This document discusses Beautiful Bash, a community-driven effort to promote best practices for writing Bash scripts. It outlines common bad coding styles, recommends modern approaches like testing and linting, and aims to create a definitive style guide through community contributions. The presenter argues that Bash is still widely used and can be developed defensively through techniques like testing, error handling, and modular functions.
The document discusses web application security and provides an overview of common vulnerabilities like SQL injection, cross-site scripting (XSS), and cross-site request forgery (CSRF). It summarizes the OWASP Top 10 list of most critical web app security risks, including injection flaws, broken authentication, sensitive data exposure, and more. The document also offers best practices for developing more securely, like using prepared statements, validating and sanitizing input, and implementing authentication and session management properly.
This document discusses SQL injection (SQLI), which is a code injection technique used to attack data-driven applications. SQLI works by inserting malicious SQL statements into entry fields for execution on the backend database. This allows attackers to read sensitive data, modify database contents, and perform administration tasks. The document outlines common SQLI attack methods like error-based and union-based techniques. It also categorizes SQLI attacks as in-band, inferential/blind, or out-of-band based on how results are returned. Examples are provided to illustrate how SQLI exploits vulnerabilities in dynamic SQL queries.
This document discusses Jenkins Pipelines, which allow defining continuous integration and delivery (CI/CD) pipelines as code. Key points:
- Pipelines are defined using a Groovy domain-specific language (DSL) for stages, steps, and environment configuration.
- This provides configuration as code that is version controlled and reusable across projects.
- Jenkins plugins support running builds and tests in parallel across Docker containers.
- Notifications can be sent to services like Slack on failure.
- The Blue Ocean UI in Jenkins focuses on visualization of pipeline runs.
1. The document discusses RESTful APIs and gRPC, comparing their characteristics and use cases.
2. RESTful APIs typically use HTTP and JSON to access resources via URLs while gRPC uses protocol buffers and HTTP/2 for efficient streaming and RPC.
3. gRPC is better suited for microservices and mobile apps due to its ability to handle streaming and performance, while REST is more widely used due to its simplicity and support in most languages.
+ Background & Basics of Web App Security, The HTTP Protocol, Web.
+ Application Insecurities, OWASP Top 10 Vulnerabilities (XSS, SQL Injection, CSRF, etc.)
+ Web App Security Tools (Scanners, Fuzzers, etc), Remediation of Web App
+ Vulnerabilities, Web Application Audits and Risk Assessment.
Web Application Security 101 was conducted by:
Vaibhav Gupta, Vishal Ashtana, Sandeep Singh from Null.
This document provides an overview of common web vulnerabilities and techniques for exploiting them using a vulnerable web application called DVWA (Damn Vulnerable Web Application). It discusses low-level vulnerabilities like brute force attacks, command injection, CSRF, file inclusion and SQL injection. It then goes into more detail on different SQL injection techniques like concatenation, error-based detection, union queries, retrieving data from tables. It also covers blind SQL injection, file uploads, and both reflected and stored cross-site scripting vulnerabilities. The document appears to be an introduction or guide to using DVWA to learn about hacking web applications.
This document discusses injection vulnerabilities like SQL, XML, and command injection. It provides examples of how injection occurs by mixing commands and data, including accessing unauthorized data or escalating privileges. The speaker then discusses ways to prevent injection, such as validating all user input, using prepared statements, adopting secure coding practices, and implementing web application firewalls. The key message is that applications should never trust user input and adopt defense in depth techniques to prevent injection vulnerabilities.
SSRF vs. Business-critical applications. XXE tunneling in SAPERPScan
Any information an attacker might want is stored in a company’s ERP. This information can include financial, customer or public relations, intellectual property, personally identifiable information and more. Industrial espionage, sabotage and fraud or insider embezzlement may be very effective if targeted at the victim’s ERP system and cause significant damage to the business.
The presentation describes the history of SSRF attack, or Server Side Request Forgery, its types and different kinds of attacks on SAP.
Jenkins is an open-source tool for continuous integration that was originally developed as the Hudson project. It allows developers to commit code frequently to a shared repository, where Jenkins will automatically build and test the code. Jenkins is now the leading replacement for Hudson since Oracle stopped maintaining Hudson. It helps teams catch issues early and deliver software more rapidly through continuous integration and deployment.
Taintgrind is a Valgrind tool that performs dynamic taint analysis by tracking tainted data through a program as it is executed. It can be used to perform reverse taint analysis to identify the origin of a crash by tainting the crashing instruction and tracking the taint backwards. Rtaint is a script that analyzes Taintgrind logs to produce graphs and slices showing the propagation of tainted values. Reverse taint analysis with these tools was able to determine the root cause for many crashes by tracing tainted inputs backwards from the crash site.
The document discusses cyber security topics like web security, Zed Attack Proxy (ZAP), SQL injection, Damn Vulnerable Web Application (DVWA), and WebGoat. It provides an overview of these topics, including what ZAP is used for, how to configure it, and how to use its features like intercepting traffic, scanning, and reporting. It also discusses the Open Web Application Security Project (OWASP) and some of the top 10 vulnerabilities like SQL injection.
Building flexible ETL pipelines with Apache Camel on QuarkusIvelin Yanev
This document discusses building flexible ETL pipelines with Apache Camel on Quarkus. It begins with an overview of what ETL is and the extract, transform, load process. It then discusses what Apache Camel is and how it is an open source integration framework that allows defining routing and mediation rules. The document introduces Camel K and Camel Quarkus, noting that Camel Quarkus brings Camel's integration capabilities to the Quarkus runtime. It argues that Apache Camel and Quarkus is a good combination for efficient ETL due to Camel's easy learning curve and extensibility and Quarkus' benefits like low memory usage and fast startup times. The document concludes with a demo
DevOps Continuous Integration & Delivery - A Whitepaper by RapidValueRapidValue
In this whitepaper, we will deep dive into the concept of continuous integration, continuous delivery and continuous deployment and explain how businesses can benefit from this. We will also elucidate on how to build an effective CI/CD pipeline and some of the best practices for your enterprise DevOps journey.
Reconnaissance denotes the work of information gathering before any real attacks are planned. The idea is to collect as much interesting information as possible about the target. The methodology described here increases the assets for testing and thus increasing the scope of finding vulnerabilities.
Hi Everyone,
This presentation is on Logical Attacks it can be helpful in Bug Bounties while doing Bug Hunting, Vulnerability Research in web applications, mobiles(andriod, ios, win), webservices, apis etc and for making a career in information security domain.
Its not an introduction to Web Application Security
A talk about some new ideas and cool/obscure things in Web Application Security.
More like “Unusual Bugs”
** DevOps Training: https://www.edureka.co/devops **
This Edureka tutorial on "Jenkins pipeline Tutorial" will help you understand the basic concepts of a Jenkins pipeline. Below are the topics covered in the tutorial:
1. The need for Continuous Delivery
2. What is Continuous Delivery?
3. Features before the Jenkins Pipeline
4. What is a Jenkins Pipeline?
5. What is a Jenkinsfile?
6. Pipeline Concepts
7. Hands-On
Check our complete DevOps playlist here (includes all the videos mentioned in the video): http://goo.gl/O2vo13
A Story of Cultural Change: PayPal's 2 Year Journey to 150,000 Containers wit...Docker, Inc.
