teleren/devto huggingface dataset:
Acknowledgement From AlienVault
Tags: security, bugbounty, bughunting, cybersecurity
Published: 2020-08-03 15:48:20


AlientVault has a[ responsible disclosure policy](https://www.alienvault.com/documentation/usm-appliance/kb/2016/03/how-to-submit-a-security-issue-to-alienvault.htm) so I experienced it and wanted to test their web application related to security vulnerabilities. I was a  little occupied nowadays so I scarcely managed time and began testing their web applications and just engaged with their primary domain. As few of my different companions got recognized from AlienVault and I also wished to don't miss that open door.

After doing a security test I established a couple of vulnerabilities in the meantime and reported it to the security support team without wasting time and get their response in ten days. _Thank you for sharing your findings. We have just issued a security-test on this domain, so we will take this into considerations while performing the research._

Following a couple of more days, I approached them for updates and they replied, _Thank you for contributing in AlienVault's responsible security disclosure process._ Please accept that certificate of appreciation as an honour.

![Alt Text](https://dev-to-uploads.s3.amazonaws.com/i/bz431f66j51ldkrmkq91.jpg)

On October 30th, 2017 AlienVault launched a program on[ HackerOne](https://hackerone.com/alienvault_security/). I reported the same issue to AlienVault through HackerOne and in the next couple of days they marked this report as resolved by following the issue utilizing HackerOne. I got listed in AlienVault's security researchers[ Hall of fame](https://hackerone.com/alienvault_security/thanks/2017) as HackerOne policy.

![Alt Text](https://dev-to-uploads.s3.amazonaws.com/i/soylxarp6opyjnuwgms7.jpg)

It's not finished by any stretch of the imagination, because it is minimally occupied nowadays and so I was unable to test their web application completely. I will require some time and will retry an infiltration testing to chase some more and high :D
Acknowledgement From Adobe
Tags: security, bugbounty, bughunting, cybersecurity
Published: 2020-08-03 15:48:18

I generally wanted to test their security and wanted to be a piece of authority Adobe security researchers. This time [HackerOne](http://hackerone.com) provided me with a chance to do as such. The Adobe security administration group keeps running on[ HackerOne](https://hackerone.com/adobe) HackerOne  HackerOne and I wanted to test their web application. Adobe has the most tremendous scope as indicated by HackerOne and it has settled circuitous more than one thousand or more reports

On 24th August 2016, I reported security vulnerability to Adobe related with SPF and DMARC records which may lead to Email address spoofing. This one is the same as I established in Magento.

After three days their security team members marked that report as triaged.

![Alt Text](https://dev-to-uploads.s3.amazonaws.com/i/dhzmlb6guhbpczyzbshy.jpg)

That was a good minute for me, I was truly cheerful on the grounds because that was my first report that got triaged in HackerOne. But after that who knows they took as much time to resolve, _Be patience, my patience._ I got some information about updates after a month that they are still working on it and inform me once it gets fixed. Affirm! It took over more than five months now however they didn't respond about any updates or inquiries. One day all of a sudden I opened my HackerOne account and investigated my triaged reports. This one is the special case that keeps going so long. I retried to test it and what I established is that it is not predictable from my side. I pinged them once again and requested updates. Following one day they marked it as resolved because it is not producible anymore

![Alt Text](https://dev-to-uploads.s3.amazonaws.com/i/6nsy4l381ws327m660wt.jpg)


As per HackerOne policy, researchers are automatically featured in the team hall of fame if reports get resolved. I got recorded in  [Adobe's Hall of Fame](https://hackerone.com/adobe/thanks) and that was my great experience.

![Alt Text](https://dev-to-uploads.s3.amazonaws.com/i/k7pank2ci5wfjyhcyqi1.jpg)

I would like to Thank adobe security team and I would also like to thank you for your precious time. If you have any questions or suggestions then please use the comment form below and let me know. I always appreciate your comments and suggestions.
Acknowledgement From Jumper.ai
Tags: security, bugbounty, bughunting, cybersecurity
Published: 2020-08-03 15:48:17

Jumper is an e-commerce enabler that helps you to sell your products instantly on social media with comments. As soon as users comment on your posts it sends them an auto message with all the product details. Users can instantly pay and checkout within the messaging app itself.

