teleren/devto huggingface dataset:
Somebody Else's Python
Tags: security, python
Published: 2020-02-26 21:43:24

---
title: Somebody Else's Python
published: true
description: Open source dependencies, security vulnerabilities, and you
tags: security, python
cover_image: https://snyk.io/wp-content/uploads/Python.png
---
_How do you manage your open source dependencies?_

<hr>

Confession - I love Douglas Adams' _Hitchhiker's Guide to the Galaxy_. It is zany and weird and sometimes (often?) really insightful about human nature. A classic example of this is his creation of the _Somebody Else's Problem Field_, a cloaking device of the highest caliber described as follows:

> An SEP is something we can't see, or don't see, or our brain doesn't let us see, because we think that it's somebody else's problem.... The brain just edits it out, it's like a blind spot. If you look at it directly you won't see it unless you know precisely what it is. Your only hope is to catch it by surprise out of the corner of your eye.

Continuing a bit later, 

> The Somebody Else's Problem field is simple and effective, and what's more can be run for over a hundred years on a single torch (flashlight) battery. This is because it relies on people's natural disposition not to see anything they don't want to, weren't expecting, or can't explain. 

Paraphrased from Douglas Adams' _Life, the Universe, and Everything_

So where might SEPs be lurking? Well, as a developer who uses and loves Python, I would like to suggest that Somebody Else's Problems might just be lurking in Somebody Else's Python. 

## Somebody Else's Python

You are more likely to know Somebody Else's Python as your open source dependencies. Don't get me wrong, open source is fantastic. It is the building blocks of many of our projects (both personal and professional) and of many of our communities. Open source is amazing!

Open source is amazing, but it should be used with consideration. If open source projects are in your production environments, you have to take responsibility for that code. It may be Someone Else's Python, but you have effectively cosigned a loan with it. You now share in any security issues in the software, known and unknown. It can be a bit sobering, and it can be hard to know what to do about it. 

## Fixing Vulnerabilities

The above risk vs. rewards calculation is one of the reasons that I really enjoy my work with [Snyk](https://snyk.io). Snyk helps developers find and fix vulnerabilities in their open source software. I came into the company as one of a handful of Python enthusiasts, liking the product, and hoping/advocating for increased support for the community. 

Today we were excited to announce support for fix pull requests. You can read more about it [here](https://snyk.io/blog/automating-remediation-for-vulnerabilities-in-python-dependencies-using-snyk/). It is my hope that this functionality can help pythonistas confidently and securely use open source software. 

Want to try it for yourself? Snyk has a [free tier](https://app.snyk.io/)!

You may be working with Somebody Else's Python, but known security issues can be fixed and no longer be problems at all.
Language Detection using ColdFusion/Java
Tags: coldfusion, java, i18n
Published: 2020-02-26 21:41:45

In the past, I've used character ranges in an attempt to identify the language of text. While this seemed to work for Russian, Chinese, Japanese, Turkish, Greek, Hebrew, Korean & Arabic, it was pretty useless when it came to Latin languages like French, German & Spanish.

Today, a question was asked on [StackOverflow](https://stackoverflow.com/q/60409179/693068):

> How can I identify the sentence having other languages like Spanish?

Someone recommended [polyglot](https://github.com/aboSamoor/polyglot) and [PYCLD2](https://pypi.org/project/pycld2/) python libraries and this started me on my quest for a Java solution.  I found [Apache OpenNLP](http://opennlp.apache.org/), but it seemed overkill as I was only needed language detection.  [Lingua](https://github.com/pemistahl/lingua) looked promising, but the library was 30mb and integration didn't seem very easy.  On the Lingua page, the [Optimaize Language Detector](https://github.com/optimaize/language-detector) Java library was referenced.  There was also a tag cloud at the top of the page and "language-detection" was listed.  I followed it and filtered the language to "java" and received [23 public repositories](https://github.com/topics/language-detection?l=java).  The [kju2 language-detector](https://github.com/kju2/language-detector) library is a fork of Optimaize, seemed more ColdFusion-friendly in terms of integration & usage and the [pre-compiled JAR file](https://mvnrepository.com/artifact/io.github.kju2.languagedetector/language-detector) is only 1.2mb (versus 131mb for Lingua).

## Installation

Copy the JAR file to your JAVA path.