Adopting containers at scale is fundamentally a cultural change. In late 2015, PayPal decided to migrate en masse to containers for applications built on many different frameworks over the last 15 years. It was a bold and strategic plan that included how to showcase value of containers to leadership, a phased execution strategy, building the right team to lead, and cultural transformation. Changing application code, deployment methods, and operational tools were at onset non-negotiable. This session will share how the plan was pitched and the learnings that unfolded as PayPal carefully changed everything - and nothing at the same time - to get to 150,000 containers running in production in 2 years.
APIsecure 2023 - Android Applications and API Hacking, Gabrielle Botbolapidays
APIsecure 2023 - The world's first and only API security conference
March 14 & 15, 2023
Android Applications and API Hacking
Gabrielle Botbol, Ethical Hacker |Award-winning Pentester | Artemis Red Team | Board Member | Speaker | Mentor
------
Check out our conferences at https://www.apidays.global/
Do you want to sponsor or talk at one of our conferences?
https://apidays.typeform.com/to/ILJeAaV8
Learn more on APIscene, the global media made by the community for the community:
https://www.apiscene.io
Explore the API ecosystem with the API Landscape:
https://apilandscape.apiscene.io/
The document discusses Server Side Request Forgery (SSRF), including what it is, different types (blind and basic), ways to exploit it like bypassing filters and chaining vulnerabilities, tools that can be used for detection, and two case studies of SSRF vulnerabilities found in the wild. The first case involves using an SSRF to retrieve internal data and then storing malicious HTML in a generated PDF. The second case was an unauthenticated blind SSRF in a Jira OAuth authorization controller that was exploited through a malicious Host header.
Static Application Security Testing Strategies for Automation and Continuous ...Kevin Fealey
Static Application Security Testing (SAST) introduces challenges with existing Software Development Lifecycle Configurations. Strategies at different points of the SDLC improve deployment time, while still improving the quality and security of the deliverable. This session will discuss the different strategies that can be implemented for SAST within SDLC—strategies catering to developers versus security analysts versus release engineers. The strategies consider the challenges each team may encounter, allowing them to incorporate security testing without jeopardizing deadlines or existing process.
Short Introduction to Docker. These slides show the basic idea behind the container technology Docker. The slides present the basic features for the daily use with Docker, Docker Compose, Docker Machine and Docker Swarm.
Docker is specially important for DevOps, because it gives Software Developers more control about their dependencies in different environments.
Bash is not a second zone citizen programming languageRené Ribaud
Bash is a widely used command line interpreter and scripting language. It is the default shell for most Linux distributions. While Bash scripts are commonly used to perform important system tasks, they are not always written with the same discipline as other programming languages. Adopting practices like Bash strict mode, following style guides, using functions and testing can help make shell scripts more reliable. Productivity tools like Shellcheck, shfmt and Bats can aid in developing robust Bash scripts.
Building an Open Source iOS app: lessons learnedWojciech Koszek
Building an Open Source iOS app: lessons learned
Dec 12, 2016, Hacker Dojo (Santa Clara), 6pm
In this talk I'm going to talk about lessons learned from building Sensorama (http://www.sensorama.org), an Open Source sensor platform for data science. The main theme of the talk will be Open Source: what is great about it, what is bad and how you must become a part of the Open Source community to really move quickly and benefit from it. For this project, I did both the code and the design, so you'll have a chance to see how solo-developer deals with time/feature constraints, which tools I've used and what my approach towards development in this mode is. In other words: I'll tell you what I did to stay sane. If the iOS development were a walk in a dark city park, this talk may turn out to be your flashlight. If you like it, star it at GitHub: https://github.com/wkoszek/sensorama-ios
Agenda
https://www.meetup.com/svmobiledev/events/235836893/
Materials
https://github.com/wkoszek/talks/tree/master/svmobiledev2016
Some links from the slides
Fake it till you make it presentation https://developer.apple.com/videos/play/wwdc2014/223
Designing for Future Hardware https://developer.apple.com/videos/play/wwdc2015/801/
References
WWW: http://www.sensorama.org
GitHub (code): https://github.com/wkoszek/sensorama-ios
GitHub (artwork): https://github.com/wkoszek/sensorama-artwork
Author
WWW: http://www.koszek.com
Twitter: https://twitter.com/wkoszek
LinkedIn: https://www.linkedin.com/in/wkoszek/
Email: wojciech (at) koszek.com
SSRF vs. Business-critical applications. XXE tunneling in SAPERPScan
Any information an attacker might want is stored in a company’s ERP. This information can include financial, customer or public relations, intellectual property, personally identifiable information and more. Industrial espionage, sabotage and fraud or insider embezzlement may be very effective if targeted at the victim’s ERP system and cause significant damage to the business.
The presentation describes the history of SSRF attack, or Server Side Request Forgery, its types and different kinds of attacks on SAP.
Jenkins is an open-source tool for continuous integration that was originally developed as the Hudson project. It allows developers to commit code frequently to a shared repository, where Jenkins will automatically build and test the code. Jenkins is now the leading replacement for Hudson since Oracle stopped maintaining Hudson. It helps teams catch issues early and deliver software more rapidly through continuous integration and deployment.
Taintgrind is a Valgrind tool that performs dynamic taint analysis by tracking tainted data through a program as it is executed. It can be used to perform reverse taint analysis to identify the origin of a crash by tainting the crashing instruction and tracking the taint backwards. Rtaint is a script that analyzes Taintgrind logs to produce graphs and slices showing the propagation of tainted values. Reverse taint analysis with these tools was able to determine the root cause for many crashes by tracing tainted inputs backwards from the crash site.
The document discusses cyber security topics like web security, Zed Attack Proxy (ZAP), SQL injection, Damn Vulnerable Web Application (DVWA), and WebGoat. It provides an overview of these topics, including what ZAP is used for, how to configure it, and how to use its features like intercepting traffic, scanning, and reporting. It also discusses the Open Web Application Security Project (OWASP) and some of the top 10 vulnerabilities like SQL injection.
Building flexible ETL pipelines with Apache Camel on QuarkusIvelin Yanev
This document discusses building flexible ETL pipelines with Apache Camel on Quarkus. It begins with an overview of what ETL is and the extract, transform, load process. It then discusses what Apache Camel is and how it is an open source integration framework that allows defining routing and mediation rules. The document introduces Camel K and Camel Quarkus, noting that Camel Quarkus brings Camel's integration capabilities to the Quarkus runtime. It argues that Apache Camel and Quarkus is a good combination for efficient ETL due to Camel's easy learning curve and extensibility and Quarkus' benefits like low memory usage and fast startup times. The document concludes with a demo
DevOps Continuous Integration & Delivery - A Whitepaper by RapidValueRapidValue
In this whitepaper, we will deep dive into the concept of continuous integration, continuous delivery and continuous deployment and explain how businesses can benefit from this. We will also elucidate on how to build an effective CI/CD pipeline and some of the best practices for your enterprise DevOps journey.
Reconnaissance denotes the work of information gathering before any real attacks are planned. The idea is to collect as much interesting information as possible about the target. The methodology described here increases the assets for testing and thus increasing the scope of finding vulnerabilities.
Hi Everyone,
This presentation is on Logical Attacks it can be helpful in Bug Bounties while doing Bug Hunting, Vulnerability Research in web applications, mobiles(andriod, ios, win), webservices, apis etc and for making a career in information security domain.
