0, King 2, King 1]

King 0: [Queen 1, Queen 0, Queen 2]
King 1: [Queen 2, Queen 1, Queen 0]
King 2: [Queen 0, Queen 2, Queen 1]

These lists would be converted to matrices that look like this:
<pre>
int[][] queens = { {0,1,2},
                {1,2,0},
                {2,0,1} };

int[][] kings = { {0,1,2},
                {1,2,0},
                {2,0,1} };
solution: {0, 1, 2}
</pre>

###Tests
<pre>
int[][] queens = { {1,0,2},
		{2,1,0},
		{0,2,1} };

int[][] kings = { {1,0,2},
		{2,1,0},
		{0,2,1} };
</pre>

Good luck!
***
_This [challenge](https://www.codewars.com/kata/5a7b83645084d7567d0000e3) comes from NotTuringComputableError on CodeWars. Thank you to [CodeWars](<https://codewars.com/>), who has licensed redistribution of this challenge under the [2-Clause BSD License](<https://opensource.org/licenses/BSD-2-Clause>)!_

_Want to propose a challenge idea for a future post?  Email **yo+challenge@dev.to** with your suggestions!_
Which is Your Best React UI Component Library / Framework for 2020 ?
Tags: react, reactnative, javascript, design
Published: 2020-01-07 14:41:02

Mention them in comment Section Below :stuck_out_tongue_winking_eye: :arrow_down::arrow_down::arrow_down::arrow_down:

![Alt Text](https://thepracticaldev.s3.amazonaws.com/i/kzdhora9dzo7fweyqw3v.png)
Tip 5: Replacing ls with exa
Tags: linux, dotfiles, rust
Published: 2020-01-07 13:25:53

Rust ... slowly but surely, all applications are being rewritten in Rust.

My next few tips will cover a few of these :)

## Exa

[Exa](https://github.com/ogham/exa) is an `ls` replacement written in Rust. As they say in their `README`:

> with more features and better defaults

What does it look like?

![Output from Exa](https://thepracticaldev.s3.amazonaws.com/i/wpyyb12l52k2781dfb9k.png)

![Alt Text](https://thepracticaldev.s3.amazonaws.com/i/wnscoi85yr3f8zbbduby.png)

Pretty shiny, eh?

Things worth noting:

1. Colours that distinguish directories, files, and executable files
2. Colours for permissions, owners, and size of file
3. Git status of each file in long output

### Trees Everywhere

When working with code, it can be pretty nice to get a `tree` style look at the repository. Exa surpasses expectations here too.

First, here are a few aliases I have configured:

```shell
# ls
TREE_IGNORE="cache|log|logs|node_modules|vendor"

alias ls=' exa --group-directories-first'
alias la=' ls -a'
alias ll=' ls --git -l'
alias lt=' ls --tree -D -L 2 -I ${TREE_IGNORE}'
alias ltt=' ls --tree -D -L 3 -I ${TREE_IGNORE}'
alias lttt=' ls --tree -D -L 4 -I ${TREE_IGNORE}'
alias ltttt=' ls --tree -D -L 5 -I ${TREE_IGNORE}'
```

Let me explain:

- `--tree` - Enables Tree display
- `-D` - Show directories only (Useful for large trees)
- `-L n` - How many levels deep to display
- `-I ${TREE_IGNORE}` - This omits/hides common vendor directories, as defined in the variable above the aliases


Here's a short `asciinema` of me using the `lt`, `ltt`, and `lttt` aliases:

{% asciinema 292221 %}
Rubber Ducks: Do they even Work? 
Tags: friendlydebate, discuss, watercooler, productivity
Published: 2020-01-07 13:06:43

I replied to a [comment](https://dev.to/s_aitchison/comment/j3ge) on [Ben Halpern's post](https://dev.to/ben/what-s-the-best-thing-to-do-when-you-ve-run-into-a-debugging-dead-end-39jg/comments) on getting out of debugging ruts and it got me thinking about how I've always had more success talking to a real person over an inanimate object.

I know talking to rubber ducks is a often recommended way to talk through problems by yourself. But I feel like it lacks some pizazz that makes it useful for me. 

To all you dev folks out there, has a rubber ducking worked for you, or was talking to a person significantly better?
How to download and install Node.js
Published: 2020-01-07 13:06:35

Installing Node.js is a very easy but lengthy procedure.