They currently support posts on Facebook, Instagram, Twitter and Youtube and Facebook and can message users on Facebook Messenger, Twitter DM and SMS.

A few days back one of my companions from India sent me a screenshot of himself featured in Jumper's about page. I got inquisitive to know further. After asking him, he disclosed to me that he revealed security weaknesses in their web application to them and they offered to mention him in their About page. I figured how I can miss this open door.

I visited [Jumper](https://jumper.ai/) in that surety that I established bugs and I am prepared to reach them. Before doing a single security test I informed them through their site's online chat box that I established security vulnerabilities and what's the procedure of responsible disclosure policy. At that point, I got a confident answer from them and wanted to test their site.

![Alt Text](https://dev-to-uploads.s3.amazonaws.com/i/qbwqy0ebnw5fsj6q3lfd.jpeg)

I did a security test for more than an hour and I established a couple of vulnerabilities few have high effects and few have medium. I revealed these security issues to them one by one. Security issues I established were:

- Broken Authentication and Session Management Flaw (Cookie Replay).
- Cross-Site Script Forgery (CSRF) in the Business address form.
- Stored Cross-Site Scripting (XSS) Admin to Admin.
- Clickjacking / UI Redressing and few more.

After a couple of hours, they reacted to one of the emails. As it's not a vast organization so perhaps it'll take more time for them to discharge a fix. Well, it was my birthday fourth September and instead of partying I am making the internet safe and secure.

![Alt Text](https://dev-to-uploads.s3.amazonaws.com/i/9s7zspsgvw9jiifmlcoi.jpg)

Impressive Isn't it? Following two weeks or less, I approached them for updates and they responded that they made a fix for critical ones and will be updated soon as possible.

![Alt Text](https://dev-to-uploads.s3.amazonaws.com/i/ud7lu1eah4463ntdsv8a.jpg)

I pinged them my Display picture and in the next couple of hours I was recorded in their site[ About](https://jumper.ai/about) (Contributors) page and it was brilliant. It was the best experience ever in Information Security. I truly appreciate the Jumper support team for good taking care of these reports and they are anticipating work with me in future too.

![Alt Text](https://dev-to-uploads.s3.amazonaws.com/i/u8qcpafozd158lxp6wk4.jpg)

Thanks to the Jumper team and I would also like to thank you for your precious time. If you have any questions or suggestions then please use the comment form below and let me know. I always appreciate your comments and suggestions.
Make sure your GraphQL Lists return predictable results!
Tags: graphql, connection, limit, pagination
Published: 2020-08-03 15:41:13

Home page of https://graphql.org/ states this fact

Describe your data
```
type Query {
 company(name: String): Company
}
type User {
  name: String
}
type Company {
  name: String
  tagline: String
  # List of board members
  boardMembers: [User] 
}
```
Ask for what you want
```
{
  company(name: "Acme") {
    name
    tagline
    boardMembers {
      name
    }
  }
}
```
Get predictable results
```
{
  "data": {
    "company": {
      "name": "Acme",
      "tagline": "Acme is all you need!",
      "boardMembers": [
        {
          "name": "Tom"
        },
        {
          "name": "Jerry"
        }
      ]
    }
  }
}
```

Are you sure? Are you sure you are getting predictable results?

This API is breaking a fundamental promise given by GraphQL! You simply are not getting predictable results!

As you scale the number of items returned by the list might become unpredictably large. See the image below for example, there is no predictability in the size of items returned in the list

![Unpredictable size of the list](https://dev-to-uploads.s3.amazonaws.com/i/ddxrqs0aksjhfj7wrmdv.gif)

Give the control back to the client, always set limits. Let the client decide how much they want to fetch.
```
type Company {
  name: String
  tagline: String
  # List of board members
  boardMembers(first:Int) : [User] 
}
```

Now client can limit the query results to exactly how much they need
```
{
  company(name: "Acme") {
    name
    tagline
    boardMembers(first:3) {
      name
    }
  }
}
```

Refer: https://graphql.org/learn/pagination/#slicing

# 🙏
Another two C# idioms
Tags: csharp, tutorial, dotnet
Published: 2020-08-03 15:39:44

In this part of the C# idioms series, we have one idiom to organize versions of commands, events or view models. And another idiom, on coditionals inside `switch` statements.