Its not an introduction to Web Application Security
A talk about some new ideas and cool/obscure things in Web Application Security.
More like “Unusual Bugs”
** DevOps Training: https://www.edureka.co/devops **
This Edureka tutorial on "Jenkins pipeline Tutorial" will help you understand the basic concepts of a Jenkins pipeline. Below are the topics covered in the tutorial:
1. The need for Continuous Delivery
2. What is Continuous Delivery?
3. Features before the Jenkins Pipeline
4. What is a Jenkins Pipeline?
5. What is a Jenkinsfile?
6. Pipeline Concepts
7. Hands-On
Check our complete DevOps playlist here (includes all the videos mentioned in the video): http://goo.gl/O2vo13
A Story of Cultural Change: PayPal's 2 Year Journey to 150,000 Containers wit...Docker, Inc.
Adopting containers at scale is fundamentally a cultural change. In late 2015, PayPal decided to migrate en masse to containers for applications built on many different frameworks over the last 15 years. It was a bold and strategic plan that included how to showcase value of containers to leadership, a phased execution strategy, building the right team to lead, and cultural transformation. Changing application code, deployment methods, and operational tools were at onset non-negotiable. This session will share how the plan was pitched and the learnings that unfolded as PayPal carefully changed everything - and nothing at the same time - to get to 150,000 containers running in production in 2 years.
APIsecure 2023 - Android Applications and API Hacking, Gabrielle Botbolapidays
APIsecure 2023 - The world's first and only API security conference
March 14 & 15, 2023
Android Applications and API Hacking
Gabrielle Botbol, Ethical Hacker |Award-winning Pentester | Artemis Red Team | Board Member | Speaker | Mentor
------
Check out our conferences at https://www.apidays.global/
Do you want to sponsor or talk at one of our conferences?
https://apidays.typeform.com/to/ILJeAaV8
Learn more on APIscene, the global media made by the community for the community:
https://www.apiscene.io
Explore the API ecosystem with the API Landscape:
https://apilandscape.apiscene.io/
The document discusses Server Side Request Forgery (SSRF), including what it is, different types (blind and basic), ways to exploit it like bypassing filters and chaining vulnerabilities, tools that can be used for detection, and two case studies of SSRF vulnerabilities found in the wild. The first case involves using an SSRF to retrieve internal data and then storing malicious HTML in a generated PDF. The second case was an unauthenticated blind SSRF in a Jira OAuth authorization controller that was exploited through a malicious Host header.
Static Application Security Testing Strategies for Automation and Continuous ...Kevin Fealey
Static Application Security Testing (SAST) introduces challenges with existing Software Development Lifecycle Configurations. Strategies at different points of the SDLC improve deployment time, while still improving the quality and security of the deliverable. This session will discuss the different strategies that can be implemented for SAST within SDLC—strategies catering to developers versus security analysts versus release engineers. The strategies consider the challenges each team may encounter, allowing them to incorporate security testing without jeopardizing deadlines or existing process.
Short Introduction to Docker. These slides show the basic idea behind the container technology Docker. The slides present the basic features for the daily use with Docker, Docker Compose, Docker Machine and Docker Swarm.
Docker is specially important for DevOps, because it gives Software Developers more control about their dependencies in different environments.
Bash is not a second zone citizen programming languageRené Ribaud
Bash is a widely used command line interpreter and scripting language. It is the default shell for most Linux distributions. While Bash scripts are commonly used to perform important system tasks, they are not always written with the same discipline as other programming languages. Adopting practices like Bash strict mode, following style guides, using functions and testing can help make shell scripts more reliable. Productivity tools like Shellcheck, shfmt and Bats can aid in developing robust Bash scripts.
Building an Open Source iOS app: lessons learnedWojciech Koszek
Building an Open Source iOS app: lessons learned
Dec 12, 2016, Hacker Dojo (Santa Clara), 6pm
In this talk I'm going to talk about lessons learned from building Sensorama (http://www.sensorama.org), an Open Source sensor platform for data science. The main theme of the talk will be Open Source: what is great about it, what is bad and how you must become a part of the Open Source community to really move quickly and benefit from it. For this project, I did both the code and the design, so you'll have a chance to see how solo-developer deals with time/feature constraints, which tools I've used and what my approach towards development in this mode is. In other words: I'll tell you what I did to stay sane. If the iOS development were a walk in a dark city park, this talk may turn out to be your flashlight. If you like it, star it at GitHub: https://github.com/wkoszek/sensorama-ios
Agenda
https://www.meetup.com/svmobiledev/events/235836893/
Materials
https://github.com/wkoszek/talks/tree/master/svmobiledev2016
Some links from the slides
Fake it till you make it presentation https://developer.apple.com/videos/play/wwdc2014/223
Designing for Future Hardware https://developer.apple.com/videos/play/wwdc2015/801/
References
WWW: http://www.sensorama.org
GitHub (code): https://github.com/wkoszek/sensorama-ios
GitHub (artwork): https://github.com/wkoszek/sensorama-artwork
Author
WWW: http://www.koszek.com
Twitter: https://twitter.com/wkoszek
LinkedIn: https://www.linkedin.com/in/wkoszek/
Email: wojciech (at) koszek.com
The document provides instructions for building LibreOffice on Linux Mint. It notes that the typical dependency resolution process may not work with certain desktop environments like Cinnamon. It then outlines the steps to manually install over 30 necessary library packages so that the configuration and build scripts will complete successfully. The document emphasizes that gaining experience from any issues that come up during the process can help one provide better support to other new users.
Porting a command line tool to Android involves cross-compiling the code using the Android NDK toolchain, which may require patching the code to address issues like different file paths, endianness, and library dependencies. While compiling and running static binaries is straightforward, dynamic binaries require position-independent executable (PIE) support added in Android 5. Calling native executables from Android code requires using Runtime.exec() or ProcessBuilder and parsing output streams. Special care needs to be taken to avoid security issues like command injection when passing untrusted inputs to native programs run as root on Android.
Fine-tuning your development environment means more than just getting your editor set up just so -- it means finding and setting up a variety of tools to take care of the mundane housekeeping chores that you have to do -- so you have more time to program, of course! I'll share the benefits of a number of yak shaving expeditions, including using App::GitGot to batch manage _all_ your git repos, App::MiseEnPlace to automate getting things _just_ so in your working environment, and a few others as time allows.
Delivered at OpenWest 2016, 13 July 2016
Often, the price of an (embedded) product is calculated as the sum of all parts (the BOM) times two. For long, this basic-formula was both simple and correct. Today, however, now software is becoming a big "part" we have to change it, as the BOM-cost of software is zero. When Linux is used, the formula is very 'wrong'; using a "big" Linux is cheaper the a smaller one. The smaller the code has to be, the more development costs!
With a simple case, those hidden cost of Linux are shown, for managers and other non-Linux experts (and even for some Linux-folks, who don't understand management or costs ...
This document is an introduction to Linux fundamentals and preparing for the Linux Professional Institute's 101 exam. It covers using the bash shell to navigate directories and view file listings, including the use of absolute and relative paths. It also discusses special directories like ., .., and ~, as well as interpreting permissions and other details from long directory listings using the ls command. The goal is to provide readers with a solid foundation in basic Linux concepts.