## Usage

Instantiate the languageDetector.cfc component.

```js
var languageDetector = new languageDetector();
```

### languageDetector.detect(text)

Returns a text string with the language detected.

```js
languageDetector("Quel est votre nom?")          // CATALAN (French?)
languageDetector("Wie heißen Sie?")              // GERMAN
languageDetector("¿Cuál es tu nombre?")          // SPANISH
languageDetector("Πως σε λένε?")                 // GREEK    
languageDetector("آپ کا نام کیا ہے؟ ")          // URDU
languageDetector("Как Вас зовут?")               // BELARUSIAN (Russian)
languageDetector("คุณชื่ออะไร?")                    // THAI
```

## Source

Download it from [Github](https://github.com/JamoCA/cf-language-detector).

{% github JamoCA/cf-language-detector %}
Where to learn GraphQL?
Tags: graphql, help
Published: 2020-02-26 20:52:03

---
title: Where to learn GraphQL?
published: true
description: 
tags: graphql, help
---

I currently have a blog built with Gridsome and have been playing about with using gatsby for an idea I had rather than my original plan of wordpress, but both of these use graphql which I know nothing about.

I've tried reading the docs but I don't understand most of it. Does anyone have any suggestions where to start with the real basics?
Atlanta Tech Meetup’s Selfless Act Exemplifies Community
Tags: devrel, community, devnexus, jfrog
Published: 2020-02-26 20:49:06

Atlanta Tech Meetup’s Selfless Act Exemplifies Community

Which is a better JavaScript or Java? Well, when the chips were down, and an anticipated conference, ngAtlanta, was canceled for both paid attendees and sponsors, the answer to that question really did not matter. What did matter was the actions the Atlanta Java Users Group (AJUG) took to ensure the ngAtlanta community were taken care of in their time of need.

If you think putting on a successful conference is easy, think again.  It takes a lot of experience and know-how, and even then, a wrong decision can be costly enough to tank the whole event.  The leaders of AJUG, [Vincent Meyers](https://twitter.com/vincentmayers) and [Pratik Patel](https://twitter.com/prpatel), have learned through many years of experience (and bumps and bruises along the way) how a disappointment like this can impact the morale and confidence in the tech community.

Perhaps this is why when I commended Vincent on their heroic actions he humbly and simply stated, “we could do it, so we did”.

Every year, AJUG puts on Devnexus, the largest independent software development conference in the country.  This year, with the Georgia World Conference Center (GWCC) as their venue, 2400+ attendees as well as scores of sponsors, gathered in Atlanta.  With only 2 weeks to spare, Vincent and Pratik heard the disappointing news, ngAtlanta was canceled, and those attendees and sponsors who had paid were “out of luck” as no refunds were being offered.

The AJUG and Devnexus team swiftly jumped into action. With the help of [Angel Banks](https://twitter.com/angelmbanks), an Atlanta tech community hero who is a director of the [Atlanta Women Who Code](https://www.womenwhocode.com/atlanta) chapter and organizer of [Refactr.Tech](https://twitter.com/RefactrTech) an Atlanta tech conference with a focus on diversity and inclusion, they contacted paid attendees, sponsors and speakers scheduled to participate in ngAtlanta. They used their venue at the GWCC to put on a conference-within-a-conference for the ngAtlanta community which included meeting space, audio/video equipment, parking, food, parties, raffles, and swag.  Oh yeah, they also made all Devnexus conference sessions, and an extra conference day available those who had already paid to go to ngAtlanta.   

This year, I was honored to be part of a technical conference that not only exceeded the expectations of those who attended but also took swift action to unify the community.  

<i>[Ari Waller](https://www.linkedin.com/in/ariwaller/) is the Meetup Event Manager for JFrog.  [JFrog](www.jfrog.com), the Liquid Software Company, is a proud sponsor of the [Devnexus](www.devnexus.com) and the [Atlanta Java User Group](www.ajug.org)</i>

Picture:https://ya-webdesign.com/explore/community-transparent-background-design/
Securing gRPC-based Microservices in .NET Core
Tags: dotnet, grpc, microservices
Published: 2020-02-26 20:48:18

---
title: Securing gRPC-based Microservices in .NET Core
published: true
description: Learn how to add authentication and authorization to gRPC for microservices in .NET Core.
tags: #dotnet #grpc #microservices
canonical_url: https://auth0.com/blog/securing-grpc-microservices-dotnet-core/
---
TL;DR: This tutorial will show you how to integrate authentication and authorization in a .NET Core microservice scenario based on gRPC. You will go through the process of protecting the server endpoints and will learn how to authorize a gRPC client to make requests to it. 

