teleren/devto huggingface dataset:
NPM... we all knew this would happen eventually
Tags: discuss, npm, security, javascript
Published: 2018-11-27 14:23:26

---
title: NPM... we all knew this would happen eventually
published: true
description: A small view on a recent security issue
tags: #discuss #npm #security #javascript
---

I remember reading [this article](https://hackernoon.com/im-harvesting-credit-card-numbers-and-passwords-from-your-site-here-s-how-9a8cb347c5b5) when it first came you in Medium

Some highlights from the article
> The following is a true story. Or maybe it’s just based on a true story. Perhaps it’s not true at all.

> Although this is all made up, it worries me that none of this is hard.

> There’s no shortage of smart, nasty people out there, and 580,000 npm packages. It seems to me that the odds are better than even that at least one of those packages has some malicious code in it, and that if it’s done well, you would never even know.

It's dated to Jan 6 2018, nine months later we have this 
[I don't know what to say.](https://github.com/dominictarr/event-stream/issues/116)

This all reminds me of [Murphy's Law](https://en.wikipedia.org/wiki/Murphy%27s_law).

I know there is already a [post](https://dev.to/nepeckman/how-do-we-improve-security-in-the-npm-ecosystem-3hmj) discussing about how to improve security, but what worries me the most is how **toxic** the Github thread became. Quoting them here would get me banned.

I know this is **a very very serious issue**, but let's say your new to open-source or coding in general and you finally manage to make a project that is useful to the community. 

One day you open your repository to find ~500 comments, people shouting at how you screwed up big time and you don't know why. That isn't the best community experience.

I've always thought the [MIT license](https://opensource.org/licenses/MIT) mentioned that this can happen
> THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND

I personally was using [Electron](https://github.com/electron/electron) before from [tux0r](https://dev.to/tux0r) from this community pointed out [this](https://www.trustwave.com/Resources/SpiderLabs-Blog/CVE-2018-1000136---Electron-nodeIntegration-Bypass/)

> This makes XSS particularly dangerous, as an attacker's payload can allow do some nasty things such as require in the child_process module and execute system commands on the client-side

[Link to the actual comment](https://dev.to/tux0r/comment/6gh3), a small shout out thanks

Big shots do screw up
- [OpenSSL](https://en.wikipedia.org/wiki/OpenSSL#Notable_vulnerabilities)
- [Spectre](https://en.wikipedia.org/wiki/Spectre_(security_vulnerability))
- [Meltdown](https://en.wikipedia.org/wiki/Meltdown_(security_vulnerability))

What pops to my mind is [this from Donald Knuth](https://youtu.be/v678Em6qyzk?t=388)

> Err 
> and err 
> and err again 
> but less 
> and less 
> and less
3 Unrelated Things I Learned Developers Should Do
Tags: webev, beginners, advice, life
Published: 2018-11-27 14:19:39

---
title: 3 Unrelated Things I Learned Developers Should Do
published: true
description: Not everything has to be about the code you write. It's good to take a break and do something else.
tags: #webev, #beginners, #advice, #life
---

There's more to life than writing code or being a technical wizard. Developers should know how to do way more than that or else they won't remain good developers for long. You can strive to have a great career and still be a whole person.

Here are three completely unrelated things that every developer should be able to do:

##Make new hobbies

You have to have some other interests in life. Coding is cool, but it's not really something you should be doing 24/7. That's just unhealthy. It's easy to get absorbed into learning as much about web development as you can and it's ok to fight that urge occasionally.

Remember your other hobbies like whittling wood or playing the ukulele. You're not a code writing robot so enjoy the other parts of your brain. If there's a new restaurant you've been thinking about trying, go check it out. Just step away from the editor for a while and relax.

##Exercise

There's no need to work out like an athlete, but you do need to get up and move. When you're working on code all day it's easy to sit at a screen and not move for hours. It's one of the absolute worst things you can do for your health and your coding abilities.

Even if you just go for a walk around the block or pace around for a few minutes, get up and move. Do it now if you've been sitting down for over an hour. Your health is the most valuable thing you have so don't forget about it.

##Read people

People reading is an art. You're used to looking at the smallest details in your code so why not observe the details of the people you work with? Learn what makes the people around you tick and it'll help improve your ability to get things done both at work and at home.