Reverse Engineering in Linux - The tools showcaseLevis Nickaster
A short tutorial to introduce tools, utilities in to do Reversing in Linux
Written by Levis Nickaster (http://ltops9.wordpress.com)
The document provides an introduction to Bash shell programming in Linux. It covers basic shell commands like pwd, ls, cat, grep, and redirection operators like > and |. It explains how to write shell scripts, set permissions, and include tests and branching. Examples are provided for listing files, examining file contents, sorting output with pipes, and writing a simple "Hello world" shell script. The document is intended as a basic overview of shell programming concepts.
The document discusses the three stages that dynamic systems go through: 1) simple content management, 2) beyond basic features like calendars and forums, and 3) building custom web applications. It also covers designing for dynamic systems by using templates and planning for user-generated content. Open source options are discussed, including choosing an existing open source project, using open source, or building your own. The benefits and challenges of using plugins and modules as well as frameworks are summarized. The key takeaways are that the web is becoming more dynamic, systems need to interconnect, and one should consider their business model.
Linux is a free and open-source operating system available in many distributions. It emphasizes flexibility, control, and customization through its use of plain text files and commands, small focused programs, and open-source code. Shell scripts allow users to combine Linux programs and commands to automate tasks and create their own programs without compiling code.
The document provides an introduction to free software, open source, and GNU/Linux, discussing key concepts like the four freedoms of free software and differences between Linux as a kernel, operating system, and distribution. It also briefly outlines the author's background and role with the Egypt GNU/Linux Users Group, as well as a brief history and evolution of GNU/Linux.
This document discusses Jenkins Pipelines. It provides an overview of what pipelines are and their benefits, including codifying build flows, dividing monolithic builds into logical stages, and abstracting common tasks. It also discusses getting started with pipelines, including setting up a test Jenkins instance, common gotchas, and useful links for pipeline examples, steps references, and handling source control with Git.
The document discusses resources for open source software projects, including version control systems like Git, SVN, and Mercurial, and hosting services like SourceForge, Launchpad, Google Code, and GitHub. It provides an overview of each option and recommends choosing a hosting service or self-hosting based on the size of the project. Distributed version control systems are preferred over centralized ones. The document also stresses the importance of configuration and community engagement.
OpenEvent is a Drupal distribution that represents an Event Open Data Model and publishes event data through a self-documented API. It aims to be a generic foundation for cultural organizations to manage and publish their events online. The distribution includes Drupal 7, the Open Data Model, Schema.org mappings, and features like a read-only API. Future plans include moving it to Drupal.org, improving documentation, refactoring custom code into reusable modules, and attending to the issue queue. Lessons learned include benefits of open source like higher developer motivation and easier code sharing.
This homework assignment covers basic Unix and Perl skills. Students are instructed to:
1) Install Linux if they don't already have it and familiarize themselves with basic Unix commands through tutorials.
2) Learn important Unix text processing tools like grep, cut, sort, and pipes. Students are given example commands to run on E. coli genome data and explain what each command does.
3) Submit their responses to the tutorial questions and command explanations for grading.
This homework assignment covers basic Unix and Perl skills. Students are instructed to:
1) Install Linux if they don't already have it and familiarize themselves with basic Unix commands through tutorials.
2) Learn important Unix text processing tools like grep, cut, sort, and pipes. Students are given example commands to run on E. coli genome data and explain what each command does.
3) Submit their responses to the tutorial questions and command explanations for grading.
This document provides an introduction to the Python programming language. It discusses what Python is, why it was created, its basic features and uses. Python is an interpreted, object-oriented programming language that is designed to be readable. It can be used for tasks such as web development, scientific computing, and scripting. The document also covers Python basics like variables, data types, operators, and input/output functions. It provides examples of Python code and discusses best practices for writing and running Python programs.
This document discusses integrating security into DevOps practices through continuous delivery. It proposes including security automation and monitoring at each stage of the software development pipeline from development through production. Specific techniques mentioned include performing continuous security scanning, integrating security testing with other testing stages, automating security tasks using tools like Ansible, and sharing security data and lessons learned across teams to improve processes over time. The overall message is that security should be built into delivery rather than treated separately to avoid slowing software releases while still maintaining quality.
4Developers 2015: Continuous Security in DevOps - Maciej LasykPROIDEA
Speaker: Maciej Lasyk
Language: Polish
Testowanie bezpieczeństwa aplikacji zazwyczaj kojarzy nam się z pentestami w wydaniu black/white box. Standardowe podejście do realizowania tematów bezpieczeństwa w firmach bez wdrożonego Continuous Delivery polega na szkoleniu kadr (programistów), uruchamiania (zamawiania) pentestów w fazach stabilizacji kodu (końcowe iteracje przed deploymentem) i naprawianiu znalezionych podatności. Sprawy mają się trochę inaczej w firmach, które wypuszczają wiele zmian każdego dnia (tu często znajdziemy więcej miejsca i zrozumienia dla zwinnych zespołów bezpieczeństwa).
Jednak w czasach, gdy programiści żyją blisko wraz z administratorami tworząc wspólny byt zwany DevOps podejście do kwestii bezpieczeńśtwa aplikacji można bardzo mocno zmienić. A co gdyby do procesu Continuous Integration, na który składa się wiele rodzajów testów (unit, smoke, performance) dodać jeszcze automatyczne testy bezpieczeństwa? A co gdyby ktoś Wam powiedział, że ""Automate all the things"" oznacza, iż można ""penetrować"" nie tylko z Backtracka / Kali'ego ale też z Ansible'a do pary z Jenkinsem, Owasp ZAPem, Metasploitem, JBehave, Selenium, Skipfishem i masą innych? A gdyby tak w skład Devopsów wchodziła część SecOps, której to zadaniem byłoby utrzymanie takiej gałęzi automatycznych testów bezpieczeństwa i analizy wyników? Z czego takie testy powinny się składać i jak je poukładać?
Jako lider zespołu Devopsów wiele razy spotkałem się z problemem sporej liczby podatności wykrytej poprzez pentesty, które potem trzeba w krótkim czasie załatać w tempie ""na zapalenie płuc"". Stąd też zrodził się jakiś czas temu pomysł, aby kompletnie zmienić podejście i odwrócić kota ogonem - zmieniamy podejście reaktywne (naprawiamy to co wykryły końcowe pentesty) na bardziej proaktywne (weryfikujemy bezpieczeństwo na bieżąco i poprawiamy w czasie rzeczywistym - w końcu część SecOps też może zmienić konfigurację serwerów w Ansiblowych YAMLach zamykając niestosowne porty na firewallu czy zmieniając delikatnie politykę SELinuksa).
4Developers: http://4developers.org.pl/pl/
Because "use urandom" isn't everything: a deep dive into CSPRNGs in Operating...Aaron Zauner
Over the past year multiple people have been engaging language maintainers and designers to change their use of CSPRNGs (mainly relying on user-land RNGs like the one from OpenSSL, and sometimes suggesting "adding entropy" by various means from user-land daemons like haveged). In this short presentation we'll survey the struggle of cryptographers, developers and security engineers to change the path various high-profile languages have taken to provide randomness to their userbase. Affected languages include but are not limited to: Ruby, node.js and Erlang. We outline better approaches for language maintainers and implementers as well as coming changes within the Linux kernel crypto subsystem (i.e. /dev/random and /dev/urandom) w.r.t. security and performance. Recently these changes were merged into mainline Linux (4), problems with languages implementations however remain. We'll also discuss operating system provided randomness testing, attacks/mitigation in embedded and virtualized environments.
