Liran Tal - StrangerDanger - Finding Security Vulnerabilities Before They Find You - Voxxed Days Frontend Bucharest 2019

•

1 like•168 views

Open source modules on the NPM ecosystem are undoubtedly awesome. However, they also represent an undeniable and massive risk. You’re introducing someone else’s code into your system, often with little or no scrutiny. The wrong package can introduce severe vulnerabilities into your application, exposing your application and your user’s data. This talk will use a sample application, Goof, which uses various vulnerable dependencies, which we will exploit as an attacker would. For each issue, we’ll explain why it happened, show its impact, and – most importantly – see how to avoid or fix it.

Software

StrangerDanger! 
Finding Security Vulnerabilities
Before They Find You!
Liran Tal | Developer Advocate at Snyk
@liran_tal VoxxedDays Frontend, May 2019

Liran Tal
Developer Advocate at Snyk
@liran_tal

@liran_tal
Open Source is written by  
People

@liran_tal
Do you know  
which dependencies  
you have?

@liran_tal
Open Source is written by  
People
Strangers

@liran_tal
ﬂatmap-stream
eslint-scope
crossenv

@liran_tal
A typical JavaScript app has  
100s or 1,000s of dependencies
Some direct, most indirect

A Serverless use-case
19 Lines of Code
2 Direct dependencies
19 dependencies (incl. indirect)
191,155 Lines of Code

@liran_tal
AppSec Challenges
1. Software delivery sped up with little thought to security
2. Lack of security focus throughout the app lifecycle
3. Silo-ed security expertise

@liran_tal
What happens when we neglect 
open source security?

@liran_tal Source: Josh Corman & Dan Geer
Responsible
disclosure to
Apache
March 6th
Fixed version released
March 7th
Exploit script appeared
Java Struts 2 RCE Vulnerability 
CVE 2017-5638

@liran_tal Source: Josh Corman & Dan Geer
March 6th
Fixed version released
May 13th - July 30th
Equifax breach
Java Struts 2 RCE Vulnerability 
CVE 2017-5638

@liran_tal
Live Hacking
Let’s learn about vulnerabilities in 
open source libraries

@liran_tal
Attackers are  
targeting open source
One vulnerability, many victims

@liran_tal
What if security was easier?
developer-friendly?
actionable?

Open Source is Awesome 
Please enjoy responsibly!
Liran Tal | Developer Advocate at Snyk
@liran_tal VoxxedDays Frontend, May 2019
https://snyk.io

The document discusses the security risks of open source software and dependencies. It notes that while open source software is great, it can introduce vulnerabilities if dependencies are not properly reviewed since they are written by many strangers and may contain vulnerabilities. It advocates using a tool like Snyk to continuously find and fix vulnerabilities in dependencies before attackers can exploit them.

Software Security by Glenn Wilson

Alex Cachia

Intel introduction for Apidays Mediterranea

Molino de Ideas

Intel is a top 10 largest software company that generates nearly 15% of its revenue from software. It has made several software acquisitions focused on API management, security, and embedded software for IoT. Intel's API reference architecture aims to securely expose hybrid enterprises by integrating, packaging, protecting, and brokering APIs, big data, and mobile services across internal and external developer communities.

Android App Security Solution

Jay Li

Devoxx - Bug Wars: Episode IV - A New Hope

Mick McGuinness

APIdays Paris 2019 - The Rise of Shadow APIs by Guillaume Montard, Bearer.sh

apidays

The document discusses the rise of uncontrolled or "shadow" API usage and proposes a solution to manage it. It notes that while APIs are widely used, most usages are not managed or monitored. This can lead to security, operations, and development issues. The proposed solution is to log all API calls, filter and store the data, build a dashboard to view it, set up rules and alerts, and implement circuit breakers. This would provide visibility and control over API usage across security, operations, and development from a top-down or bottom-up approach to empower rather than enforce controls.

