teleren/devto huggingface dataset:
Escaping the call stack
Tags: javascript, stack
Published: 2019-11-07 23:35:24

Let’s look at one way to cover the tracks within injected javascript code. It exploits asynchronous javascript nature to obfuscate the function call stack. This is a continuation of the initial post on code obfuscation.

## What are we even talking about?

Call stack is best observed within exceptions, but it’s purpose is to resolve values of the called functions. It “rewinds” function calls with resulted values upon completion, but let’s not go into details.

```javascript
const first = () => {
  throw new Error()
}
const second = () => first()
const third = () => second()

third()

/* pasting this to browser's console will print something like
VM80:1 Uncaught Error
    at first (<anonymous>:1:29)
    at second (<anonymous>:2:22)
    at third (<anonymous>:3:21)
*/
```

This is an example of a call stack. Execution started at the **third()** function call and then continued to **second()** and **first()** function calls until the exception was thrown.


## Breaking free from the call stack

There are reasons you might want to break from the call stack. Most are malicious and try to cover up the tracks. Nonetheless, here is one way of stack escape:

```javascript
function maliciousStuff() {
  throw new Error()
}

function legitChunkOfCode() {
  // ...
  // code that you don't want people to easily connect with it's caller function
  setTimeout(() => maliciousStuff())
}

legitChunkOfCode()

/* pasting this to browser's console will print something like
Uncaught Error
    at maliciousStuff (<anonymous>:2:9)
    at setTimeout (<anonymous>:7:20)
*/
```

The easiest way to break off the execution chain is to set up a **timeout** call. That breaks the **synchronicity** of a function call and schedules code for some time in the future. You can’t find information about the caller function in the call stack(*legitChunkOfCode*). We’ve broken the stack and made execution much harder to follow.
Promise.resolve() everything
Tags: promise, resolve, javascript
Published: 2019-11-07 23:31:56

Ever had a block of code that, based on a condition can fetch data asynchronosuly or synchronously? In one case you’ll need to wait for the results, and in the other the results will be available at the very next “line”.

Simple trick that circles around the internet every once in a while, but is underutilized:

```javascript
const data = 'test'

// synchronous
function getData() {
  return data
}

// asynchronous
function getDataAsync() {
  return new Promise((resolve, reject) => {
    setTimeout(() => resolve(data))
  })
}

let response

// let's imagine we are fetching data based on environment variable
if (ENV_ASYNC) {
  response = getDataAsync()
} else {
  response = getData()
}

// you can see in one case response is a promise and in the other it's the data itself
// how to handle both in unified way? Use Promise.resolve

Promise.resolve(response).then(responseData => {
  // collect money here! we get the extracted data!
})
```

If you can’t understand this completely look up on how Promises work with returns and especially cases when you return nothing(undefined), data reference, or another promise.

Cheers!
Canvas and data integrity
Tags: canvas, integrity
Published: 2019-11-07 23:29:10

If you ever decide to do bitwise operations and do “bit-precise” data storing inside canvas image data, I have news for you.

First, take a pill in Ibiza and party hard:

{% youtube foE1mO2yM04 %}

2nd, get back to miserable Js dev life and confront the problem that was right in front of you whole the time.

BROWSERS ALTER RGB CHANNEL DATA BEHIND YOUR BACK!

That is, if you set the alpha channel of a pixel to any value other than 255 browser will eventually need to render that pixel to screen and represent it using RGB values. They combine alpha channel and RGB value to derive just the RGB values that represent the combination. Adding some amount of opacity to your pixels will inevitably “whiten” them.

So, when storing something to RGB channels set alpha to 255 otherwise it will mess up your data & data extracted from canvas will not remain the same!
Multiple Postgres databases in a single Docker container
Tags: docker, postgres, webdev, tutorial
Published: 2019-11-07 22:42:35

This will be a short one.

The official Postgres Docker [image](https://hub.docker.com/_/postgres) supports a few environment variables. One of them, `POSTGRES_DB`, is responsible for holding a database name. However, if you want your container to include more than one database (e.g **app** and **app_test**), you have to reach for different solutions.

One of them is to create a bash script that sets up multiple databases by `psql` command. Postgres will execute it on database startup inside the container. An example of such script, `create-multiple-postgresql-databases.sh`, can be found [here](https://github.com/mrts/docker-postgresql-multiple-databases/blob/master/create-multiple-postgresql-databases.sh). Credits to **mrts** at Github.