[BlackHat USA 2016] Nonce-Disrespecting Adversaries: Practical Forgery Attack...Aaron Zauner
GCM mode in TLS is vulnerable if nonces are not unique per message. The document describes scanning the internet and finding implementations that reuse nonces, allowing an attacker to recover the authentication key and manipulate messages. It proposes a man-in-the-middle attack where an attacker collects nonces from a server, waits for a repeat, recovers the key, and modifies encrypted content served to a victim. While TLS 1.2 specifies nonces, implementations sometimes fail to generate unique nonces correctly. Better guidance and testing tools are needed to prevent such vulnerabilities.
No need for Black Chambers: Testing TLS in the E-Mail Ecosystem at Large (hac...Aaron Zauner
Presented at hack.lu 2015.
Abstract—TLS is the most widely used cryptographic protocol on the Internet. While many recent studies focused on its use in HTTPS, none so far analyzed TLS usage in e-mail related protocols, which often carry highly sensitive information. Since end-to-end encryption mechanisms like PGP are seldomly used, today confidentiality in the e-mail ecosystem is mainly based on the encryption of the transport layer. A well-positioned attacker may be able to intercept plaintext passively and at global scale.
We collected and scanned a massive data-set of 20 million IP/port combinations of all related protocols (SMTP, POP3, IMAP) and legacy ports. Over a time span of approx. three months we conducted more than 10 billion TLS handshakes. Additionally, we show that securing server-to-server communication using e.g. SMTP is inherently more difficult than securing client-to- server communication. Lastly, we analyze the volatility of TLS certificates and trust anchors in the e-mail ecosystem and argue that while the overall trend points in the right direction, there are still many steps needed towards secure e-mail.
State of Transport Security in the E-Mail Ecosystem at LargeAaron Zauner
An Internet-wide scanning project analyzed the state of transport security in the email ecosystem. Scans of SMTP(S), POP3(S), IMAP(S) and other ports found widespread issues, including support for weak protocols, ciphers and key lengths. While most certificates used strong cryptography, some hosts still supported RC4, 512-bit DH and other vulnerabilities. The results validated expectations of existing security problems in email transport.
The document discusses Javascript Object Signing and Encryption (JOSE) standards being developed by the IETF to provide a framework for signing and encrypting JSON data in a secure manner. These include the JSON Web Key (JWK) format for representing cryptographic keys, the JSON Web Signature (JWS) format for signing payload data, and the JSON Web Encryption (JWE) format for encrypting payload data. The standards provide mechanisms for integrity protection and encryption of JSON content in a way that ensures interoperability.
Introduction to and survey of TLS security (BsidesHH 2014)Aaron Zauner
This document provides an introduction and survey of Transport Layer Security (TLS). It begins with motivations for studying TLS and provides background information on topics like cryptography, the TLS handshake process, and cipher suites. The document then discusses the history of TLS and examples of attacks against it. It aims to educate about TLS security and the ongoing efforts by the Internet Engineering Task Force (IETF) to improve TLS mitigations against modern threats.
Introduction to and survey of TLS SecurityAaron Zauner
This document provides an introduction and survey of TLS security. It begins with an overview of motivation and background topics like information security, cryptography, and TLS. It then discusses TLS in more detail, including TLS records, the TLS handshake process, and cipher suites that combine cryptographic techniques. The document aims to cover the necessary basics to understand TLS security while recommending additional resources for deeper learning.
The document discusses the reaction from the Internet Engineering Community to the Snowden leaks. It describes how the IETF began working on drafts and new working groups to prevent pervasive monitoring after 2013. This includes the TLS, UTA, TCPINC, and DPRIVE working groups which are standardizing improvements to TLS, application usage of TLS, TCP encryption, and DNS privacy. The CFRG is also working to standardize a set of cryptographic curves for use in IETF protocols by the end of 2014, including Curve25519, NUMS, and ed448goldilocks.
This document summarizes the history of encryption protocols and attacks against them, beginning with the early SSL and TLS protocols in the 1990s. It describes numerous attacks published over the years that exploited vulnerabilities in the protocols, such as padding oracle attacks, timing attacks, traffic analysis attacks, and attacks against specific algorithms like RC4. Each attack paved the way for new, more secure versions of the protocols to be developed. The document outlines advances like TLS 1.1, 1.2, and the removal of insecure or broken algorithms, as well as high-profile security incidents at CAs like DigiNotar and Comodo.
Introduction to and survey of TLS SecurityAaron Zauner
For higher quality see: https://github.com/azet/talks/tree/master/2014/DevOpsSec-Meetup_Vienna/introduction_to_and_survey_of_tls_security-19_5_2014
[TALK WAS HELD IN GERMAN DUE TO AUDIENCE]
The BetterCrypto Project started out in the fall of 2013 as a collaborative community effort by systems engineers, security engineers, developers and cryptographers to build up a sound set of recommendations for strong cryptography and privacy enhancing technologies catered towards the operations community in the face of overarching wiretapping and data-mining by nation-state actors. The project has since evolved with a lot of positive feedback from the open source and operations community in general with input from various browser vendors, linux distribution security teams and researchers. This talk will give a concise guide on how to properly deploy networked services in a secure fashion that is applicable today. We will also give an update on the project as well as new development on the front of cryptography, attacks and TLS protocol standardization.
Although the "Modules" system has been around since the early 1990ties it has yet to find widespread adoption outside of the scientific computing and HPC community. Most FOSS developers rely on a wide range of tools to abstract and manage their Linux and UN!X environments for different scripting languages, compiler toolchains and applications. This problem has been long solved in the world of High Performance Computing where optimization of applications, toolchains and libraries is paramount. Environment Modules are a wonderful tool that will save time, help ease of development processes, reproducibility, and management of your development environment. This talk will give insight into how Modules work, which implementations are out there and how to use Modules instead of language bound tools as well as a comparison with common tools that the community uses to develop on Python and Ruby (for example) projects.
I intend to give a 20 min overview of the "Environment Modules" system as deployed on many scientific and HPC sites to FOSS developers, students and linux enthusiasts.
This will include a comparison of different Modules implementations their history and typical use cases in HPC and development environments and how Modules can be of help to FOSS developers and systems administrators. As a developer and systems engineer, I am familiar with a lot of different systems to manage multiple installations of e.g. script languages their environments and libraries. I'll give a short overview and comparison of those and compare these systems with Modules and show how developers and engineers alike can save time and effort in managing their environment for all applications, toolchains and script languages.
The document provides summaries of several workshops and presentations at an HPC conference:
1. The rasdman workshop discussed adding array support to SQL queries, array query operators, and storage techniques for large arrays like tiled storage.
2. The energy efficient HPC talk discussed optimization techniques to improve energy efficiency, with information provided in slides.
3. The data-aware networking workshop included discussions of techniques for improving data transfer performance over networks like pipelining and parallelism in gridftp.