Mobile application security tools

QTMContent

Mobile Security & Analytics: What Works and What Doesn't

Skycure

The document discusses securing the ICT supply chain from cyber threats. It provides examples of past cyber attacks that targeted software supply chains, such as the Xcode Ghost attack in 2015 that compromised the iOS app developer toolchain. The document also discusses the risks of hardware supply chains being compromised through tactics like planting spy chips during the manufacturing and distribution process, as was reported done by the NSA on Cisco routers and servers from Amazon and Apple. It advocates breaking the cyber kill chain and securing different components of the ICT supply chain from chips to end customers to help stop threats.

The Art of Defensive Programming By Ipan Ardian

Ipan Ardian

Defensive programming is a form of programming intended to ensure software continues functioning under unexpected conditions. It is important for software dealing with safety, security, or high availability. Without defensive programming, bugs can have serious consequences like falsely reporting missile attacks, delivering fatal radiation overdoses, or destroying expensive rockets. Defensive practices include writing solid code following principles like single responsibility, testing units of code, conducting code reviews, and tracking errors in real time.

Content without Borders: How Ontologies Help You Provide Customers with Acces...

LavaConConference

Within an organization, each department uses their own content tools and formats. How to put them together into an interconnected web of knowledge that customers can navigate? We’ll discuss how an ontology can become a tool independent knowledge model connecting department-level content. We’ll see how through the web of semantic relationships, customers can start, for example, from a troubleshooting procedure written by technical writers, continue to an instructional video created by trainers, and get to best practices prepared by marketers. In this session, attendee’s will learn: What’s the difference between taxonomy and ontology? How an ontology defines the knowledge model of a domain How an ontology links a semantic model of the domain with the actual knowledge about the domain regardless of the format in which the content is created How an ontology makes information created by different departments in different formats an interconnected web of knowledge How to visualize ontologies How ontologies help you discover how seemingly unrelated issues are interconnected and affect each other How customer-facing intelligent applications, such as chatbots or customer portals, can use the ontology How to build an ontology: where to start and what tools to use

Getting Started with Titanium Studio

Ket Majmudar

This document provides instructions for getting started with Titanium Studio. It outlines downloading the necessary tools, including Xcode, iOS SDK, Android SDK, JDK, and Titanium Studio. It also discusses setting up an Apple developer account to deploy to iOS devices. The steps include installing the tools, preparing the Android SDK, setting up the system, installing Titanium Studio, creating a new mobile project, and reviewing demo applications.

MAXXYS@appsworld-berlin-2015

MAXXYS AG

MAXXYS AG is a Software System Integrator with over 10 years experience. We distribute, adapt and enhance software products of other manufacturers and integrate these in our customers IT. Our technology partner CA Technologies understands to deliver high valued products with their core in monitoring and security; today we are offering their latest products: CA Mobile Application Analytics (MAA) and CA API Management (former known as Layer7):

Index i phone app

sam-2015

APIDays Finland 2019 - How to Choose the Ultimate AI Platform

Merja Kajava

SPI Dynamics web application security 101

Wade Malone

Web applications are vulnerable to attacks at the application layer, with over 70% of attacks targeting websites and web applications directly. Traditional network and system security tools do not adequately assess vulnerabilities in custom web applications. SPI Dynamics develops automated web application security products that contain expert security knowledge to comprehensively scan websites and web applications, simulating how a hacker would attack. Their flagship product, WebInspect, automatically crawls an entire website and tests for vulnerabilities, providing an easy to understand report of issues found.

Pro Tips for Better Chatbot Experience

Muhammad Gilang Januar

The document provides tips for building better chatbots on the LINE platform, covering acquisition, interaction types, and development. It discusses using the LINE Messaging API for interactions like postbacks and datetime pickers. It also mentions using natural language processing and deploying bots locally with caching instead of databases for improved performance. Examples of LINE chatbots are provided on GitHub and the LINE developer community is available for additional support.