First visit the website : Node.js . See, by default as my PC has Windows 8.1 and it has 64 bit architecture so I can download from here.
Major Node. js versions enter Current release status for six months, which helps library authors time to contribute. LTS release status is "long-term support", which generally guarantees that bugs will be fixed for a total of 30 months.

But if you want to download some other binary files of node.js, click on the "DOWNLOADS" tab, from the top navigation bar of the website. As you can see, you have plenty of options and OS types to download for. For me, I have downloaded the Windows Installer(.msi) 64-bit architecture.

If you are interested to download Node.js and install Node.js error free, visit my blog and read : <a href="https://learnnodeonline.blogspot.com/2020/01/how-to-download-node.js.html">How to download node.js and configure your PC</a>

Here I have explained everything step by step with pictures., from visiting the official website up to testing if the installation is error free. I hope the beginners will love it.
$ cli --tools --for all-the-things
Tags: node, javascript, cli, nodejsinteractive
Published: 2020-01-07 13:05:37

---
title: $ cli --tools --for all-the-things
published: true
description: My cli talk at Node+JS Interactive 2019 is up on Youtube 
tags: node, javascript, cli, NodeJSInteractive
cover_image: https://thepracticaldev.s3.amazonaws.com/i/fg4m9ohlqu86dljaj060.jpg
---

Turns out my talk at **Node JS Interactive 2019** was not a completely failure! :tada: yay! :tada:

So as a reward I get to have a decent Youtube video of me presenting at a major conference that I can actually share with the world! :heart: Are you interested in the intersection of **cli** + **JavaScript** + **Node.js**? Or just a friend that wants to see me nervously trying to live code stuff in front of a big crowd? In any case here is the video, enjoy it :smile:

{% youtube E0Oz5s9ZjKY %}

PS: Slides are available on **SpeakerDeck**, you can browse them here:

{% speakerdeck ebe1bf123a98442c8feb4d577aa8bb20 %}

---

### Links

Here are the original links for reference:

- Youtube video: https://youtu.be/E0Oz5s9ZjKY
- Slides: https://speakerdeck.com/ruyadorno/cli-tools-for-all-the-things
- Conference website: https://njsi2019.sched.com/event/T5HY/cli-tools-for-all-the-things-ruy-adorno-npm
A few tips for building better APIs
Tags: todayilearned, api, testing, design
Published: 2020-01-07 13:00:14

*TL;DR notes from articles I read today.*

### [API practices if you hate your customers](http://bit.ly/3698OdR)

![](https://thepracticaldev.s3.amazonaws.com/i/khc5doziygox89b0jkwb.png)

*[Full post here](http://bit.ly/3698OdR), 16 mins read*

---

### [Common API mistakes and how to avoid them](http://bit.ly/39j0HNT)

Covering the “how to avoid” part here 
- Be stingy with data you are sending through your APIs. Figure out what’s the absolute minimum amount of data that satisfies the requirements you are trying to meet. 
- Represent upstream data internally as a Domain Object. You can both circumvent some bugs and provide a more consistent API by doing this. 
- Try to name attributes of objects in your API responses in such a way that they can be forward compatible with any future updates. 
- Apply Robustness Principle: “Be conservative in what you do, be liberal in what you accept from others.” Ensure all the API responses follow conventions and best practices but be accepting of inconsistent forms of requests (whenever you can) and normalize them into a consistent format at your end. 

*[Full post here](http://bit.ly/39j0HNT), 15 mins read*

---

### [Continuous testing of APIs](http://bit.ly/2tcjrxS)

- 3 steps for having your APIs tested continuously: Write good test collection. Run tests on schedule and on-demand. Look at analytics & set up smart alerts. 
- You should be running contract tests, integration tests and end-to-end tests in your build system on demand - when code changes happen or code merges happen.
- You should have some scheduled tests run regularly. These are the ones for API health checks, DNS checks, security checks, and any infrastructure related checks. 
- For complete test coverage of your APIs, you will need both scheduled and on-demand tests. 
- Analytics from data generated from these tests will give you a view of system health, performance, stability, resiliency, quality and agility over time. Use it to find underlying problems and set up effective alerts. 

*[Full post here](http://bit.ly/2tcjrxS), 7 mins read*

---

*[Get these notes directly in your inbox every weekday by signing up for my newsletter, in.snippets().](https://mailchi.mp/appsmith/insnippets?utm_source=devto&utm_medium=post08&utm_campaign=is)*