You can place it in whatever project directory you want, although `pg-init-scripts/` might be a good starting point. Then, to make the script visible and executable by Postgres, it has to be mounted to the `/docker-entrypoint-initdb.d` container directory.

To mount a host directory to a container directory, we have to use [volumes](https://docs.docker.com/storage/volumes/).

Syntax: `<host directory>:<container directory>`.

WARNING: You cannot mount a single file to a directory, it works just for directories.

Final `docker-compose.yml`:

```yaml
version: "3.7"
services:
  db:
    container_name: "app_db"
    image: "postgres:11.5-alpine"
    volumes:
      - ./pg-init-scripts:/docker-entrypoint-initdb.d
    environment:
      - POSTGRES_USER=${DB_USER}
      - POSTGRES_PASSWORD=${DB_PASSWORD}
      - POSTGRES_MULTIPLE_DATABASES=app,app_test
```

The `${DB_USER}` syntax means that the `DB_USER` value is read from automatically loaded `.env` file placed inside the same directory as `docker-compose.yml`.

Corresponding `.env`:

```
DB_USER=someuser
DB_PASSWORD=somepassword
```

Remember, you shouldn't commit `.env` files! Create and commit `.env-example` file with empty secret values instead.

If you want to use a different path (e.g `.env-docker`), define `env_file` in `docker-compose.yml`:

```yaml
env_file:
  - ./.env-docker
```

Now, with every piece in place, run `docker-compose up` to start the service.

Happy coding!
npm@6.13.0
Tags: npm, javascript, funding, opensource
Published: 2019-11-07 22:12:12

---
title: npm@6.13.0
published: true
description: new cli docs, npm fund command and more!
tags: npm, javascript, funding, opensource
cover_image: https://thepracticaldev.s3.amazonaws.com/i/oq83fs011p0oq9290xpr.jpg
---

I'm happy to share that I've cut a release of npm for the first time this week! 🎉 `npm@6.13.0` is out there! It was a bit stressful making sure I don't get anything wrong but all in all it's a very straightforward process as you can see in the [Release process wiki page](https://github.com/npm/cli/wiki/Release-Process) and I had the support of my entire team. ❤️

This release comes with 2 exciting new features, the first being the work from @koste4 on the new look of the browser CLI docs (the one that pops up docs in your browser when you run `npm help <command> --viewer browser`):

![new browser cli docs screenshot](https://user-images.githubusercontent.com/459713/68184716-d3b6c700-ff6d-11e9-9bd7-76bb3a4d9177.png)

---

And the second new feature we shipped in this version is the work [I've put together](https://github.com/npm/cli/pull/273) to support a new `funding` property in `package.json` - [in a bid to help the open source community](https://blog.npmjs.org/post/187382017885/supporting-open-source-maintainers) npm decided to add a [new command](https://github.com/npm/rfcs/blob/2d2f00457ab19b3003eb6ac5ab3d250259fd5a81/accepted/0017-add-funding-support.md):<br />`npm fund` that will provide more visibility to **npm** users on what dependencies are actively looking for ways to fund their work.

As part of that change, `npm install` will also show a single message at the end in order to let the user aware that dependencies are looking for funding, it looks like this:

```
$ npm install
3 packages are looking for funding.
Run "npm fund" to find out more.
```

Here is a quick preview of what the output from `npm fund` looks like:

```
$ npm fund
tmp4@1.0.0
├─┬ fund-dev-dep@1.0.0
│ ├── type: dev dep
│ └── url: http://example.com/fund
├─┬ fund-project@1.0.0
│ ├── type: individual
│ └── url: https://example.com/project/support
└─┬ sub-fund-foo@1.0.0
  ├── type: corporate
  └── url: https://corp.example.com/sponsor

```

Running `npm fund <package>` will open the url listed for that given package right in your browser.