MCE^3 - Scott Alexander-Bown - Android App Security on a Budget

PROIDEA

The document discusses improving the security of an Android app called Acme Corp on a limited budget. It outlines three "sneak sprints" to enhance security: 1) strengthening the SSL/TLS connection and implementing SSL pinning, 2) checking device integrity and encrypting data, and 3) adding tamper detection and obfuscating the APK. While more code complexity was introduced, the app is now less vulnerable to man-in-the-middle attacks, XSS vulnerabilities, and tampering by rooted users. Resources for mobile security best practices are also provided.

Eddy the Eagle - The Student Chatbot

SohitGatiganti

Protecting the Front Door

Nick Malcolm

We can do a lot to secure our web-app backends, but ultimately our users email and password are the front door, and they're notoriously insecure. This talk quickly shows you how to mitigate this attack vector by detecting and responding to login anomalies using ThisData's Login Intelligence API. This talk was originally presented as at Ruby Nights Auckland on March 24 2016: http://www.meetup.com/aucklandruby/events/228852539/

Secure development environment @ Meet Magento Croatia 2017

Anna Völkl

Software development can sometimes be a mess: live database dumps needed for testing lying around, development files being forgotten or accidentally transferred to the live environment, untested code being written and deployed in a hurry. It's easy to mess up and fail, often without noticing for a long time. In this talk we'll have a look at how to bullet-proof your development workflow. It covers best practices and tools which you should use in your daily work that will improve the overall security and also speed up software development. http://hr.meet-magento.com/en/speaker/anna-volkl/

DevSecCon Singapore 2019: Web Services aren’t as secure as we think

DevSecCon

Tilak T Web-Services are taking over the world. Rest-framework is accelerating this development, because of its ease and flexibility. Developers often use and develop REST-based applications because it's exciting to work with. But they forget about security which leads to compromised and exploited applications. For instance, in more recent security tests against Web Services that my team executed, we found that vulnerabilities like Insecure Deserialization, XML External Entities, Server-Side Template Injection and Authorization Flaws are quite prevalent. I have found some simple steps that engineering teams can take towards finding and fixing such vulnerabilities with Web Services. This talk is offering a holistic perspective on finding and fixing some uncommon flaws that will be replete with anecdotes and examples of secure and insecure code. I will also delve into automating SAST and DAST tools using Robot-Framework to identify such flaws in Web-Services.

Cybersecurity: A game of innovation

W2O Group

Magento Security Best Practises - MM17PL

Anna Völkl

Software development can sometimes be a mess: live database dumps needed for testing lying around, development files being forgotten or accidentally transferred to the live environment, untested code being written and deployed in a hurry. It’s easy to mess up and fail, often without noticing for a long time. In this talk we’ll have a look at how to bullet-proof your development workflow. It covers best practices and tools which you should use in your daily work that will improve the overall security and also speed up software development. Presentation given on 18th September 2017 at Meet Magento Poland #mm17pl

P05 | Covid-19 & Apps | Anurag Gupta | MCA

ANURAGGUPTA570

A Modeling Editor and Code Generator for AsyncAPI

abgolla

Talk presented at the 1st AsyncAPI conference - https://www.asyncapiconf.com/ Talk summary: In the new Internet of Things (IoT) era, our everyday objects have evolved in the so-called cyber-physical systems (CPS). The use and deployment of CPS has especially penetrated the industry, giving rise to the Industry 4.0 or Industrial IoT (IIoT). Typically, architectures in IIot environments are distributed and asynchronous, communication being guided by events such as the publication of (and corresponding subscription to) messages. In this talk, we present AsyncAPI toolkit, our proposal relying on AsyncAPI to automate the design and implementation of these architectures using model-based techniques. AsyncAPI toolkit provides a set of editors and Eclipse-based tools which allow defining JSON-based specifications of message-driven APIs using AsyncAPI. From these specifications, the prototype is able to generate the Java code supporting the creation and serialization of JSON-based message payloads according to the modeled AsyncAPI, including nested JSON objects, as well as the necessary code to publish and subscribe to different topics. The initial prototype that implements this proposal as an open-source project is available at https://github.com/SOM-Research/asyncapi-toolkit

Patrick kane-priori-data

App Promotion Summit Conference

The document summarizes mobile app market trends from 2014. It shows that in 2014 both Android and iOS saw year-over-year growth in downloads and monthly growth in the number of available apps. It also provides insights into monthly download growth and rankings of top free apps by country and category for October 2013 versus October 2014. Social networking apps like Facebook and WhatsApp rose to the top of rankings in October 2014.

