teleren/devto huggingface dataset:
Checking your project dependencies for vulnerabilites
Tags: security, java, javascript, npm
Published: 2018-11-27 20:06:04

---
title: Checking your project dependencies for vulnerabilites
published: true
tags: security,java,javascript,npm
canonical_url: https://on-sw-integration.epischel.de/2018/11/27/checking-your-project-dependencies-for-vulnerabilites/?pk_campaign=feed&pk_kwd=devto
---

In the light of the [recent case](https://arstechnica.com/information-technology/2018/11/hacker-backdoors-widely-used-open-source-software-to-steal-bitcoin/) of introducing malicious code through a popular JavaScript module on npm, I like to mention [snyk.io](http://snyk.io) .

In a simple, free of charge scenario, snyk.io scans build or dependencies files on your github or gitlab projects and **periodically reports vulnerabilities**. Snyk supports Node, Ruby, Java, Scala and Python projects.

If you pay for snyk.io, you get a lot more integrations, CLI and API access etc.

In my own trial I found that even for fairly recent spring boot and apache camel dependency tree there a dozen of high-rated vulnerabilities! (Many of them by using “com.fasterxml.jackson.core:jackson-databind@2.9.1”). So the next question is **if it’s advisable to upgrade to a secure patch** of – say – jackson-databind although I use it only indirectly – in other words: will the depended framework still work with the secure patch version?

An open-source alternative is [OWASP-Dependency-Check](https://www.owasp.org/index.php/OWASP_Dependency_Check). It scans Java and .Net dependencies, has experimental support for Python, Ruby, PHP (composer), and Node.js applications. The tool seems to be JVM-based. There is a [SonarQube-plugin](https://github.com/stevespringett/dependency-check-sonar-plugin). I have not tried it myself.
A short list of Data Science resources #4
Tags: python, datascience
Published: 2018-11-27 19:14:53

---
title: A short list of Data Science resources #4
published: true
description: data science resources of the week
tags: #python #datascience
---
Also in the last days I stumbled upon some interesting resources related to data science. I hope that can be useful for someone else.

- If you use python for your data science projects you surely work with pandas and scikit-learn but never heard of these little-known libraries. Check them out https://opensource.com/article/18/11/python-libraries-data-science
- Suggested by {% user ellowrath %} Google Dataset Search lets you find datasets wherever they are hosted https://toolbox.google.com/datasetsearch
- A handful of pandas tricks https://www.pythonprogramming.in/pandas-examples.html
- A lot of plots to highlight that correlation does not imply causation http://www.tylervigen.com/spurious-correlations

If you have any feedback or cool resources, please share them in the comments!
Welcome Thread - v23
Tags: welcome
Published: 2018-11-27 18:48:15

---
title: Welcome Thread - v23
published: true
description: Introduce yourself to the community!
tags: welcome
---

Hey there! Welcome to dev.to!

![A laptop prints in cursive text, "hello world"](https://media.giphy.com/media/fedryX7dMGMe6lgqDm/giphy.gif)

Leave a comment below to introduce yourself to the community!✌️

1. Leave a comment below to introduce yourself! You can talk about what brought you here, what you're learning, or just a fun fact about yourself.

2. Reply to someone's comment and say hello or ask them a question. 👋
Grpc for web???
Tags: healthydebate, webdev, javascript, grpc
Published: 2018-11-27 18:27:04

---
title: Grpc for web???
published: true
tags: healthydebate, webdev, javascript, grpc
---

I want to start this discussion because of this 
[gRPC-Web is going GA](https://www.cncf.io/blog/2018/10/24/grpc-web-is-going-ga/)

What do you think about Grpc for frontend
My First Online Testing Conference
Tags: testing, conference
Published: 2018-11-27 18:19:45

---
title: My First Online Testing Conference
published: true
description: 
tags: testing, conference
---

Today I am attending the [OnlineTestConf](http://www.onlinetestconf.com/) a free testing conference between 11/27 to 11/28 2018. So far I have attended two sessions. One Automation Quality by Louise Gibbs and The Science of Testing by Thomas Haver.


