CSV Injection | OWASP Foundation
CSV Injection, also known as Formula Injection, occurs when websites embed untrusted input inside CSV files. When a spreadsheet program such as Microsoft Excel or LibreOffice Calc is used to open a CSV, any cells starting with = will be interpreted by the software as a formula. Maliciously crafted formulas can be used for three key attacks: Hijacking the user’s computer by exploiting vulnerabiliti
AWSアカウントを取得したら速攻でやっておくべき初期設定まとめ - Qiita
AWSアカウントを作成したら最初にやっておきたいことをまとめてみた。 あわせて読みたい 本記事の内容を含めた最新の手順は、下記の書籍にまとまっている。 クラウド破産を回避するAWS実践ガイド AWSアカウント（ルートアカウント）の保護 AWSアカウントが乗っ取られると詰むので、真っ先にセキュリティを強化する。 AWSアカウントへ二段階認証を導入 AWSアカウントでのログインは、AWSアカウント作成時のメールアドレス・パスワードだけでできてしまう。心許ないにもほどがあるので、まずは二段階認証を設定しよう。 IAMのページを開く https://console.aws.amazon.com/iam/home 「ルートアカウントのMFAを有効化」を選択して、「MFAの管理」ボタンをクリック 「仮想MFAデバイス」にチェックが入っていることを確認し、「次のステップ」ボタンをクリック 注意書きを読ん
Reflections on ESLint's success - NCZOnline
It’s hard for me to believe, but I first conceived and created ESLint1 in June 2013 and first announced it’s availability in July 20132. As frequent readers might recall, the primary goal of ESLint was to create a linter with rules that could be loaded at runtime. I had seen some problems in our JavaScript at work and really wanted some automation to ensure those mistakes weren’t repeated. In the
Angular 2 versus React: There Will Be Blood
Angular 2 has reached Beta and appears poised to become the hot new framework of 2016. It’s time for a showdown. Let’s see how it stacks up against 2015’s darling: React. Disclaimer: I enjoyed working in Angular 1 but switched to React in 2015. I’ve published Pluralsight courses on React and Flux and React and Redux in ES6 (free trial). So yes, I’m biased. But I’m attacking both sides. Alright, le
React.js Best Practices for 2016 | @RisingStack
Join 150K+ monthly readers. In-depth articles on Node.js, Microservices, Kubernetes and DevOps. 2015 was the year of React with tons of new releases and developer conferences dedicated to the topic all over the world. For a detailed list of the most important milestones of last year, check out our React in 2015 wrap up. The most interesting question for 2016: How should we write an application and
2016 - the year of web streams - JakeArchibald.com
Yeah, ok, it's a touch bold to talk about something being the thing of the year as early as January, but the potential of the web streams API has gotten me all excited. TL;DR: Streams can be used to do fun things like turn clouds to butts, transcode MPEG to GIF, but most importantly, they can be combined with service workers to become the fastest way to serve content. Streams, huh! What are they g
Programming with Modularity and Project Jigsaw. A Tutorial Using the Latest Early Access Build
Software can be seen as a system of interacting parts and in Java it is common to package each of those parts in its own JAR. Conceptually a part consists of three properties: a name, a public API for the rest of the world to use, and dependencies on other parts. This graph-like model helps developers and tools dissect, analyse, and work with software systems. But none of those properties exist in
Quiver でメモ管理改善
Quiver: The Programmer’s Notebook Twitter のタイムラインで こちらのエントリ を見かけて、これはよさそうと思って衝動買いしてちょっと試してみたところ、自分のニーズを全て満たしていると言っても過言ではないくらいよかった。ので、この感動を同じニーズを持った人達に伝えるべく、軽くレポートしてみようと思う。 Quiver 移行前のメモ管理 Dropbox に markdown 形式で保存 emacs で編集 Marked 2 を emacs から起動して閲覧 という感じで落ち着いていた。 が、いまいちしっくりきてなかったというか。メモ管理に最適化されてる感じは薄かった。シェルの世界から出ないでよいのでラクだなあというくらい。 Quiver の特徴 最たる特徴は以下。 1つの Note は複数の Cell で構成されている 現状、Cell は以下の5種類 T
Distributed Time Travel for Feature Generation
We want to make it easy for Netflix members to find great content to fulfill their unique tastes. To do this, we follow a data-driven algorithmic approach based on machine learning, which we have described in past posts and other publications. We aspire to a day when anyone can sit down, turn on Netflix, and the absolute best content for them will automatically start playing. While we are still wa
Automated Failure Testing
At Netflix, we have found that proactive failure testing is a great way to ensure that we have a reliable product for our members by helping us prepare our systems, and our teams, for the problems that arise in our production environment. Our various efforts in this space, some of which are manual, have helped us make it through the holiday season without incident (which is great if you’re on-call
Evolution of the Netflix Data Pipeline
Our new Keystone data pipeline went live in December of 2015. In this article, we talk about the evolution of Netflix’s data pipeline over the years. This is the first of a series of articles about the new Keystone data pipeline. Netflix is a data-driven company. Many business and product decisions are based on insights derived from data analysis. The charter of the data pipeline is to collect, ag
TypeScriptでpower-assertを使う時の注意点 - Qiita
TypeScriptでpower-assertを使ってテスト時に詳細情報を出そうとしたら, テスト実行そのものは問題ないのだが詳細情報が出なくて解決するまで小一時間かかってしまいました. せっかくなので注意点として共有しておきます. 2016/02/17 追記 DefinitelyTypedのpower-assert.d.ts側で対応されたため、本記事で書いていた注意点について気にする必要がなくなりました！ 最新のDefinitelyTypedのpower-assert.d.tsを使って、
リリース、障害情報などのサービスのお知らせ
最新の人気エントリーの配信
j次のブックマーク
k前のブックマーク
lあとで読む
eコメント一覧を開く
oページを開く
fix(power-assert): use CommonJS style default export statement by teppeis · Pull Request #8127 · DefinitelyTyped/DefinitelyTyped
GitBook – Knowledge management for technical teams
TypeScript + power-assert + ES6 Modules issue http://qiita.com/wadahiro/items/5d8a81252f2105112339
GitHub - lodash/lodash at es