This is a skill that will help you ten times more than any technical skill you can learn. If you ever decide to freelance or you need to get a new job, knowing how to read people will help you tremendously. It takes some time to get good at reading people but once you know how to do it, you'll be the most powerful developer out here.

You can do so many other things that aren't on this list. The main thing is for you to *do* those other things. Improving your programming skills is great, but so is improving your tap dancing skills. Live your life outside of the editors. Please!

<hr>

Hey! You should follow me on Twitter because reasons: https://twitter.com/FlippedCoding
Reason Town 13 - Auto-serialization and Full Stack Reason
Tags: reason, podcast, node, fullstack
Published: 2018-11-27 13:57:09

---
title: Reason Town 13 - Auto-serialization and Full Stack Reason
published: true
description: Jared and Murphy talk about Jared's work to support generating serializers for types that support migrations, and about full-stack Reason at Day One.
tags: reasonml, podcast, node, full stack
---

Reason Town 13 - Auto-serialization and Full Stack Reason
https://reason.town/13

Jared and I had a fun conversing last night about our projects.

Hosting sponsored by [TylerMcGinnis.com](https://tylermcginnis.com/):
The linear, course based approach to learning web technologies.

Sponsored by Day One

* [Bucklescript Roadmap](https://bucklescript.github.io/blog/2018/11/19/next-half) 
	* OCaml (4.06)
	* Inline records
	* Better syntax error messages
* [Web Assembly Update](https://medium.com/@sanderspies/a-webassembly-backend-for-ocaml-b78e7eeea9d5)
* [The Event Stream Fiasco](https://github.com/dominictarr/event-stream/issues/116)
* Jared’s project: Auto-serialization
	* No links yet!
* [Error handling & Murphy’s blog post](https://dev.to/splodingsocks/an-approach-to-handling-errors-in-a-reasonml-express-web-app-1o40)
* Murphy’s Project: Day One gifts!
	* Implemented in about two weeks.
	* Server in Reason / Node
	* Client in Reason / React
* Picks
	* Jared: [Reason-expo](https://github.com/FiberJW/reason-expo)
	* Murphy: [Keyboardio](https://shop.keyboard.io/)

We want to hear from you about your stories with Reason in production!
Please email jared@reason.town or murphy@reason.town.

And we’d love it if you would rate us on iTunes or whatever podcast client you use.
The Git interface that i want to use
Tags: git
Published: 2018-11-27 13:37:50

---
title: The Git interface that i want to use
published: true
description: 
tags: #git
---

This is purely an idea, but i think it's potential to make programming fun again with `git`.

Imagine we have a command `enter-git-mode`

Our terminal turns into `git mode`. What can it do ?

- Making new folder.

Behind the scene, git will create new branch for us, so that whenever we want to enter, `cd foo/`, we're inside the `foo` branch.

- Moving files.

Now after you edited the code, you want to commit it to a branch, just use the famous: `mv file foo/`, git will commit the saved `file` to `foo` branch.

In general, we need a `git mode` that will map our folder commands to git command.

Hope this's an idea for a fun hacking weekends for everyone.
The frustration of confounding expectations
Tags: development, requirements, userexperience, ux
Published: 2018-11-27 13:06:40

---
title: The frustration of confounding expectations
published: true
tags: development,requirements,userexperience,ux
canonical_url: https://craignicol.wordpress.com/2018/11/27/the-frustration-of-confounding-expectations/
---

[![Icons on the microwave : heat water with a spoon in it. There is a glass of water without a spoon with a cross through it.](https://craignicol.files.wordpress.com/2018/11/img_20181119_224243.jpg?w=352&h=198)](https://craignicol.files.wordpress.com/2018/11/img_20181119_224243.jpg)<figcaption>Spoons in the microwave</figcaption>

After years of being told no metal in microwave, it still feels too weird to follow the instructions on my new microwave to use a spoon when boiling water. There’s a sticker telling me I have to add a spoon when microwaving water but I don’t see myself ever doing that because the “no metal” is so ingrained, and I’ve seen plenty of lightning videos from people who have done it.