![Automation Quality](https://s3.amazonaws.com/www.alanmbarr.com/blog/images/Automation+Quality.png)

- Choose which tests bring the most value for automation
- Improve manual testing by benefiting from automation wins
- Report success metrics

![Science of Testing](https://s3.amazonaws.com/www.alanmbarr.com/blog/images/Science+of+Testing.png)

- Testing is the scientific method
- Apply rigor to your exploratory testing
- Report your results and have peers review how you are testing
Top 5 DEV Comments from the Past Week
Tags: bestofdev
Published: 2018-11-27 17:25:52

---
title: Top 5 DEV Comments from the Past Week
published: true
description: Highlighting some of the best DEV comments from the past week.
tags: bestofdev
cover_image: https://res.cloudinary.com/practicaldev/image/fetch/s--7VrAA2ln--/c_imagga_scale,f_auto,fl_progressive,h_420,q_auto,w_1000/https://thepracticaldev.s3.amazonaws.com/i/qmb5wkoeywj06pd7p8ku.png
---

This is a weekly roundup of awesome DEV comments that you may have missed.  You are welcome and encouraged to boost posts and comments yourself using the **[#bestofdev](/t/bestofdev)** tag.

One of the most popular discussions this week was a conversation on **[Password manager recommendations.](https://dev.to/jess/password-manager-recommendations-447l)**  @simoroshka had the short-and-sweet top comment to recommend LastPass:
{% devcomment 72j9 %}

While @alex_barashkov offered some additional context around 1Password.  Be sure to give the whole thread a look if you're in the market for a new password manager:
{% devcomment 72mj %}

@ballpointcarrot jumped into **[The node_modules problem](https://dev.to/leoat12/the-nodemodules-problem-29dc)** discussion thread to talk about how _there really is a package for everything_.  This actually pre-dated the very timely disclosure of an [npm package that was discovered to have a backdoor](https://dev.to/ben/npm-package-discovered-to-have-bitcoin-stealing-backdoor-j7i):
{% devcomment 72hh %}

@bosepchuk talked about preference in the **[Compact or Verbose Codestyle?](https://dev.to/f1lt3r/compact-or-verbose-codestyle-30dd)** discussion:
{% devcomment 75kj %}

And finally, @puritanic gave a great reply in response to **[What are some misconceptions about web development?](https://dev.to/ben/what-are-some-misconceptions-about-web-development-454k)**:
{% devcomment 752c %}

See you next week for more great comments ✌
QuickAuthPHP – One script for web authentication. Multi-user. No database required.
Tags: php, authentication, opensource, github
Published: 2018-11-27 17:11:19

---
title: QuickAuthPHP – One script for web authentication. Multi-user. No database required.
published: true
description: Quickly add a web authentication to your project. A fast, easy and generic solution.
tags: php,authentication,open source,github
---

## Goal

Sometimes you have a small web application that you want to keep private, but don't have time to implement a proper database authentication system, nor _.htaccess_ is suitable for your needs (or you hate native browser authentication, like me). If this is true for you, QuickAuthPHP is a super fast solution.

## Project website

[github.com/llagerlof/QuickAuthPHP](https://github.com/llagerlof/QuickAuthPHP)


## What it does?

- Add a single login form to any webpage on your server.
- You can have multiple logins and passwords.

## Goodies

- One single script easy to configure and install.
- Non obstrusive. You only need to require_once() the script in your web pages.
- No dependencies.
- No need to change HTML, Javascript or CSS in your pages.
- Secure.


## What will you need?

- A working web server with PHP 5.5 or above (preferably 7.x).
- The file [auth.php](https://github.com/llagerlof/QuickAuthPHP).
Vue CLI UI for Easy Project Management
Tags: vue, javascript, cli, frontend
Published: 2018-11-27 16:29:04

---
title: Vue CLI UI for Easy Project Management
published: true
description: Learn how to create, configure and manage Vue projects through the Vue CLI graphical user interface.
tags: #vuejs #javascript #cli #frontend
canonical_url: https://auth0.com/blog/vue-cli-ui-for-easy-project-management/
---

The Vue CLI has evolved into a full system for rapid VueJS development. Vue CLI 3.0 comes packed with extraordinary tooling that increases developer experience by providing fast and intuitive project scaffolding, webpack sensible defaults, zero configuration, extensibility, and much more.