The gRPC Framework
Lately, gRPC is becoming quite popular since it allows you to build high performance distributed systems. Initially designed by Google to optimize communication within their internal service infrastructure, it is now an open-source project available for most common programming languages: from Java to Python, to PHP, to C#. In a nutshell, gRPC is a Remote Procedure Call framework (RPC framework) based on the HTTP/2 protocol to transport binary messages and on the Protocol Buffers, also known as Protobuf, to define service contracts. A mandatory requirement for a gRPC service is to accept only secure gRPC connections, such as TLS connections.

Starting from .NET Core 3.0, Microsoft supports gRPC natively, so .NET Core developers can leverage this framework to build efficient microservices. The tutorial Implementing Microservices with gRPC and .NET Core 3.0 introduces you to the basics of using this framework with .NET Core. It shows you how to create a simple microservice that evaluates whether a customer is entitled to receive credit for a given amount and a client that makes requests to it.

In this tutorial, you will take that project and will secure the communication between the client and the server by using Auth0.

[Read on 📖](https://auth0.com/blog/securing-grpc-microservices-dotnet-core/?utm_source=dev&utm_medium=sc&utm_campaign=securing_grpc)
Method overload in JS?
Tags: eslint, javascript, overload
Published: 2020-02-26 20:42:21

![Mind Blown!](https://media.giphy.com/media/SDogLD4FOZMM8/giphy.gif)

In this linting series, we've now stumbled across the fabled function override bug. 

```js
this.getReportData = function(type, reportname, id) { ... };
// 100 lines later
this.getReportData = function(name, id, year, month) { ... };
```
Now, what happens is that only the last function is defined as getReportData because there is no such thing as method overload in javascript, like in C#. So... my task was set to linting, not refactoring an entire component. So what I had to do, was just get past this, because doing smoke testing, I just can't ignore this and keep on trucking as if I hadn't seen it. 


###"This isn't right"
So just to get on with it, I had to implement something that doesn't feel right. What it does is it turns a function into something that can return different types of objects. Now ESLint won't catch this, because it cannot analyze the full code flow, so it won't know this. It didn't even catch the function override, because it wasn't a named function, but a variable being overriden which is allowed in JS. And some dynamic scripts being loaded by JSONP rely on being able to override functions in a parent scope or otherwise.

Now... to make a function overload, I had to make a new function, that took any number of parameters. Which btw, all functions in javascript do, just that you get named parameters if you define them in the function parameter declaration. 

###"Overload! Overload!"
Now below "solution"/code could have been written as function(arg1, arg2, arg3, arg4) but... I just wanted to simplify it for myself and just do function().

The second part of this, is of course to create something we call a technical-debt task. So that it's not forgotten and can be fixed later if not fixed through organic growth later on. The code/component should be refactored to use the two NEW function definitions instead of the single getReportData.

So to the "solution"....

```js
this.getReportData = function() {
  var firstParam = arguments[0];
  var typeParams = ["dashboard","list","details"];
  if(typeParams.indexOf(firstParam.toLowerCase()) > -1) {
    self.getReportDataByType(arguments[0], arguments[1], arguments[2]);
  } else {
    self.getReportDataByNameId(arguments[0], arguments[1], arguments[2], arguments[3]);
  }
};
this.getReportDataByType = function(type, reportname, id) { ... };
this.getReportDataByNameId = function(name, id, year, month) { ... };
```

So now we have getReportData function simulating "method overloading" and I didn't have to dig into the dependent components and refactor it and try to ensure that it's all still working and not missed some reference somewhere.

Now I just need to load up JIRA and create the TD task. Wish me luck.
Live CSS scratchpad & file editor + Less / Sass and ...
Tags: css, webdev, showdev, beginners
Published: 2020-02-26 19:49:33

- Do you hate switching between your code editor and browser while writing CSS code?
- Do you hate to refresh webpage when you are making changes in CSS files?
- Do you hate editing CSS in browser DevTools because they reduce the viewport size on your laptop?
- Do you wish for an easier way to identify appropriate CSS selectors?
- Do you wish you could write Less / Sass code while editing and debugging in browser?

If these situations sound familiar to you, read on for a minute to find a fine solution.

In recent years, the browser DevTools have improved a lot in terms of developer experience for CSS development. But, there are still some gaps which need to be filled.