[![A lift control panel with a numeric keypad and the letter C in the display](https://craignicol.files.wordpress.com/2018/11/dsc_0045.jpg?w=748)](https://craignicol.files.wordpress.com/2018/11/dsc_0045.jpg)<figcaption>Abstraction in lift design</figcaption>

This picture is from the lifts at the local hospital. You press a floor number (rather than up/down) and the display responds with a letter telling you which lift to catch. This additional abstraction confuses many users, as I discovered helping people use them as I was taking a coffee break.

I see the same thing on a lot of websites. Those “cool” websites that break scrolling by moving things sideways or zoom in as I scroll down. SPA sites that break the back button. Using outlook web access on a mobile browser is painful. I keep getting the “Are you sure you want to resend?” or the login prompt when I try to go back to my message list from an email.

I’ve never been a great visual web designer, [I’m definitely a function-over-form type](https://craignicol.wordpress.com/2016/04/15/smart-is-subtle/), but I’ve always started with the principles that came to be known as progressive enhancement. Make it work in the simplest way, and add the bells and whistles on top of a strong, accessible foundation. That foundation has shifted from HTML, to HTML+CSS+JS, to TSX in my latest projects, and from desktop to mobile throughout, but it is always based on the basic principles of text and forms : easy to read, easy to follow, and works the way you expect it to.

If you’re trying hard to stand out by breaking expectations, what are you trying to hide?
Vue form components with validation
Tags: vue, form, validation
Published: 2018-11-27 13:06:29

---
title: Vue form components with validation
published: true
description: Vue form components with validation
tags: vue, form, validation
---

[![logo](https://thepracticaldev.s3.amazonaws.com/i/env44pktfp558jkb4vch.png)](https://antonreshetov.github.io/vue-form-components)

I would like to share my small open source project for creating forms with validation on Vue.

The project has a simple and minimalistic design.

Of course, along with the large libraries by building a UI on Vue, mine is a drop in the ocean, but still I wanted to do something for the open source community, to contribute to say so. And of course I wanted to raise my skills in developing components on Vue.

If the project is interesting to anyone or you have any questions, always happy to talk on this topic.

The composition of the components:

- Input (also Textarea)
- Select
- Checkbox
- Radio
- Button
- Form

Thanks for attention!

https://antonreshetov.github.io/vue-form-components
User stories in a mixed software/hardware environment
Tags: agile, projectmanagement, systems, discuss
Published: 2018-11-27 13:05:35

---
title: User stories in a mixed software/hardware environment
published: true
description: Doing agile things in a bespoke systems team
tags: agile, project management, systems, discuss
---

I'm a team lead for a small team of devs.  We've been Agile-ish for a few years but there are a few areas causing problems.  The main one is getting good user stories for things that users don't care/know about.

We deliver embedded solutions that are a mixture of hardware and software.  There's a lot that has to happen that doesn't relate easily to the user requirements.

For instance, they might want a system to check the distribution of pepperoni on a pizza (yes, really).  We'd probably treat that high level requirement as a epic and break it down it down into things like:

_As a Production Engineer I want to make sure there is no more than 10 grams of pepperoni on the pizza so that I can meet my efficiency target_

_As a QA manager I want to ensure the pepperoni is evenly distributed across the pizza so we don't get complaints from the supermarkets._

But I feel there's potential for things to get missed.  We might need to spend 20 days designing a pepperoni detection algorithm  or we might have to spend 10 days designing and building an electrical cabinet.  

I don't want to leave them 'hidden' within larger stories.  I'd like those tasks to emerge as part of the story process.  But it feels a bit forced.  Who would be the user for a story about an electrical cabinet?


Any suggestions appreciated!
The Happy World of ngrok
Tags: productivity, technology, csharp, webdev
Published: 2018-11-27 12:46:50

---
title: The Happy World of ngrok
published: true
description: A little insight into ngrok - the tool that enables secure access to localhost development
tags: productivity, technology, csharp, webdev
---
Current favourite tool: <b>ngrok</b>

<ul><li>Have you ever wanted to share something still in development with a product manager, project manager or even another developer just so they could give it a quick click through, maybe give you some pointers, nothing too intense?</li>
<li>Have you ever been working with a third-party service (Mailchimp, SendGrid, SparkPost, Twilio, Authy, the list goes on…) and want to use a webhook to channel data around on a dev site?</li>
<li>Have you ever been giving a dev talk and thought “it would be great if people could just access this site I’m running locally”, but you don’t want to deploy anything?</li></ul>

Ngrok is the answer. It’s a command line tool that gives access to your local server using a secure URL and an excellent debugging/inspection panel to boot.