But probably, the most user-friendly of its offerings is the ability to create and manage Vue projects through a beautiful browser-based graphic user interface called Vue Project Manager. In this blog post, you are going to learn how to use the Vue CLI 3.0 graphic user interface to create, import, manage, and customize Vue projects easily.

[Read on ✊](https://auth0.com/blog/vue-cli-ui-for-easy-project-management/?utm_source=dev&utm_medium=sc&utm_campaign=vue_cli)

![Vue CLI UI for Easy Project Management](https://thepracticaldev.s3.amazonaws.com/i/oq519i1f8s80r922y2sj.png)
Select2 in Angular
Tags: angular, select2
Published: 2018-11-27 17:05:16

---
title: Select2 in Angular
published: true
description: Select2 in Angular
tags: angular, select2
---
Hello to all, here I am going to share post related to Select2 in Angular.


[Select2 in Angular](https://therichpost.com/how-to-implement-select2-in-angular-7)

Note: I am blogger by heart. I am running therichpost.com blog.I am doing blogging to help others in coding.

Thank you
Jatt Blood
Make your own types
Tags: functional, beginners, elm
Published: 2018-11-27 17:04:20

---
title: Make your own types
published: true
description: 
tags: #functional, #beginners, #Elm
---

_TL;DR: Make very specific types so nobody can use the wrong functions for them._

If you hang out in the Elm community a bit, you will know of a preference for creating your own enum types rather than using existing isomorphic ones. E.g., if you have a color that can be black or white, it is customary (no pun intended) to create a new type:

```elm
type Color = Black | White
[...]
color : Color
``` 

rather than using the standard boolean type:

```elm
colorIsBlack : Bool
```

despite the later requiring fewer lines of code.

I even had to look up if Elm uses `Bool` or `Boolean` because I never frigging see it.

The main reason given for doing this is that it makes code easier to understand, but this is not the only argument.

In the [functional fundamentals](https://dev.to/drbearhands/a-series-on-functional-fundamentals-48mb) series I've [mentioned](https://dev.to/drbearhands/functional-fundamentals-types-as-propositions-programs-as-proofs-56gh) how functional type systems act as a proof that a function *will* return a specific type and not, e.g. an error.

If you use the same types for isomorphic data, e.g. you use a boolean rather than a color in the example above, that proof will only hold up to data isomorphism, not semantics. 

A somewhat contrived examples:

If you're taking into account relativity theory, you should not be able to add up two velocities (speed of light being a maximum and such). But if you just use `Float` as the type of a velocity, you do have a proof for correctness of such an operation. Indeed, it *is* correct as far as data isomorphism is concerned, but not correct in terms of semantics.

You could, instead, define your own type for velocities and the functions that come with it. It'd look a little bit like this in Elm:

```elm
module RelativityTheory exposing (Velocity, Energy, accelerate)

type Velocity = Velocity Float
type Energy = Energy Float

accelerate : Energy -> Velocity -> Velocity
[...]
```

By not exposing the inner structure of `Velocity`, as you would by exposing `Velocity(...)`, you prevent any future error by you or your team-mates. Unless, you know, they try hard enough and actually modify the exposition.

The concept is similar to encapsulation in OOP principles.

More common examples in which these errors happen all the time: is a distance in km, miles, m, feet? Is a rotation in degrees, radials or turns? What is the encoding for this string?

Semantic type differentiation can help solve these problems.
I've write a VSCode extension to share folders with Dat
Tags: javascript, vscode, dat, p2p
Published: 2018-11-27 16:24:32

---
title: I've write a VSCode extension to share folders with Dat
published: true
description: 
tags: #javascript #vscode #dat #p2p
---
Another day I was trying a easy way to share a simple directory with a friend, and store with git, create a github repo, make commit and push it was very expansive because I'm at the ending of my graduation and I'm very tired in the last days.