I'm excited to see how this will evolve as we collect feedback from the community and iterate on it in the following months. 😊

---

For more info on this release and the latest news about the Community & Open Source team, go check out the npm blog post: https://blog.npmjs.org/post/188841555980/updates-to-community-docs-more

[Photo by Paul Esch-Laurent on Unsplash](https://unsplash.com/photos/oZMUrWFHOB4)
Configure Let's Encrypt + Nginx in Ubuntu 
Tags: letsencrypt, nginx, linux, servers
Published: 2019-11-07 22:09:53

---
title: Configure Let's Encrypt + Nginx in Ubuntu 
published: true
description: Guide to set up Let's Encrypt with Nginx in Ubuntu
tags: LetsEncrypt, Nginx, Linux, Servers
---

### Step-by-step guide to install Let's Encrypt certificate

###### Translated into: [Español](https://dev.to/jpblancodb/configurando-letsencrypt-con-nginx-en-ubuntu-2ini)

First, let's briefly define what [Let's Encrypt](https://letsencrypt.org) is for by quoting them.

> Let’s Encrypt is a free, automated, and open Certificate Authority.

In summary, with [Let's Encrypt](https://letsencrypt.org) we obtain a secure domain certificate (SSL) for our site and for free.

#### Steps:

1. Install [Certbot](https://certbot.eff.org) in the server:

```
sudo add-apt-repository ppa:certbot/certbot
sudo apt-get update
sudo apt-get install python-certbot-nginx
```

2. We need to modify nginx file (we are going to use the default file for simplicity):
   

```
sudo nano /etc/nginx/sites-available/default
```

Search and replace the line that contains `server_name` with: 

```
server_name domain.com www.domain.com;
```

Verify nginx configuration is correct:

```
sudo nginx -t
```

3. Restart Nginx:

```
sudo systemctl reload nginx
```

4. Installing the certificate:

```
sudo certbot --nginx -d domain.com -d www.domain.com
sudo openssl dhparam -out /etc/ssl/certs/dhparam.pem 2048
sudo nano /etc/nginx/sites-available/default
```

Add in the server section:

```
ssl_dhparam /etc/ssl/certs/dhparam.pem;
```

Let's verify again that our configuration is correct:

```
sudo nginx -t
```

Restart Nginx:

```
sudo systemctl reload nginx
```

5. Finally, we need to automatically renew our certificate because it expires every 90 days:

```
sudo crontab -e
```

and add:

```
15 3 \* \* \* /usr/bin/certbot renew –quiet
```

Done! We have our domain secure with SSL.

Lastly, we could verify the state of our certificates with certbot by executing this command:

```
certbot certificates
```

I hope this is helpful! If you have any doubts you could contact me via [Twitter](https://twitter.com/jpblancodb) or by adding a comment :)

###### Translated into Español

{% link https://dev.to/jpblancodb/configurando-letsencrypt-con-nginx-en-ubuntu-2ini %}
Internet 24 years ago and nowadays
Tags: humor, jokes
Published: 2019-11-07 21:17:48

*Bill Gates answering David Letterman's questions about what the internet can offer, 24 years ago.*

{% twitter 1190694088590462976 %}

Time goes really quickly... This conversation happened only a couple of decades ago, the future of the internet was uncertain but nowaways we know, for sure, how Internet is 




<img src="https://www.therpf.com/forums/attachments/20170131_102724-jpg.702786/" alt="internet">
How my MindMaps helped others clear AWS certification
Tags: aws, productivity
Published: 2019-11-07 21:09:38

One fine morning I woke up and thought that I would like to get AWS certified. I did do the groundwork in a real passive manner for over a period of 4-5 months in 2018. Fast Forward to the above mentioned morning, so yes let me do it and I bought that Udemy course. It has been almost 3000 days I have given a test so I was not sure how my DAD brain will perform compared to BOY brain 3000 days ago. So I read this book "Unlimited Memory", totally unwanted effort but I learnt about MindMaps. For AWS Developer Associate you need to remember a lot of facts and I forcefully fit in the MindMaps here. I bought a monthly subscription of ~2$ from MindMup.com and created topic based MindMaps. Less I knew back then that it's going to be useful to a handful of people to actually clear the exam including me. I have got a lot of good feedback and Linkedin requests based on the same. My vlog floats up in Top 10 "How to Clear AWS Developer Associate Exam" on YouTube. I'm not going to sell my YouTube link here but let me know if you find me :-)

I'm new to DEV and though that I might give something with my first post here. 

https://www.notion.so/AWS-Mind-Maps-Developer-Associate-4ae243fc3779433a9cbf77592b31d5e0
🚀 Tech Internships
Tags: watercooler
Published: 2019-11-07 21:07:26

I interned at LinkedIn the summer before I graduated.