It is the best thing. No, really. I am prone to occasional geeking-out on technology-fronts (a certain ramble about how finding the perfect monitor configuration could equate to finding true love springs to mind), but trust me on this one.

Reasons why you should love ngrok as much as I do:

<ol><li>It’s free! (I mean, you can pay if you want custom subdomains etc, but for most development/testing needs the free version is where it’s at)</li>
<li>It’s as easy as cmd <code>ngrok http 80</code> and boom, you’re up and running</li>
<li>But what if you’re running on IIS express? That’s super easy too:
<code>ngrok http -host-header="localhost:[port-number]" [port-number]</code></li>
<li>The inspection panel is unexpectedly helpful, I’ve never felt so supported by a tool. I mean, I love Fiddler, but there’s just so much functionality I often feel like I’m shortchanging it a bit... (like someone built me a mansion and I’ve moved into the larder to live)</li></ol>

Just to be clear, I am in no way affiliated with ngrok or it’s devs, I am just excitable when it comes to speeding up my own dev processes!

Download it here: https://ngrok.com/download
Suggestions for Open Source DB for anomaly detection?
Tags: backend, database, security, architecture
Published: 2018-11-27 12:06:54

---
title: Suggestions for Open Source DB for anomaly detection?
published: true
description: Looking for suggestions on DB or system that is meant to detect spikes or unusual activity given time-series input of events. Ideally with a dashboard. :) Thanks in advance.
tags: backend, databases, security, architecture
---
Build a blog application on Google App Engine
Tags: javascript, node, googlecloud, tutorial
Published: 2018-11-27 10:31:10

---
title: Build a blog application on Google App Engine
published: true
description: Node.js tutorial on how to build an app on Google App Engine
tags: javascript, node.js, google cloud, tutorial
---
![Blog application on Google App Engine](https://thepracticaldev.s3.amazonaws.com/i/wxakdlx6fct35ibniwm8.jpeg "Blog application")

Hi there!

I've just [published a multipart tutorial on Medium on **how to build a blog application on Google App Engine using the Datastore**](https://medium.com/@sebelga/build-a-blog-application-on-google-app-engine-setup-part-1-38dab981b779) to store the content.

I share it here in case it might be useful to someone :)

Cheers!
A Great Video List of Clean Code in Js
Tags: freecodecamp, cleancode, video, javascript
Published: 2018-11-27 10:27:24

---
title: A Great Video List of Clean Code in Js
published: true
description: 
tags: freecodecamp, cleancode, video, javascript
---

* varibles
* functions
* objects
* classes
* SOLID
* testing, concurrency, error
* formating, comments

Last: Programmer's Oath

Short videos, great for learning.
From Beau teacher, Freecodecamp.org

[link-->](https://www.youtube.com/playlist?list=PLWKjhJtqVAbkK24EaPurzMq0-kw5U9pJh)
What makes a company culture great?
Tags: showdev, discuss
Published: 2018-11-27 08:26:24

---
title: What makes a company culture great?
published: true
description: Which company treats are matters and which ones are bullshit?
tags: showdev, discuss
cover_image: https://thepracticaldev.s3.amazonaws.com/i/dp5870zhpamkvoh10gfa.jpg
---

Corporate culture plays a huge role in the success of businesses. No matter how cool is the product or how challenging is the problems, if the working environment is toxic, the employees will find another job. Business might try using financial motivation, but it's not a secret that is the worst kind of motivation for creative professions. The only way to attract and keep the top talent is providing a working environment that allows realizing themselves maintaining life-work balance.

But what's that means? I've decided to find the answer to this question, so I've built [Cultural Fit](https://cultural.fit/). It's a collaborative list of corporate culture traits that people love or disapprove.