Unlock AI Creativity: Image Generation with DALL·EExpeed Software
Discover the power of AI image generation with DALL·E, an advanced AI model that transforms text prompts into stunning, high-quality visuals. This presentation explores how artificial intelligence is revolutionizing digital creativity, from graphic design to content creation and marketing. Learn about the technology behind DALL·E, its real-world applications, and how businesses can leverage AI-generated art for innovation. Whether you're a designer, developer, or marketer, this guide will help you unlock new creative possibilities with AI-driven image synthesis.
https://ncracked.com/7961-2/
Note: >> Please copy the link and paste it into Google New Tab now Download link
Free Download Wondershare Filmora 14.3.2.11147 Full Version - All-in-one home video editor to make a great video.Free Download Wondershare Filmora for Windows PC is an all-in-one home video editor with powerful functionality and a fully stacked feature set. Filmora has a simple drag-and-drop top interface, allowing you to be artistic with the story you want to create.Video Editing Simplified - Ignite Your Story. A powerful and intuitive video editing experience. Filmora 10 hash two new ways to edit: Action Cam Tool (Correct lens distortion, Clean up your audio, New speed controls) and Instant Cutter (Trim or merge clips quickly, Instant export).Filmora allows you to create projects in 4:3 or 16:9, so you can crop the videos or resize them to fit the size you want. This way, quickly converting a widescreen material to SD format is possible.
Replacing RocksDB with ScyllaDB in Kafka Streams by Almog GavraScyllaDB
Learn how Responsive replaced embedded RocksDB with ScyllaDB in Kafka Streams, simplifying the architecture and unlocking massive availability and scale. The talk covers unbundling stream processors, key ScyllaDB features tested, and lessons learned from the transition.
https://ncracked.com/7961-2/
Note: >> Please copy the link and paste it into Google New Tab now Download link
Brave is a free Chromium browser developed for Win Downloads, macOS and Linux systems that allows users to browse the internet in a safer, faster and more secure way than its competition. Designed with security in mind, Brave automatically blocks ads and trackers which also makes it faster,
As Brave naturally blocks unwanted content from appearing in your browser, it prevents these trackers and pop-ups from slowing Download your user experience. It's also designed in a way that strips Downloaden which data is being loaded each time you use it. Without these components
CFD Studio Credentials – Branding, Design & Developmenttrannghia2018
CFD STUDIO is an independent creative studio, specializing in Branding, UX/UI Design, Website & Mobile App Development. We craft high-quality digital experiences for brands and business goals.
Our Mission is to transform ideas into impactful brands by blending creativity, technology, and strategic thinking, delivering solutions that not only captivate but also drive success.
AIXMOOC 2.3 - Modelli di reti neurali con esperimenti di addestramentoAlessandro Bogliolo
Lezione tenuta da Alessandro Bogliolo nell'ambito del MOOC dell'Università di Urbino dedicato a LLMs e IA generativa
https://mooc.uniurb.it/aixmooc
UiPath NY AI Series: Session 1: Introduction to Agentic AI with UiPathDianaGray10
🚀 Embracing the Future: Starting the Course with Agentic AI with UiPath
📢 Event Overview:
Join us for an exciting session on Agentic AI with UiPath! This event is perfect for professionals, tech enthusiasts, and automation leaders eager to learn about autonomous and intelligent digital agents. Discover how UiPath’s Agentic AI is shaping the future of automation! 🤖✨
📅 What You’ll Learn
🔹 UiPath’s Agentic AI Vision - Learn about UiPath’s AI-driven automation future.
🔹 Evolution of UiPath’s Automation - From RPA to AI-powered automation, see the journey! 🚀
🔹 What is Agentic Automation? - Understand how self-adaptive AI is changing workflows.
🔹 Principles of Agentic Automation - Key ideas like autonomy & adaptability.
🔹 Real-World Applications - Success stories & use cases from businesses leveraging AI.
🔹 UiPath’s Agentic AI Architecture - A peek into the technical side of intelligent automation. 🏗️
🔹 Q&A Session
👥 Who Should Attend?
Automation Developers & Tech Enthusiasts 💡
Business Leaders 📊
IT Architects & Tech Innovators 🏗️
UiPath Community Members 🤝
📌 Register now & be part of the future of AI-driven automation! 🔥
World Information Architecture Day 2025 - UX at a CrossroadsJoshua Randall
User Experience stands at a crossroads: will we live up to our potential to design a better world? or will we be co-opted by “product management” or another business buzzword?
Looking backwards, this talk will show how UX has repeatedly failed to create a better world, drawing on industry data from Nielsen Norman Group, Baymard, MeasuringU, WebAIM, and others.
Looking forwards, this talk will argue that UX must resist hype, say no more often and collaborate less often (you read that right), and become a true profession — in order to be able to design a better world.
Data Intelligence Platform Transforming Data into Actionable Insights.pptxLisa Gerard
In today’s data-driven world, a Data Intelligence Platform plays a crucial role in empowering organizations to make informed, strategic decisions. By leveraging advanced analytics, seamless data integration, and robust governance, businesses can transform vast amounts of data into actionable insights.
Verbose AI: The Accessibility Challenge - CSUN 2025Ted Drake
This presentation was created for the 2025 CSUN Assistive Technology Conference
Verbose AI: The Accessibility Challenge
Explore how verbose AI-generated image descriptions could hinder screen reader accessibility. We'll share real-world examples, the importance of context, AI's limitations, and practical solutions to promote inclusivity and encourage action.
Using speech recognition and natural language processing, Automated Minutes creates an accurately transcribed meeting minutes draft in a near real-time, secure environment.
On March 11th at 2 PM EST OnBoard’s product team, Heather Hansson and Philip Hinz, explored the power of OnBoard’s Automated Minutes.
Using this webinar, you can learn:
Why Automated Minutes? Customizable, Secure, and Governance-Built for Boards
How Automated Minutes works to capture and create an initial draft of your minutes
Personalizing and formatting your Minutes through rich text editing tools
UiPath Document Understanding - Generative AI and Active learning capabilitiesDianaGray10
This session focus on Generative AI features and Active learning modern experience with Document understanding.
Topics Covered:
Overview of Document Understanding
How Generative Annotation works?
What is Generative Classification?
How to use Generative Extraction activities?
What is Generative Validation?
How Active learning modern experience accelerate model training?
Q/A
❓ If you have any questions or feedback, please refer to the "Women in Automation 2025" dedicated Forum thread. You can find there extra details and updates.
30B Images and Counting: Scaling Canva's Content-Understanding Pipelines by K...ScyllaDB
Scaling content understanding for billions of images is no easy feat. This talk dives into building extreme label classification models, balancing accuracy & speed, and optimizing ML pipelines for scale. You'll learn new ways to tackle real-time performance challenges in massive data environments.
The Future of Repair: Transparent and Incremental by Botond DénesScyllaDB
Regularly run repairs are essential to keep clusters healthy, yet having a good repair schedule is more challenging than it should be. Repairs often take a long time, preventing running them often. This has an impact on data consistency and also limits the usefulness of the new repair based tombstone garbage collection. We want to address these challenges by making repairs incremental and allowing for automatic repair scheduling, without relying on external tools.
FinTech - US Annual Funding Report - 2024.pptxTracxn
US FinTech 2024, offering a comprehensive analysis of key trends, funding activities, and top-performing sectors that shaped the FinTech ecosystem in the US 2024. The report delivers detailed data and insights into the region's funding landscape and other developments. We believe this report will provide you with valuable insights to understand the evolving market dynamics.
Many MSPs overlook endpoint backup, missing out on additional profit and leaving a gap that puts client data at risk.
Join our webinar as we break down the top challenges of endpoint backup—and how to overcome them.