### Separate versions of commands and events using namespaces and static classes

When working with Command Query Responsibility Segregation (CQRS), sometimes you need to support versions of your commands and queries. For example, you need to add new properties or remove old ones. You don't want to mess with your existing commands and queries. Also, it applies to request and response view models in your API projects.

One alternative is to encode the version number in the class name itself. For example, `DoSomethingCommandV2`. 

For better organization, you can group your commands and queries inside a namespace. This namespace's name will contain the version number. But, someone could use one version instead of the other by mistake. In this situation, a named alias comes handy.

```csharp
namespace Commands.V2
{
  public class DoSomethingCommand
  {
  }
}
```

Another option, you can wrap your commands and queries inside an static class, named after the version number. They will be used like : `V2.DoSomethingCommand`. This time, it's obvious which version is used.

```csharp
namespace Commands
{
    public static partial class V2
    {
        public class DoSomethingCommand
        {
        }
    }
}
```

But, if you use a partial class and your commands and events belong to different projects, you will end up with a name conflict. There will be two classes with the same name in different projects. Then you would need to use an `extern alias` to differentiate between the two.

Finally, you can take the best of both worlds.

```csharp
namespace Commands.V2
{
    public static partial class V2
    {
        public class DoSomethingCommand
        {
        }
    }
}
```

### Conditional cases in `switch` statements

When working with `switch` statements, you can use a `when` clause instead of an `if/else` in your `case` expressions. Order is important in this case. The `case/when` should be higher than the corresponding `case` without `when`.

Before,

```csharp
switch (myVar)
{
  case aCase:
    if (someCondition)
    {
      DoX();
    }
    else
    {
      DoY();
    }
    break;
}
```

After,

```csharp
switch (myVar)
{
  case aCase when someCondition:
      DoX();
      break;
  
  case aCase:
      DoY();
      break;
}
```

_Happy C# time!_
Parameters and Arguments..the difference
Tags: javascript, codenewbie
Published: 2020-08-03 15:35:43

Hello, Developers...

So, I remembered a definition I struggled with back then in CS class and I decided to differentiate so others could learn from it.

What is the difference between 
####Parameters and Arguments?

A lot of devs use these terms interchangeably, it's really no big deal if you're writing codes but when documenting, you want to make sure you're passing the right information across to whoever's reading your article.

1. Parameters are named variables which are declared during a function's definition.

2. Arguments are the real values passed into the functions.


![Alt Text](https://dev-to-uploads.s3.amazonaws.com/i/l1txu4ywfian75e3mfh2.png)

As you see in the example above, the parameter in the function is the **name** variable passed in during the function definition while the argument is the name **Samuel** passed in during function invocation.

You can use this [link](https://developer.mozilla.org/en-US/docs/Glossary/Parameter) as a reference to understand better.
CSS Pixel Ghost
Tags: codepen, css
Published: 2020-08-03 15:33:52

<p>I created this image of a ghost on the pixel drawing application <a href="https://pxl.netlify.app" target="_blank">PxL</a> created by <a href="https://codepen.io/jh3y" target="_blank">@jh3y</a>. I animated the pixel ghosts eyes using CSS keyframes. Image also available as an SVG or PNG.</p>

<p>Using PxL is a whole lotta fun and allows for really creative pixel art. I'd love to see what others can create with this great pixel drawing app.</p>

{% codepen https://codepen.io/tannerdolby/pen/dyGjMEN %}
Single Div Camera
Tags: codepen, css
Published: 2020-08-03 15:25:47

<p>My attempt to recreate a single div camera. Made with <strong>lots</strong> of box-shadows. </p>

<p>Original illustration by <a href="https://codepen.io/lynnandtonic" target="_blank">@lynnandtonic</a></p>

<p>If you want to get started with single div drawings and CSS art in general. I highly recommend you checkout this amazing article over on Mozilla Hacks by Lynn Fisher <a href="https://hacks.mozilla.org/2014/09/single-div-drawings-with-css/" target="_blank">Single Div Drawings with CSS</a></p>