In the last week, they gave me an offer to return full-time after graduating. Not everyone has this chance.

56% of interns get an offer to return full-time. Internships are the *best* way to get your first job. Unfortunately, under-privileged students can't afford to take on unpaid internships.

At Levels.fyi, our mission is to help people make better career decisions. We're launching our Internships page (https://www.levels.fyi/internships/) today to help students start their careers. I've gathered some quick tips below:

💡 Internship Tips:
	- *Apply Early* - Aug. through Dec. of previous year
	- *Apply Everywhere* - I applied to over 100 internships and was accepted to less than 3
	- *Get a Referral* - It's likely the largest factor why I got one. Comment if you'd like advice on this.
	- *Prepare* - Focus on the raw skills. For Software interns, this means data structures & algorithms problems.
	- *Deliver* - Internships are the time to push. Make it easy for your mentor / manager to give you an offer by going above and beyond.
Typescript Decorators for HTTP Server controllers and routes
Tags: typescript, node, decorators, express
Published: 2019-11-07 21:00:55

Backend devs, I launched a library to create HTTP routes in a very simply and directly way on an express server, using only Typescript decorators. I would like your opinions, reviews, tips and so on. If you can leave a star, would make me happy!



https://github.com/MutterPedro/digjoy
Distributed Rant Series Part 1
Tags: distributed, go, python, security
Published: 2019-11-07 20:14:21

---
title: Distributed Rant Series Part 1
published: true
description: A tale for a distributed era (Tech Rant)
tags: Distributed, Go, Golang, Python, security
---

In this rant series I would like to discuss a little bit about the new era of software development, users trends, security an son on.

While that verbose rant is going I will introduce a series of guides to design , prepare,code and deploy micro applications using GO.

First Question ... why GO?

Well... Go is simple, very simple to learn, is cross-platform (or at least easier than many) is super fast compare with other cross-platform frameworks, the community is growing exponentially fast.

* Building with Go in my opinion has major takeaways.

* Simplicity of deployment and roll outs.

* Security, as long as you care about the communication layer. 

* Performance, as many task can be delegated to the client in a more efficient way.

For the sake of order, we will be following , generally this index:

- Structuring Go Projects ( What I found to be more easy to follow)
- Golang Web with net/http and Gorilla Mux
- Templating with GO
- Serving Vue.js application (Why Vuejs... well...check later)
- Embedding databases ( bbolt with a few disclaimers and twists)
- gRPC , protobuf
- Client Server Communication
- Security, TLS and mtls.
- Publishing on the internet, securing applications,

So we have a quite to cover.

Let's narrow a bit the scope for those looking for specifics...

We are going to talk about distributed systems while we code server-less applications, that can serve as both client and server, that can run locally to the user and communicate remotely.

**[RANT START HERE]**

Why? Well we are in the verge of a big change, or at least we are witnessing a technological revolution.

New generations grow with tech in their cribs. They consume information faster and at a younger age. So it's only reasonable that we need to start considering this to build the next layers of society.

We witness the danger of monopoly in a digitized world. Major vendors control influences, tells us what to do, what to wear, and people are seeking more resilient and dependable services. 

New generations are seeing this, and freedom, or what we know as freedom has become an emblem. 

But freedom without responsibility, without accountability, is not freedom. True freedom is both, being accountable and own our decisions.

And in this verge is where us, the older generations, and the systems we lay and build, along with the speed and the new technology grown humans can have a chance for creating self sustain , resilient, mature software. 

In this "extremely extensive" series will try to give my grain of sand, by teaching what I believe is the root for owning software.
 

**[END OF RANT ]**
 

Hope you enjoy it :)
Configurando LetsEncrypt con Nginx en Ubuntu
Tags: letsencrypt, nginx, linux, servers
Published: 2019-11-07 19:56:41

---
title: Configurando LetsEncrypt con Nginx en Ubuntu
published: true
description: Guía para configurar paso a paso LetsEncrypt con Nginx en Ubuntu.
tags: LetsEncrypt, Nginx, Linux, Servers
canonical_url: https://jpblanco.dev/posts/2019-11-07-configurando-letsencrypt-con-nginx/
---

###### Traducido al: [English](https://dev.to/jpblancodb/configure-let-s-encrypt-nginx-in-ubuntu-bph)

En primer lugar, deberíamos preguntarnos para que sirve LetsEncrypt y nada mejor que citarlos para entender:

> Let’s Encrypt is a free, automated, and open Certificate Authority.