Elements of Indigenous Style: Insights and applications for the book industry...BookNet Canada
From acquisitions and editorial to marketing and sales teams, every team member plays a role in accurately, respectfully, and ethically championing Indigenous and traditionally underrepresented voices. This session, led by Warren Cariou, Lead Editor of the second edition of Gregory Younging’s Elements of Indigenous Style, is for book industry professionals eager to learn and apply Indigenous teachings to their work.
Using Elements of Indigenous Style as a foundation, this session delves into its mind-opening content, which goes beyond the scope of a traditional style guide. The book advocates for the indigenization of publishing and addresses topics such as culturally appropriate publishing practices; understanding identity and community affiliation; Two-Spirit, trans, and Indigiqueer contexts; practices to support Indigenous linguistic and cultural sovereignty; and emerging issues in the digital environment. Warren provides actionable recommendations and best practices for publishers working on literary projects by or about Indigenous authors, which can be applied more broadly to other underrepresented communities.
Kaitlin Littlechild from the Indigenous Editors Association brings her expertise to the discussion as the moderator.
Link to recording and transcript: https://bnctechforum.ca/sessions/elements-of-indigenous-style-insights-and-applications-for-the-book-industry/
Presented by BookNet Canada on February 28, 2025 with support from the Department of Canadian Heritage.
3. Caveat Emptor
I’m not endorsing Bash for large-scale projects, difficult or
performance critical tasks. If your project needs to talk to a
database, object store, interact with a filesystem or dynamically
handle block devices - you SHOULD NOT use Bash in the first
place. You can. But you’ll regret it - I speak from years of
experience doing completely insane stuff in Bash for fun (certainly
not for profit).
Bash is useful for one thing and one thing only: as glue!
..and it’s the glue that holds Linux distributions, Embedded
Appliances and even Commercial networking gear together - so you
better use the best glue on the market, right?
DevOps/Security Meetup Vienna - 17/12/2014 Beautiful Bash: A community driven effort
Aaron Zauner 1/30
4. Do we really need another style guide?
For starters: It’s not only a style guide, but more on that later.
A lot of the internet actually runs on poorly written Bash.
Your company probably depends on a lot of Bash-glue.
Everyone uses it on a daily basis to glue userland utilities
together.
Some scripts unintentionally look like they are submissions for
an obfuscated code contest.
There are some style guides (e.g. by Google) and tutorials -
but nothing definitive.
Most books on the subject are ancient and often reflect
personal opinions of authors, outdated Bash versions and
userland utilities and most haven’t been updated in decades.
I don’t know a single good book on Bash. The best resource is
still http://wiki.bash-hackers.org.
DevOps/Security Meetup Vienna - 17/12/2014 Beautiful Bash: A community driven effort
Aaron Zauner 2/30
5. Working towards a community style guide
I’ve started collecting style guides, tutorials, write-ups, tools
and debugging projects during the last couple of years.
..chose the best ideas and clearest styles and combined them
into one big community driven effort.
People started contributing.
Nothing is written in stone. Come up with a better idea for a
certain topic and I’ll gladly accept it.
I’ve also included a lot of mistakes people do or even rely on
when writing their (often production) scripts.
I’ve also collected a lot of tricks and shortcuts I’ve learned over
the years specific to bash scripting and the Linux userland.
DevOps/Security Meetup Vienna - 17/12/2014 Beautiful Bash: A community driven effort
Aaron Zauner 3/30
6. Bad Example
Here’s a cool and bad example at the same time. rpm2cpio
reimplemented in bash.
As Debian package: Installed-Size: 1044
As Bash script: 4
DevOps/Security Meetup Vienna - 17/12/2014 Beautiful Bash: A community driven effort
Aaron Zauner 4/30
8. Common bad style practices
overusing grep for tasks that Bash can do by itself.
using bourne-shell backticks instead of $() for subshell calls.
.. ever tried to nest backtick subshells? yea. you’ll have to
escape them. instead of e.g.:
$(util1 $(util2 ${some_variable_as_argument})).
manual argument parsing instead of using the getopts builtin.
using awk for arithmetic operations bash can do very well.
.. same goes for expr(1). please stop using it in bash scripts.
.. same goes for bc(1). please stop using it in bash scripts.
DevOps/Security Meetup Vienna - 17/12/2014 Beautiful Bash: A community driven effort
Aaron Zauner 6/30
9. Common bad style practices (cont.)
using the echo builtin where printf can (and probably
should) be used.
using seq 1 15 for range expressions instead of {1..15}
many coreutils you do not need & you save on subshell calls.
.. a lot is set as a variable in your environment already
(protip: see what env gives you to work with in the first place)
worst of all: endless and unreadable pipe glue. . . . . . . . . . . .
DevOps/Security Meetup Vienna - 17/12/2014 Beautiful Bash: A community driven effort
Aaron Zauner 7/30
10. Common bad style practices (cont.)
So what is more readable to you and probably the angry sysadmin
that might take over your codebase at some point in time?
ls ${long_list_of_parameters} | grep ${foo} | grep -v
grep | pgrep | wc -l | sort | uniq
or
ls ${long_list_of_parameters}
| grep ${foo}
| grep -v grep
| pgrep
| wc -l
| sort
| uniq
DevOps/Security Meetup Vienna - 17/12/2014 Beautiful Bash: A community driven effort
Aaron Zauner 8/30
11. awk(1) for everything
But why?
$ du -sh Downloads | awk ‚{ print $1 }‚
366G
$ folder_size=($(du -sh Downloads))
$ echo ${folder_size[1]}
Downloads
$ echo ${folder_size[0]}
366G
DevOps/Security Meetup Vienna - 17/12/2014 Beautiful Bash: A community driven effort
Aaron Zauner 9/30
13. Debugging is a mess
One of the reasons nobody should aim for big projects in Bash is
that it is terrible to debug, most of you will know this already.
This project aims to make it easier for you to debug your scripts.
By writing beautiful, solid and testable code.
DevOps/Security Meetup Vienna - 17/12/2014 Beautiful Bash: A community driven effort
Aaron Zauner 11/30
14. Modern Bash scripting
Most people don’t know that there are a lot of useful paradigms and
tools that are used for software engineering in serious languages
available also to Bash.
Let’s not kid ourselves: some Bash scripts will run in production,
even for years. They’d better work. And not take your business
offline.
DevOps/Security Meetup Vienna - 17/12/2014 Beautiful Bash: A community driven effort
Aaron Zauner 12/30
15. Conventions
I’ve come up with a few conventions:
use #!/usr/bin/env bash
do not use TABs for (consistently use 2, 3 or 4 spaces)
but conditional and loop clauses on the same line:
if ..; then instead of
if ...
then
...
fi
there’re no private functions in Bash, RedHat has a convention
for that, prepend with two underscores function
__my_private_function()
as in Ruby, Python; don’t use indents in switch (case) blocks
always “escape” varabiles. Bad: $MyVar, Good: ${MyVar}.DevOps/Security Meetup Vienna - 17/12/2014 Beautiful Bash: A community driven effort
Aaron Zauner 13/30
16. DocOpt
DocOpt is a Command-line interface description language with
support for all popular programming languages.
http://docopt.org/
https://github.com/docopt
..also for Bash
https://github.com/docopt/docopts
DevOps/Security Meetup Vienna - 17/12/2014 Beautiful Bash: A community driven effort
Aaron Zauner 14/30
17. Test Driven Development and Unit tests with Bash
#!/usr/bin/env bats
@test "addition using bc" {
result="$(echo 2+2 | bc)"
[ "$result" -eq 4 ]
}
@test "addition using dc" {
result="$(echo 2 2+p | dc)"
[ "$result" -eq 4 ]
}
. . .