Teqnation 19 - Live Hacking

Brian Vermeer

1. The document discusses problems with software development such as lack of security focus throughout development and siloed security expertise. 2. It notes that open source usage has exploded but attackers are targeting vulnerabilities in open source libraries, meaning one vulnerability can impact many users. 3. The proposed solution is adopting a DevSecOps approach by focusing on team culture, development processes, and tools to integrate security from the beginning of the development lifecycle.

apidays LIVE Paris 2021 - API Attack Simulator - Find your API vulnerabilitie...

apidays

What's hot

Reptor_Poster

Yixiang(Eddie) Wu

Introduction to ICT supply chain (Cyber norms awareness)

Benjamin Ang

The Art of Defensive Programming By Ipan Ardian

Ipan Ardian

Content without Borders: How Ontologies Help You Provide Customers with Acces...

LavaConConference

Getting Started with Titanium Studio

Ket Majmudar

MAXXYS@appsworld-berlin-2015

MAXXYS AG

Index i phone app

sam-2015

APIDays Finland 2019 - How to Choose the Ultimate AI Platform

Merja Kajava

SPI Dynamics web application security 101

Wade Malone

Pro Tips for Better Chatbot Experience

Muhammad Gilang Januar

MCE^3 - Scott Alexander-Bown - Android App Security on a Budget

PROIDEA

Eddy the Eagle - The Student Chatbot

SohitGatiganti

Protecting the Front Door

Nick Malcolm

Secure development environment @ Meet Magento Croatia 2017

Anna Völkl

DevSecCon Singapore 2019: Web Services aren’t as secure as we think

DevSecCon

Cybersecurity: A game of innovation

W2O Group

Magento Security Best Practises - MM17PL

Anna Völkl

Software development can sometimes be a mess: live database dumps needed for testing lying around, development files being forgotten or accidentally transferred to the live environment, untested code being written and deployed in a hurry. It’s easy to mess up and fail, often without noticing for a long time. In this talk we’ll have a look at how to bullet-proof your development workflow. It covers best practices and tools which you should use in your daily work that will improve the overall security and also speed up software development. Presentation given on 18th September 2017 at Meet Magento Poland #mm17pl

P05 | Covid-19 & Apps | Anurag Gupta | MCA

ANURAGGUPTA570

A Modeling Editor and Code Generator for AsyncAPI

abgolla

Patrick kane-priori-data

App Promotion Summit Conference

What's hot (20)

Reptor_Poster

Introduction to ICT supply chain (Cyber norms awareness)

The Art of Defensive Programming By Ipan Ardian

Content without Borders: How Ontologies Help You Provide Customers with Acces...

Getting Started with Titanium Studio

MAXXYS@appsworld-berlin-2015

Index i phone app

APIDays Finland 2019 - How to Choose the Ultimate AI Platform

SPI Dynamics web application security 101

Pro Tips for Better Chatbot Experience

MCE^3 - Scott Alexander-Bown - Android App Security on a Budget

Eddy the Eagle - The Student Chatbot

Protecting the Front Door

Secure development environment @ Meet Magento Croatia 2017

DevSecCon Singapore 2019: Web Services aren’t as secure as we think

Cybersecurity: A game of innovation

Magento Security Best Practises - MM17PL

P05 | Covid-19 & Apps | Anurag Gupta | MCA

A Modeling Editor and Code Generator for AsyncAPI

Patrick kane-priori-data

Similar to Liran Tal - StrangerDanger - Finding Security Vulnerabilities Before They Find You - Voxxed Days Frontend Bucharest 2019

Teqnation 19 - Live Hacking

Brian Vermeer

apidays LIVE Paris 2021 - API Attack Simulator - Find your API vulnerabilitie...