Presenting you with a popular browser extension which has been solving the above mentioned issues along with many other features for thousands of web developers across browsers: **Live editor for CSS, Less & Sass - Magic CSS** (https://chrome.google.com/webstore/detail/live-editor-for-css-less/ifhikkcafabcgolfjegfcgloomalapol)

The extension takes a simple, but powerful approach of providing an in-page code editor which is draggable and resizable. Whatever code you write, gets applied immediately and it is saved in your browser for later reuse.

Some of the features worth mentioning:
- Ability to use it as a scratchpad for CSS / Less / Sass code which gets applied as soon as you type it
- Ability to edit files on your filesystem and instant refresh of the relevant CSS files via live-css server, which can be installed and started by executing 2 simple commands in your terminal
- Auto-save the changes as you type
- Highlight and count the elements matching the CSS selector
- Generate the CSS selector of any element via point-and-click tool
- While the core purpose of the tool is to assist in web development, you can use it to modify the styles of any website
- No permissions required by the extension for its core functionality
- Helpful for beginners to try out Less / Sass code without any setup

More details and the source code of the extension are available at: https://github.com/webextensions/live-css-editor

The extension is available for the following browsers:
- [Google Chrome](https://chrome.google.com/webstore/detail/live-editor-for-css-less/ifhikkcafabcgolfjegfcgloomalapol)
- [Mozilla Firefox](https://addons.mozilla.org/en-US/firefox/addon/live-editor-for-css-and-less/)
- [Opera](https://addons.opera.com/en/extensions/details/live-editor-for-css-and-less-magic-css/)
- Microsoft Edge ([old](https://www.microsoft.com/en-us/p/live-editor-for-css-and-less-magic-css/9nzmvhmw5md1) / [new](https://chrome.google.com/webstore/detail/live-editor-for-css-less/ifhikkcafabcgolfjegfcgloomalapol))

Google Chrome has better API support for browser extensions and faster publishing process, hence you would find the full featured version on that before the features become available on the other browsers.

Cheers :-)
The safest way to download a private repository
Tags: todayilearned, git, github, security
Published: 2020-02-26 19:46:15

# Introduction 🕵🏻‍♀️🕵🏻
I'm writing a script to easily download a code stored in a private repository from the command line.
Many solutions to this was exposing credentials in the command line, personally, I didn't want to put my password into my script to accomplish this.

#### If you're the type to live dangerously and don't care about security, use the following:
```bash
curl --digest --user <username>:<password> https://bitbucket.org/<username>/<repository>/get/<branchname>.zip -o <branchname>.zip
```
![](https://media3.giphy.com/media/kYkQYXkO3XyRa/giphy.gif?cid=790b761106fe7c83932229bb2ad231b78f7163400ffe0fd6&rid=giphy.gif)

#### But if you're like me and care about the security of your applications, let's get down to business 

# Set up an SSH key 👩‍🔧 👨‍🔧
The first step is create private and public keys, I won't go into the details of how to do this, as we have the tutorials on github and bitbucket extramement explicit and clear on how to do this in the best way:
 - [Github tutorial](https://help.github.com/en/github/authenticating-to-github/connecting-to-github-with-ssh) 
 - [Bitbucket tutorial](https://confluence.atlassian.com/bitbucket/set-up-an-ssh-key-728138079.html) 

# The magic command 🧙‍♂️🧙‍♀️
I'll assume that you already have your keys configured, so just run the command below:
```bash
git archive --remote=ssh://git@bitbucket_or_github.org/your_username/your_repository.git --format=zip --output="zip_file.zip" desired_branch
```
![](https://media3.giphy.com/media/12NUbkX6p4xOO4/giphy.gif?cid=790b76111769f78817a93341eddfb22ced9cae983f28043b&rid=giphy.gif)
Hold On A Second There, Partner
Tags: git, reporting
Published: 2020-02-27 22:18:34

---
title: Hold On A Second There, Partner
published: true
date: 2020-02-26 18:13:00 UTC
tags: git,reporting
canonical_url: https://thjones2.blogspot.com/2020/02/hold-on-second-there-partner.html
---

One of the devs on  project many of us work on was excited to announce that we'd topped 2000 commits on the project. I'm a pedant. I know that we configure our projects with a lot of "administrativa" bots, so I wanted to look harder at the numbers. What I found was:  
  
**The raw number of commits was:**

> ```
> $ git shortlog -s -n | awk '{ sum += $1 } END { print sum }'
> 2008
> ```

  
**Total minus bot-commits:**  

> ```
> $ git shortlog -s -n | grep -v bot | awk '{ sum += $1 } END { print sum }'
> 1476
> ```

  
**Total minus bot- and merge-commits:**  

> ```
> $ git shortlog -s -n --no-merges | grep -v bot | awk '{ sum += $1 } END { print sum }'
> 752
> ```

  
I wasn't trying to rain on his parade, but it is kind of cool that you can break things out that way and see just how much of your project's activity is "administrativa" type of actions.  
  