{% codepen https://codepen.io/tannerdolby/pen/JjGzRbg %}
#30DaysOfCJS: Let’s Talk About Mentoring
Tags: 30daysofcjs, conferences, mentoringmonday, community
Published: 2020-08-03 15:11:47

---
title: #30DaysOfCJS: Let’s Talk About Mentoring
published: true
description: Day 2 of #30DaysOfCJS, Let’s Talk About Mentoring // Glenn Block // CascadiaJS 2018
tags: 30daysofcjs, conferences, mentoringmonday, community 
cover_image: https://dev-to-uploads.s3.amazonaws.com/i/6zon5st2kjmqxxr5r7w9.png
series: 30DaysOfCJS
---

*This is a follow up post for Day 2 of* **#30DaysOfCJS**, *learn more about* **#30DaysOfCJS** *here* {% link jimcalliu/30daysofcjs-1jd3 %}

Happy #MentoringMonday! For my Day 2 of **#30DaysOfCJS**, I would like to share the inspiring talk by [Glenn Block](https://twitter.com/gblock). Glenn is a DEI Advocate in addition to being a tech/product leader. He had inspired and helped me get started with how to be a mentor. I hope by resurfacing this talk, more people will be inspired to take on mentor roles and pay it forward.

In this talk, you will also learn about the inspiring story from @taeluralexis, who went from fast food server to a software engineer in 6 months. Tae’lur's story moved many people at the conference, and I hope to see stories like this in the future.

{% user taeluralexis %} 

If you'd like to watch the talk, here is the Youtube link. 
{% youtube WsTYfQXF8MA %}

Tell us if you want to become a mentor in the comment or tweet at [me](https://twitter.com/jimcalliu) or [Glenn](https://twitter.com/gblock) on Twitter.
Animated Loading Divs
Tags: codepen, gsap
Published: 2020-08-03 15:11:14

<p>This loading animation was created using GSAP and a row of four div elements. I saw a similar loader after logging out of the game I was playing this morning and thought it was cool. So here is my first attempt at recreating it. </p>

{% codepen https://codepen.io/tannerdolby/pen/eYJKXWJ %}
Where Do You Host Your Websites?
Tags: discuss, webdev, hosting, website
Published: 2020-08-03 15:02:09

I recently saved over $100 from switching one of my static sites over to Netlify (Starter Tier, free), which seems to be one of the more popular hosting options - there are SO many free options to host your static website on these days.

Whether it's a static or dynamic, where did you choose to host your website(s)? Are you using the free or paid tier of your hosting service? Do you separate your static from your dynamic websites when it comes down to where it's hosted?

If you have a favorite hosting service/platform (for static and/or dynamic sites), please share it below!
Variable Font Animation
Tags: codepen, variablefonts, gsap, css
Published: 2020-08-03 14:58:28

<p>Introduction to Google Variable fonts with some GSAP animation sprinkled in to animate letters to and from low/high font-weights. Shoutout to <a href="https://codepen.io/jh3y" target="_blank">@jh3y</a> for making me aware of variable fonts.</p>

{% codepen https://codepen.io/tannerdolby/pen/zYrRrVq %}
What are you tips on understanding more challenging concepts?
Tags: discuss, rstats, gis, datascience
Published: 2020-08-03 14:46:40

Although my primary concern is making sense of applied statistics in R language, as well as geostatistics; **enough to make sound inferences / explanations** in academics (public health, actually); I would be interested to hear how you tackle more challenging concepts are well.

Problems are usually,

- Video too long. Not understanding much.
- Writings too long and too confusing.
- Even after some time, I cannot write a discussion, or **make a point in a discussion**. (Forums and webinars.)
Where does Python Shine Over Node?
Tags: discuss, node, python
Published: 2020-08-03 14:45:30

This is the scenario I'm in:

I'm comfortable with Node, I have interest in Python but little experience, and I want to begin writing scripts for automating certain processes on my local machine.

At first glance, Node is capable of handling any task that Python would be used for, but Python is often touted as the "go-to" choice for this type of work.