So, I have write a very simple vscode extension to do this with [Dat](https://datproject.org/)! Anyone can access [with this link](https://marketplace.visualstudio.com/items?itemName=gustavofsantos.dat-dir) and plase, if anyone has time to contribute, do it. My english is not so good to write documentation and only correcting my spelling will help a lot :)
How to use Dagger 2 - Binds Annotation
Tags: android, dagger2
Published: 2018-11-27 16:22:12

---
title: How to use Dagger 2 - Binds Annotation
published: true
description: 
tags: android, dagger2
---

Dagger 2 introduces new annotation @Binds. You can use it to simplify @Provides, it turns this:

```java
@Module
class HomeModule {
    
    @Provides
    HomeView provideHomeView() {
        return new HomeViewImpl();
    }
}
```

Into this:

```java
@Module
abstract class HomeModule {
    
    @Binds
    abstract HomeView provideHomeView(HomeViewImpl impl);
}
```

## Can we use @Binds and @Provides together?

Yes, you can use static method.

```java
@Module
public abstract class MainActivityModule {

    @Provides
    static MainPresenter provideMainPresenter(MainView mainView, ApiService apiService) {
        return new MainPresenterImpl(mainView, apiService);
    }

    @Binds
    abstract MainView provideMainView(MainActivity mainActivity);
}
```

On Kotlin, you can use `companion object` to achieve the same thing.

```kotlin
@Module
abstract class MainApplicationModule {

    @Binds
    abstract fun provideApplication(application: Application): Context

    @Module
    companion object {
        @JvmStatic
        @Provides
        internal fun provideAgeMap(): Map<String, Int> {
            return mapOf("Luffy" to 17, "Shanks" to 37)
        }
    }
}
```

## Verdict

@Binds clearly makes component declaration more succint. There is a slight problem when combining it with @Provides. While both approach works. I would prefer to still use @Provides for the sake of consistency. But you may want to experiment it yourself too feel which one you like better.
Documentation as a key to the strong tech community
Tags: discuss, opensource, documentation
Published: 2018-11-27 16:21:59

---
title: Documentation as a key to the strong tech community
published: true
description: How to create the description of readme that works on building open source community
tags: discuss, open source, documentation
---
I believe that all great projects were started with clear documentation. My project is a new open-source protocol that is searching to build a community around the concept of digital certificates that are secured by blockchain network. I see that our idea attract interest on the hackathons, meetups and tech chats, but it is essential to transmit those activities on the GitHub as well. 

We have prepared Q&A page as well as simple project documentation http://docs.remme.io. But now I see a necessity to work more on our GitHub repository readme file. As I understood we need to add more about the problem that our code challenges, current features, contribution policy and left some info about the development team. I saw on the Internet a considerable number of advice about gifs, colorful buttons, and tables, but not sure that it wouldn't irritate our repo guests. 

What else should we add on our core protocol page to make it closer to open source community and attract it to contribute to the project? I have added the link here:

{% github Remmeauth/remme-core %}
How to scroll RecyclerView to a certain position?
Tags: android
Published: 2018-11-27 16:21:03

---
title: How to scroll RecyclerView to a certain position?
published: true
description: 
tags: android
---

This questions seems so simple, in fact Android SDK has provided several API to scroll item at certain position.

```kotlin
fun iJustWantToScroll() {
    recyclerView.scrollToPosition()
    recyclerView.smoothScrollToPosition()
    recyclerView.layoutManager?.scrollToPosition()
    (recyclerView.layoutManager as LinearLayoutManager).scrollToPositionWithOffset()    
}
```

It should work as expected right? Afterall, scrolling an item to certain position is a fairly common usage. Yet, why does this question is still popular?

![scrolltoposition](https://github.com/aldoKelvianto/blog/raw/master/assets/scrolltoposition.png)

Me too, is a victim of this bug. I have spent years before I realised I was asking the wrong question, before I'll answer this question, let me show you what I previously had done before.

```kotlin
fun iJustWantToScroll() {
    recyclerView.postDelayed(Runnable {
        // or use other API
        recyclerView.smoothScrollToPosition(0)

        // give a delay of one second
    }, 1_000)
}
```

This is a bit hacky, but always works (in my scenario). Try to reduce the delay, usually 500 milliseconds is enough.

----

The right question to ask about `scrollToPosition` is not *How*, but *When*.

# When to scroll RecyclerView to a certain position?

I find that the problem why `scrollToPosition` , and others API, does not work is because the dataset is not yet ready. We should call `scrollToPosition` when the recyclerView has received dataset. To do that, we can use `AdapterDataObserver`.

[AdapterDataObserver on d.android](https://developer.android.com/reference/android/support/v7/widget/RecyclerView.Adapter#registerAdapterDataObserver(android.support.v7.widget.RecyclerView.AdapterDataObserver))

`AdapterDataObserver` has five public methods.