Also, removing the filtering/counting pipelines gives you a nice output of who's contributed and how much (though "how much" is only in commits ...which, in our case, are generally squashed when merging back from an individual developer's fork).
The "best" web framework?
Tags: webdev, framework, javascript, discuss
Published: 2020-02-26 19:36:48

_What is the best web framework to learn?_

This is a common question among people just starting out in the field of web development. As a beginner, it is easy to assume that there is probably one major framework that everyone uses. Learning this framework would be enough to quickly land you a job, right?

![Well yes, but actually no](https://media.giphy.com/media/SVgKToBLI6S6DUye1Y/giphy.gif)

In my opinion, there is no "best" web framework. Only one that is best for  the given requirements and constraints. 

What do you think?
Jquery - JavaScript Series - Part 30
Tags: javascript, tutorial, webdev, codenewbie
Published: 2020-02-26 19:36:41

jQuery is a fast, small, and feature-rich JavaScript library. This helps to write js codes easily. This saves a ton of time.

![Alt Text](https://dev-to-uploads.s3.amazonaws.com/i/94lx9fj0f1bozr8p6gkl.png)

But people don't use it on new projects because there are more better library & you can do the same thing using vanila js. Check this out - http://youmightnotneedjquery.com/ 

![Alt Text](https://dev-to-uploads.s3.amazonaws.com/i/f1gzytclg09w6a4mfu6l.png)

But jQuery saves a ton of time before and helped to write better javascript. So there are many projects which use jQuery. To understand those project you should learn it. 

![Alt Text](https://dev-to-uploads.s3.amazonaws.com/i/56p9x98ib0zkpa1wvlc2.png)

jQuery has lots of plugins which can help you to do things easier (use img 4)
Bootstrap still using the jQuery

![Alt Text](https://dev-to-uploads.s3.amazonaws.com/i/fa54qgsgqxp25ufriomb.png)

jQuery is really lightweight and it's also hosted in google so you can use cdn in your project very easily 

![Alt Text](https://dev-to-uploads.s3.amazonaws.com/i/gf38ialb4ndd5z2c0lag.png)

Easy JavaScript for Designers 

![Alt Text](https://dev-to-uploads.s3.amazonaws.com/i/af18ykvo061c2pmna0tw.png)

It will be better if you start with other js library/frameworks instead of jQuery (use react,angular & vue logo image here)
Do you want to use jQuery in your new project ?

Other posts of this series can be found here – https://blog.nerdjfpb.com/tag/javascript/

You can see the graphical version here
{% instagram B9BXrg9A4LV %}

Source Codes - { Check commits }
{% github nerdjfpb/javaScript-Series %}

Originally it published on [nerdjfpbblog](https://blog.nerdjfpb.com/javascript-part-29/). You can connect with me in [twitter](https://twitter.com/nerdjfpb) or [linkedin](https://www.linkedin.com/in/nerdjfpb/)!
My first Ruby gem is useless
Tags: ruby, webdev, beginners, gem
Published: 2020-02-26 19:35:06

---
title: My first Ruby gem is useless
published: true
description: My first Ruby gem 
tags: ruby , webdev , beginners , gem
---

This is my first ever post in dev.to and I just wanted to share that 
I published my first Ruby [gem] (https://rubygems.org/gems/ds_watcher), which basically is useless. I mean to me it isn't but to others it may.

It's a simple gem to get the episodes of Demon Slayer Manga (which is a pretty cool manga). It doesn't have any other feature aside from getting the list of episodes, but overall I'm happy that I just finished it as I learned a bunch while developing it.

I am a PHP developer but really loves Ruby, as it makes me happy ❤️

I have also made a post on my [blog](https://www.jandev.me/posts/my-first-ruby-gem-is-useless/) about it (also first time blogging), As I just wanted to improve my English and writing skills. 


Anyways, I just wanted to share it and thank you for reading this post.

Here's the link of the [repo](https://github.com/necrojan/ds_watcher) if someone is interested in checking it. To all Ruby devs out there I'd be happy to get some feedback or tips so I can improve my coding as well as maybe books to read in Ruby that you can suggest.

Thank you.