I invite DEV community to help me find the answer: please vote for your favorite traits and downvote the ones you don't approve. Add missing traits and share your opinion here, in the post, or on the site:

[![](https://thepracticaldev.s3.amazonaws.com/i/bkma29aia7yjse4hatvc.png)](https://cultural.fit/)

I've build this project for [Product Hunt Makers Festival 2018](https://www.producthunt.com/makers-festival-2018). This is universal Preact app. It's build using TypeScript on top of Firebase (Firestore, Firebase Hosting, Firebase Functions). 

Any kind of feedback is welcome!

Thanks!
What would you like people to know about programming?
Tags: discuss
Published: 2018-11-27 08:17:34

---
title: What would you like people to know about programming?
published: true
tags: discuss
---

Programming has come to encompass all of society. There is no area of our lives that isn't somehow touched upon by code. In some ways our profession has come a long way in the past 30 years, in other ways it has not. 

A lot of programmers end up getting trapped, or lost, in a bubble without seeing a clear path to improve. Even if those that want to branch out are often left uncertain of what is out there.

What do you think all programmers should know? I'm thinking in terms of high-level or large things, like issue systems, clean coding, prioritization, working with graphics guys and dealing with perplexing defects.

----
 
This type of question, and the answers, will be the focus of the new books I'm writing. If you want to be kept informed of the progress, you can [join my mailing list](http://edaqa.com/on_programming/)
Angular: Refetch data on same URL navigation
Tags: frontenddevelopment, angularrouter, typescript, angular
Published: 2018-11-27 17:12:16

---
title: Angular: Refetch data on same URL navigation
published: true
tags: front-end-development,angular-router,typescript,angular
---

#### Different approaches with their pros and cons

![](https://cdn-images-1.medium.com/max/2000/1*HdF1NiaTQUXwN4V1zp57Ag.jpeg)

Real time applications normally use WebSockets or some server push technology. In case the backend doesn’t support a push technology we often use some sort of polling mechanism to get the latest data.

However there are use cases where we want to give control to the user and let him decide when the data should be refreshed. For example by clicking on a refresh button or a route navigation item while that particular route is already displayed.

By default the router doesn’t emit router events when we try to navigate to the same URL that is already activated. Which generally is a good thing.

But how can we refetch data on route refresh? 🤔

[Find out more...](https://medium.com/@kevinkreuzer/refresh-current-route-in-angular-512a19d58f6e)
How to signing digital signature for macos app bundle and linux executable
Tags: help, discuss, linux
Published: 2018-11-27 04:30:19

---
title: How to signing digital signature for macos app bundle and linux executable
published: true
description: 
tags: #help #discuss #linux
---
I have an java swing application and building executable for three platform Window (exe), macOS(.app) an linux(.sh). I also have a .p12 certificate file and signed for exe file on windows and can check as digital signature tab in properties. But when I try with macos and linux, I confuse that is there we can assign p12 certificate to macOS app (.app) and linux ( .sh) like window (exe) on the linux build server ?
I used linux build server to build executable for three platform

Thanks all.
Happy coding ..
Recruiters we all hate them!
Tags: recruiters
Published: 2018-11-20 11:31:01

---
title: Recruiters we all hate them!
published: true
description: Pretty much in the title
tags: #recruiters
---
So I will start this by saying I am a recruiter.

BUT...

I have been a recruiter for nearly 12 years and all of those have been in recruiting software developers.

I thought I would write this article because I joined this board to genuinely understand more about the technology I work with, to understand the people and to understand market trends.
Sadly the issue I see is the same as on sites liked LinkedIn, everyone hates recruiters.

So I thought I would try to put another angle across to you all.

Do you have any idea how hard is it to be a recruiter? 

No this isn't a sob story this is a simple question?

I work long hours for zero commission if I don't place anyone. There seems to be a strange opinion we are paid fantastic amounts of money and actually do very little. The truth is the opposite we get paid well if we work incredibly hard and during this time of working hard expect to be hated by everyone (for no real reason) lied to by the people you represent, treated as an inconvenience, disrespected and if you find something else before I place you feel free to not attend an interview, not answer your phone and potentially destroy my relationship with a client for no reason at all...

But we are hated? Seems strange. 

Many of us work really hard and actually genuinely try to be good people. Why is it that if one person doesn't get a job or is treated in way they dislike an entire sector (110,000 people + in the UK alone) are universally criminalised? 

So in ending I would like to ask why we are all so bad?