En resumen, con LetsEncrypt obtenemos un certificado de dominio seguro, el famoso SSL para nuestro sitio y de forma gratuita. Todo esto gracias a la Linux Foundation.

Hecha ya la introducción, pasemos a lo que nos interesa que es como lo configuramos en un servidor linux con Nginx

1. Instalamos certbot en el servidor:

```
sudo add-apt-repository ppa:certbot/certbot
sudo apt-get update
sudo apt-get install python-certbot-nginx
```

2. Configuramos el archivo de Nginx:
   (En este caso como ejemplo usamos el archivo default)

```
sudo nano /etc/nginx/sites-available/default
```

Buscamos la linea que contiene `server_name` y la reemplazamos por: 

```
server_name dominio.com www.dominio.com;
```

Verificamos que la configuración de nginx sea correcta con:

```
sudo nginx -t
```

3. Reiniciamos Nginx:

```
sudo systemctl reload nginx
```

4. Instalando el certificado:

```
sudo certbot --nginx -d dominio.com -d www.dominio.com
sudo openssl dhparam -out /etc/ssl/certs/dhparam.pem 2048
sudo nano /etc/nginx/sites-available/default
```

Agregamos dentro del bloque server:

```
ssl_dhparam /etc/ssl/certs/dhparam.pem;
```

Volvemos a verificar que nos haya quedado bien:

```
sudo nginx -t
```

Reiniciamos Nginx nuevamente:

```
sudo systemctl reload nginx
```

5. Configuramos la renovación automática del certificado:

```
sudo crontab -e
```

En nuestro archivo agregamos:

```
15 3 \* \* \* /usr/bin/certbot renew –quiet
```

De esta forma nos aseguramos que se renueve de forma automática nuestro certificado, dado que caduca cada 90 días.

Listo! Ya tenemos nuestro SSL configurado y funcionando!

Por último, si queremos verificar el estado de nuestros certificados con certbot para verificar la fecha de expiración o por ejemplo los dominios que tenemos registrados en nuestro servidor con LetsEncrypt, debemos ejecutar lo siguiente:

```
certbot certificates
```

Cualquier duda o consulta no duden en dejar sus comentarios o bien me pueden consultar vía twitter.

Saludos!


###### Traducido al inglés

{% link https://dev.to/jpblancodb/configure-let-s-encrypt-nginx-in-ubuntu-bph %}
Beginner Vue.js Tutorial with User Login
Tags: javascript, vue, programming
Published: 2019-11-07 19:48:37

---
title: Beginner Vue.js Tutorial with User Login
published: true
description: Learn how to build a Vue.js application from scratch and add authentication.
tags: #javascript #vuejs #programming  
canonical_url: https://auth0.com/blog/beginner-vuejs-tutorial-with-user-login/
---
TL;DR In this article, I'm going to show you how to build a Vue website that will showcase events hosted by an organization. Users will be required to sign in to view details of an event, so we'll also be adding authentication to the website. We'll go over some Vue background, Vue application structure, creating components, setting up routing, and styling with Bulma. You can find the final code in this GitHub repository if you'd like to see the end result now.

[Keep reading 🚀] (https://auth0.com/blog/beginner-vuejs-tutorial-with-user-login/?utm_source=twitter&utm_medium=sc&utm_campaign=beginner_vuejstut)
#codevember - 07 - Animated Shapes Loading Screen
Tags: codepen, webdev, svg, animated
Published: 2019-11-07 19:46:24

I decided to do this Codevember about loading screens, this isn't what I really wanted but it isn't so bad, please leave feedback.

{% codepen https://codepen.io/zadquieljlp/pen/eYYrrLB %}
Where can I ask for help for my Open Source projects?
Tags: opensource, contributorswanted, javascript
Published: 2019-11-07 19:34:04

Hi there!

**Where/how** do you guys ask for **help** for your Open Source projects? I've been searching with no success. 

I've got a couple of Javascript projects that could do with some help, and don't know how to look for contributors.

These are the projects in case any of you want to check them out:
* [Loggin'JS](https://github.com/loggin-js/loggin-js) - A node-js/browser logger
* [Strif](https://github.com/nombrekeff/strif) - String formatter

Anyways, any help is appreciated!
Cheers.