![public-methods](https://github.com/aldoKelvianto/blog/raw/master/assets/public-methods.png)

As the method name implies, `onItemRangeInserted` is called when an item is added to the RecyclerView, and `onItemRemoved` is called when an item is removed from the RecyclerView.

There is an exception for `onChanged`. `onChanged`is only called when you call `notify` on an Adapter, it is **not going to called everytime** there is a change on the RecyclerView.

I usually call `scrollToPosition` when the dataset is succesfully inserted to a RecyclerView, for example:

```kotlin
adapter.registerAdapterDataObserver( object : RecyclerView.AdapterDataObserver() {
    override fun onItemRangeInserted(
        positionStart: Int,
        itemCount: Int
    ) {
        recyclerView.scrollToPosition(0)
    }

    override fun onItemRangeRemoved(
        positionStart: Int,
        itemCount: Int
    ) {
        recyclerView.smoothScrollToPosition(itemCount)
    }
}
```

This way, we don't have to wait certain millisecond to scroll a ReyclerView. When there is a new dataset, we can trigger `scrollToPosition` or `smoothScrollToPosition` and be sure RecyclerView is scrolled.
Aversion, upgrade projects that are using old language versions
Tags: opensource, ruby, node, productivity
Published: 2018-11-27 15:22:26

---
title: Aversion, upgrade projects that are using old language versions
published: true
tags: opensource, ruby, node, productivity
---

<img src="https://thepracticaldev.s3.amazonaws.com/i/kpeood5kbrt1iaj10bjh.png" width="403px">

Aversion helps you manage language versions by looking at which language versions your projects use, which you have installed, and then tells you which you need to install and which you can uninstall. It also gives you an overview of every project and what language version each one is using to make upgrading them easier.

## Why?

Language version managers are great at easily installing new language versions. You can see what language versions you have installed but they don’t know anything about your projects or which language versions each project is using.

Upgrading the versions of a language your projects use happens unevenly. Over time you wind up with a bunch of projects each using a different, possibly outdated language version and a bunch of even older language versions that no project is using and could be uninstalled.

Figuring out which projects are on old language versions and need to be upgraded and which language versions can be uninstalled is tedious, and the more projects you have the more tedious it is.

Aversion is the bridge between your language version managers and your projects.

<div align="center">
  <img src="https://thepracticaldev.s3.amazonaws.com/i/8oyncbj1qi6apzshsk2x.png" width="606px">

  <br>
  <br>

  In this example `11.0.0` is in use by a project but not installed, so you know to install it, and `11.1.0` is not in use by any project, so you know to uninstall it.
</div>

[Take a look](https://github.com/brandonweiss/aversion) and let me know what you think!
MySQL: Client and Server Model Databases
Tags: mysql, client, server, database
Published: 2018-11-27 15:14:31

---
title: MySQL: Client and Server Model Databases
published: true
description: 
tags: MySQL, client, server, database
---
![](https://upload.wikimedia.org/wikipedia/en/thumb/6/62/MySQL.svg/1200px-MySQL.svg.png)
Hello fellow Javascript coders, 

In this article, we will be discussing MySQL which is a very popular database management system based on a client-server model. To get a perspective on how useful and widespread this way of structuring application is, we can take a look at the many popular webs apps that you and I use everyday including YouTube, PayPal, Google, Twitter, and Facebook. All of those platforms use MySQL to structure the different and countless amounts of data that they send and receive to and from every user on their websites. 

First, let's explore what a MySQL database is. MySQL is a database management system that can run on any platform (Linux, MacOS, and Windows) and is based on SQL (Structured Query Language). MySQL runs on the client-server model which means that the MySQL server can send client interfaces to multiple users simultaneously. These interactions with the server allow the client to send individual SQL statements in order to garner a response to their user interface. These SQL statements include ADD, DROP, INSERT, and UPDATE and can be used to adequately navigate through the database and perform a desired action on each entry.

If any random client could establish a connection with a MySQL server, there could be a potential security breach if the client had malicious intent on sabotaging the server. Luckily, MySQL has security features built in to prevent the threat from happening. MySQL uses a host-based verification system that uses access privilege and passwords to keep out anonymous dangers to the server.