apidays

apidays LIVE Singapore 2021 - Securing the Open Source supply chain by Liran ...

apidays

apidays LIVE Singapore 2021 - Digitisation, Connected Services and Embedded Finance April 21 & 22, 2021 Securing the Open Source supply chain Liran Tal, Director of Developer Advocacy at Snyk ------ Check out our conferences at https://www.apidays.global/ Do you want to sponsor or talk at one of our conferences? https://apidays.typeform.com/to/ILJeAaV8 Learn more on APIscene, the global media made by the community for the community: https://www.apiscene.io Explore the API ecosystem with the API Landscape: https://apilandscape.apiscene.io/

The State of Open Source Security - Liran Tal - 2019 NodeJS+Interactive Montreal

Liran Tal

Open source security affects everything from software supply chain attacks in package managers to container security which revealed in a recent study that the top ten most popular Docker images contain at least 30 vulnerable system libraries. In this session we will further explore the security posture of open source maintainers and deep characteristics of application dependencies across language ecosystems, with stories from the Node.js and npm ecosystem.

Securing containers by Breaking In - Liran Tal - DevSecCon Tel Aviv 2019

Liran Tal

There’s no better way to understand container security than seeing some live hacking! This sessions explains and distinguishes the security concern of each layer in the container stack by actually exploiting each layer. We’ll take on Kubernetes itself, the Kubernetes configuration, the container engine (sandbox escaping), OS dependencies in your images, and of course your application dependencies. Each successful hack will help you better understand the mistakes you can make, their implications, and how you can avoid them.

Build Better Apps through API Virtualization

Lorinda Brandon

The document discusses building better apps by testing APIs through virtualization. It recommends virtualizing both internal and external APIs to simulate different behaviors during development and testing without impacting the actual systems. This allows developers to assert proper usage of APIs and minimize risks from bad API calls. The document raises questions about how virtual APIs will be managed, maintained, integrated into CI processes, and how to implement access control and reporting when using API virtualization.

Open Source Insight: Who Owns Linux? TRITON Attack, App Security Testing, Fut...

Black Duck by Synopsys

We look at the three reasons you must attend the FLIGHT Amsterdam conference; how to build outstanding projects in the open source community; and why isn’t every app being security tested? Plus, in-depth into the TRITON attack; why 2018 is the year of open source; how open source is driving both IoT and AI and a webinar on the 2018 Open Source Rookies of the Year. Open Source Insight is your weekly news resource for open source security and cybersecurity news!

Snyk Intro - Developer Security Essentials 2022

Liran Tal

Overwhelmed with security issues in your Node.js applications? Not entirely sure how to write secure code? Join us in this workshop where you’ll learn how to improve security without being a security professional. We’ll use Snyk Code’s VS Code extension to catch and find security issues while you code, automatically fix security issues in your open source libraries, and see first-hand how to weaponize vulnerabilities to exploit working Node.js applications. You will also learn about the multiple ways of using Snyk to secure your projects, from the CLI, to CI/CD pipelines with GitHub Actions, and extend your know from secure code and secure dependencies to that of building secure containers to your Node.js apps on Docker.

Devoxx France 2022: Game Over or Game Changing? Why Software Development May ...

Steve Poole

A small but vital step on a long road was made last year. The President of the USA signed an executive order towards improving the situation on cybersecurity. In this session you’ll learn more about what was ordered and how it’s the beginning of a significant change in how software will be developed, delivered and secured in the future – not just in the USA but world wide too. The need to have a vastly improved software supply chain to counter the challenges of cyber attacks is well understood and many tools already exist. Learn more about the tooling landscape, what’s on the horizon and how presidential orders, the software industry and application development are coming together to take even bigger steps towards safeguarding the future.

Webinar: Why evasive zero day attacks are killing traditional sandboxing

Cyren, Inc

2022 APIsecure_A day in the life of an API; Fighting the odds

APIsecure_ Official

AppSec is Eating Security

Alex Stamos

Create a Unified View of Your Application Security Program – Black Duck Hub a...