I'd like to know what others think about this, and maybe some specific areas that Python would be a better choice than Node.

Thanks for reading.
@Azure Mini Fun Bytes: How to setup Azure Blob Storage
Tags: azure, storage, tutorial
Published: 2020-08-03 14:30:53

I take you through a few real-world problems and find some solutions.  Today, we answer:

**How do I create Azure blob storage?** 

If you need to store many objects in the cloud, like pictures, videos, logs, or any other kinds of unstructured data, using a [storage blob on Azure](https://docs.microsoft.com/azure/storage/blobs/storage-blobs-introduction?WT.mc_id=devto-blog-jagord) is a perfect option. In this post, I walk through the steps of creating a storage account, [creating the blob container](https://docs.microsoft.com/azure/storage/blobs/storage-quickstart-blobs-portal?WT.mc_id=devto-blog-jagord), [uploading the content](https://docs.microsoft.com/azure/storage/common/storage-account-create?tabs=azure-portal&WT.mc_id=devto-blog-jagord), and eventually accessing my https available object.

 {% youtube iFeVV4wG6Dw %}

I take questions and give you a start with code and procedure to deploy it.

Follow AzureFunBytes on [Twitter](https://twitter.com/azurefunbytes) and [Twitch](https://www.twitch.tv/azurefunbytes) for updates on future episodes.

Links for you!

[Introduction to the core Azure Storage services](https://docs.microsoft.com/azure/storage/common/storage-introduction?WT.mc_id=devto-blog-jagord)

[What is Azure Blob storage?](https://docs.microsoft.com/azure/storage/blobs/storage-blobs-overview?WT.mc_id=devto-blog-jagord)

[Introduction to Azure managed disks](https://docs.microsoft.com/azure/virtual-machines/windows/managed-disks-overview?WT.mc_id=devto-blog-jagord)

[Use the portal to attach a data disk to a Linux VM](https://docs.microsoft.com/azure/virtual-machines/linux/attach-disk-portal?WT.mc_id=devto-blog-jagord)

Microsoft Learn: [Core Cloud Services - Azure data storage options](https://docs.microsoft.com/en-us/learn/modules/intro-to-data-in-azure/?WT.mc_id=devto-blog-jagord)

Microsoft Learn: [Azure Fundamentals](https://docs.microsoft.com/learn/paths/azure-fundamentals/?WT.mc_id=devto-blog-jagord)

[Microsoft LearnTV](https://docs.microsoft.com/learn/tv/?WT.mc_id=devto-blog-jagord) 24*7 streaming Azure content

[Get $200 in free Azure credit along with 12 months of free services](https://azure.microsoft.com/en-us/free/?WT.mc_id=devto-blog-jagord)
Rustacean does Javascript
Tags: rust, javascript, deno
Published: 2020-08-03 14:24:38

To be honest I am not the most stable person when it comes to what software and tools I use. I tend to be a bit emotional and biased on my choices. As of late I have changed up my Javascript environment to be a bit more Rusty. It's a language that facinates me and I have become quite the fanboy of it. So since I mainly do web development, I like to keep rust as close as I can. So I have made some changes to how I work which makes things much more Rusty. 

The first change I made is replacing my default shell with [Nushell](https://www.nushell.sh/). The reasoning behind it. 
1. It's written in Rust
2. It's cross platform
3. It's easy to install
4. It's got major geek cred!

My second change is moving from node to [Deno](https://devo.land) for my Javascript environment. I am mainly running little scripts and such, so the main difference for me is I go from typing `node script.js` to `deno run script.js`. Of course `deno run` is a little more typing so I have already made an alias that has me just typing `dr script.js`. 

So far, my work is the same, nothing else has really changed other than the above. It's almost not noticible at all. I just get to have that warm fuzzy feeling that I'm running a bunch of Rust all day. To those who will complain in comments, yes I know this post is a little pointless, but it's fun. 

If anyone is really interested in this, I can do a post on getting it all setup. It's pretty simple. 

![](https://pixelfed.social/storage/m/_v2/195905623068643328/a2741f614-ed245b/XQkgB4xclpqr/3ei7xXFtQ51F72KnOIXWEePJqbaurqaic8yM3gn6.png)