DevOps/Security Meetup Vienna - 17/12/2014 Beautiful Bash: A community driven effort
Aaron Zauner 15/30
18. Test Driven Development and Unit tests with Bash (cont.)
1. Sam Stephenson (of rbenv fame) wrote an automated testing
system for Bash scripts called ‘bats’ using TAP (Test Anything
Protocol): https://github.com/sstephenson/bats
2. Sharness: another TAP library. there’s even a Chef cookbook
for it: https://github.com/mlafeldt/sharness
3. Cram: a functional testing framework based on Marcurial’s
unified test format - https://bitheap.org/cram/
4. rnt: Automated testing of commandline interfaces -
https://github.com/roman-neuhauser/rnt
5. shUnit2: is a xUnit framework (similar to PyUnit, JUnit et
cetera) - https://code.google.com/p/shunit2/
6. shpec: Tests/Specs - https://github.com/rylnd/shpec
..there are more, but these I’ve found to be most useful.
DevOps/Security Meetup Vienna - 17/12/2014 Beautiful Bash: A community driven effort
Aaron Zauner 16/30
19. Linting
A online Bash style linter:
https://github.com/koalaman/shellcheck
Ubuntu ships with a tool called checkbashisms based on
Debians lintian (portability).
shlint tests for portability between zsh, ksh, bash, dash and
bourne shell (if need be):
https://github.com/duggan/shlint
For Node fans: Grunt task that checks if a Bash script is valid
(not anything else, btw):
https://www.npmjs.com/package/grunt-lint-bash
DevOps/Security Meetup Vienna - 17/12/2014 Beautiful Bash: A community driven effort
Aaron Zauner 17/30
20. Inter-shell portability
Personal opinion:
Inter-shell portability doesn’t matter. I’ve spent years writing OS
agnostic bourne-shell scripts. Today every modern OS ships with a
reasonably recent version of Bash. These days Solaris (and FOSS
forks like SmartOS) ship even with a GNU userland. Use Bash.
I love zsh and it can do a lot more. I still use Bash for (semi-)
production scripts. They run basically everywhere when done right.
DevOps/Security Meetup Vienna - 17/12/2014 Beautiful Bash: A community driven effort
Aaron Zauner 18/30
21. Defensive Bash programming
As you would in every other language, write helper functions,
test these functions.
Set constants readonly.
Write concise, well defined and tested functions for every
action.
Use the local keyword for function-local variables.
Prepend every function with the function keyword.
Return proper error codes and check for them.
Write unit tests.
Some people write a function main() as people would with
Python. So one can import and test ones main call as well.
DevOps/Security Meetup Vienna - 17/12/2014 Beautiful Bash: A community driven effort
Aaron Zauner 19/30
22. Defensive Bash programming (cont.)
function fail() {
local msg=${@}
# handle failure appropriately
cleanup && logger "my message to syslog"
echo "ERROR: ${msg}"
exit 1
}
et cetera
DevOps/Security Meetup Vienna - 17/12/2014 Beautiful Bash: A community driven effort
Aaron Zauner 20/30
24. Defensive Bash programming (cont.)
function debian_version() {
# convert debian version to single unsigned integer
local dv=$(printf "%.f" $(</etc/debian_version))
printf "%u" ${dv}
}
DevOps/Security Meetup Vienna - 17/12/2014 Beautiful Bash: A community driven effort
Aaron Zauner 22/30
25. Defensive Bash programming (cont.)
function is_empty() {
local var=${1}
[[ -z ${var} ]]
}
function is_file() {
local file=${1}
[[ -f ${file} ]]
}
function is_dir() {
local dir=${1}
[[ -d ${dir} ]]
}
DevOps/Security Meetup Vienna - 17/12/2014 Beautiful Bash: A community driven effort
Aaron Zauner 23/30
26. Signal Handling
Bash supports signal handling with the builtin trap:
# call the fail() function if one
# of these signals is caught by trap:
trap ‚fail "caught signal!"‚ HUP KILL QUIT
DevOps/Security Meetup Vienna - 17/12/2014 Beautiful Bash: A community driven effort
Aaron Zauner 24/30
27. Anonymous Functions (Lambdas)
You’ll probably never ever need this in Bash, but it’s possible:
function lambda() {
_f=${1} ; shift
function _l {
eval ${_f};
}
_l ${*} ; unset _l
}
DevOps/Security Meetup Vienna - 17/12/2014 Beautiful Bash: A community driven effort
Aaron Zauner 25/30
28. Bash Profiling
Sam Stephenson also wrote a profiler for Bash scripts:
https://github.com/sstephenson/bashprof
DevOps/Security Meetup Vienna - 17/12/2014 Beautiful Bash: A community driven effort
Aaron Zauner 26/30
29. Bash Debugging
Hopefully you’ll write code that you do not have to debug often, but
eventually you’ll have to. There’s only one real way to debug a
Bash script unfortunately:
bash -evx script.sh
or setting set -evx in your script directly
that being said, someone wrote a Bash debugger with gdb
command syntax: http://bashdb.sourceforge.net/
DevOps/Security Meetup Vienna - 17/12/2014 Beautiful Bash: A community driven effort
Aaron Zauner 27/30
30. Conclusion
There’s a lot more to tell (just ask me afterwards) - but this
was supposed to be a lightning talk.
All this, a lot of references and other projects are mentioned in
my Community Bash Style Guide which is on GitHub.
Please contribute in any way you can if you come up with
useful Bashisms, tricks or find any cool projects.
Any input is very much appreciated!
Fork and open Pull Requests, Issues or Complaints!
https://github.com/azet/community_bash_style_guide
DevOps/Security Meetup Vienna - 17/12/2014 Beautiful Bash: A community driven effort
Aaron Zauner 28/30
31. Trivia: Do not try this at home
OOP in Bash:
https://github.com/tomas/skull
https://github.com/kristopolous/TickTick
https://code.google.com/p/object-oriented-bash/
https://github.com/patrickd-/ooengine
http://hipersayanx.blogspot.co.at/2012/12/
object-oriented-programming-in-bash.html
LISP Dialect implemented in Bash:
https://github.com/alandipert/gherkin
The original Macros used in the source of Bourne Shell (To make it
look like ALGOL68 - the author was a big fan):
http://research.swtch.com/shmacro
DevOps/Security Meetup Vienna - 17/12/2014 Beautiful Bash: A community driven effort
Aaron Zauner 29/30
32. Thanks for your patience. Are there any questions?
Twitter:
@a_z_e_t
E-Mail:
[email protected]
XMPP:
[email protected]
GitHub:
https://github.com/azet
GPG Fingerprint:
7CB6 197E 385A 02DC 15D8 E223 E4DB 6492 FDB9 B5D5
[I have ECDSA (Brainpool) & EdDSA (Curve25519) subkeys as well.]
DevOps/Security Meetup Vienna - 17/12/2014 Beautiful Bash: A community driven effort
Aaron Zauner 30/30