Denim Group

Effective application security programs rely on multiple sources for vulnerability data – from traditional static and dynamic testing, interactive testing, to manual and 3rd-party testing. Unfortunately, many organizations fail to consider the impact of open source software use and reuse on their security posture. This webinar will demonstrate how Black Duck Hub can identify security issues associated with open source usage and how ThreadFix’s correlation engine can provide a comprehensive view of an organization’s application security posture. In addition, the webinar demonstrates how ThreadFix’s HotSpot detection technology identifies security issues created by internally developed components – providing a complete of both open source and proprietary component usage.

Apidays Singapore 2024 - Building Digital Trust in a Digital Economy by Veron...

apidays

Building Digital Trust in a Digital Economy Veronica Tan, Director - Cyber Security Agency of Singapore Apidays Singapore 2024: Connecting Customers, Business and Technology (April 17 & 18, 2024) ------ Check out our conferences at https://www.apidays.global/ Do you want to sponsor or talk at one of our conferences? https://apidays.typeform.com/to/ILJeAaV8 Learn more on APIscene, the global media made by the community for the community: https://www.apiscene.io Explore the API ecosystem with the API Landscape: https://apilandscape.apiscene.io/

JacksonvilleJUG_CVE101.pdf

Theresa Mammarella

GIDS-2023 A New Hope for 2023? What Developers Must Learn Next

Steve Poole

This document discusses the evolving threats from cybercrime and importance of securing the software supply chain. It notes that cybercrime now costs over $6 trillion annually, similar to the global GDP of major countries. Attacks have become more sophisticated using techniques like supply chain compromises and exploiting vulnerabilities before they are publicly known. Developers are urged to carefully select open source components based on security practices like using SBOMs and rapid patching. The talk recommends following secure development principles and keeping educated on improving tools that can help harden applications and their supply chains.

Aliens in Your Apps!

All Things Open

The document discusses the results of a survey on open source software usage and security practices. Some key findings include: - Over half of organizations have an open source policy but only two-thirds follow the policies. Top challenges are lack of enforcement and unclear expectations. - Most organizations do not have meaningful controls over the components used in applications and many have an incomplete view of license risks. - Few organizations actively monitor components for vulnerability changes or maintain an inventory of components used in production applications. Responsibilities for security are often unclear. - Application security practices often lag development speeds, with security analysis rarely performed early in the process. Training availability and developer interest in security is limited.

(Isc)² secure johannesburg

Tunde Ogunkoya

This talk focussed on the challenges facing the DevOps community from the “developers culture perspective” and the consequences of the perceived disinterest in inculcating a complete 360 degrees’ risk mitigation framework in DevOps practices. The talk touched on the legal +Security+Operational Risk of using Open Source in their SDLC, the need for internal customized Open Source policy and a two-step approach to resolve these risks

LSI Spring Agent Open House 2014

Ashlie Steele

This document appears to be a series of slides from a presentation on cloud computing and cybersecurity. The slides discuss trends in cyber threats like the rapid growth of malware and frequent attacks on web servers. They highlight challenges small-to-medium enterprises face in cybersecurity like limited resources and complexity. The presentation introduces Sophos as a cybersecurity vendor that aims to provide complete, simple security solutions that can be deployed and managed in various ways including on-premise, as a service, or in the cloud. It suggests Sophos offers unified protection across networks, servers, endpoints and mobile devices through an intuitive management console.

Security in the age of open source - Myths and misperceptions

Tim Mackey

As delivered at Interop ITX 2017. The security of open source software is a function of the security of its components. For most applications, open source technologies are at their core, but security related issues may not be disclosed directly against the application because its use of the open-source component is hidden. In this talk, I explored how information flow benefits attackers, but how awareness can help defenders. I presented key attributes any vulnerability solution should have - including deep understanding of how open source development works and being DevOps aware.

Similar to Liran Tal - StrangerDanger - Finding Security Vulnerabilities Before They Find You - Voxxed Days Frontend Bucharest 2019 (20)

Teqnation 19 - Live Hacking

apidays LIVE Paris 2021 - API Attack Simulator - Find your API vulnerabilitie...

apidays LIVE Singapore 2021 - Securing the Open Source supply chain by Liran ...

The State of Open Source Security - Liran Tal - 2019 NodeJS+Interactive Montreal

Securing containers by Breaking In - Liran Tal - DevSecCon Tel Aviv 2019

Build Better Apps through API Virtualization

Open Source Insight: Who Owns Linux? TRITON Attack, App Security Testing, Fut...

Snyk Intro - Developer Security Essentials 2022

Devoxx France 2022: Game Over or Game Changing? Why Software Development May ...

Webinar: Why evasive zero day attacks are killing traditional sandboxing

2022 APIsecure_A day in the life of an API; Fighting the odds

AppSec is Eating Security

Create a Unified View of Your Application Security Program – Black Duck Hub a...

Apidays Singapore 2024 - Building Digital Trust in a Digital Economy by Veron...

JacksonvilleJUG_CVE101.pdf

GIDS-2023 A New Hope for 2023? What Developers Must Learn Next

Aliens in Your Apps!

(Isc)² secure johannesburg

LSI Spring Agent Open House 2014

Security in the age of open source - Myths and misperceptions

Recently uploaded

Migration From CH 1.0 to CH 2.0 and Mule 4.6 & Java 17 Upgrade.pptx

ervikas4

Malibou Pitch Deck For Its €3M Seed Round

sjcobrien

UI5con 2024 - Boost Your Development Experience with UI5 Tooling Extensions

Peter Muessig

The UI5 tooling is the development and build tooling of UI5. It is built in a modular and extensible way so that it can be easily extended by your needs. This session will showcase various tooling extensions which can boost your development experience by far so that you can really work offline, transpile your code in your project to use even newer versions of EcmaScript (than 2022 which is supported right now by the UI5 tooling), consume any npm package of your choice in your project, using different kind of proxies, and even stitching UI5 projects during development together to mimic your target environment.

ppt on the brain chip neuralink.pptx

Reetu63

一比一原版(USF毕业证)旧金山大学毕业证如何办理

dakas1

USF硕士毕业证成绩单【微信95270640】一比一伪造旧金山大学文凭@假冒USF毕业证成绩单+Q微信95270640办理USF学位证书@仿造USF毕业文凭证书@购买旧金山大学毕业证成绩单USF真实使馆认证/真实留信认证回国人员证明 #一整套旧金山大学文凭证件办理#—包含旧金山大学旧金山大学本科毕业证成绩单学历认证|使馆认证|归国人员证明|教育部认证|留信网认证永远存档教育部学历学位认证查询办理国外文凭国外学历学位认证#我们提供全套办理服务。一整套留学文凭证件服务：一：旧金山大学旧金山大学本科毕业证成绩单毕业证 #成绩单等全套材料从防伪到印刷水印底纹到钢印烫金二：真实使馆认证（留学人员回国证明）使馆存档三：真实教育部认证教育部存档教育部留服网站永久可查四：留信认证留学生信息网站永久可查国外毕业证学位证成绩单办理方法： 1客户提供办理旧金山大学旧金山大学本科毕业证成绩单信息：姓名生日专业学位毕业时间等（如信息不确定可以咨询顾问：我们有专业老师帮你查询）； 2开始安排制作毕业证成绩单电子图； 3毕业证成绩单电子版做好以后发送给您确认； 4毕业证成绩单电子版您确认信息无误之后安排制作成品； 5成品做好拍照或者视频给您确认； 6快递给客户（国内顺丰国外DHLUPS等快读邮寄）。教育部文凭学历认证认证的用途：如果您计划在国内发展那么办理国内教育部认证是必不可少的。事业性用人单位如银行国企公务员在您应聘时都会需要您提供这个认证。其他私营 #外企企业无需提供！办理教育部认证所需资料众多且烦琐所有材料您都必须提供原件我们凭借丰富的经验帮您快速整合材料让您少走弯路。实体公司专业为您服务如有需要请联系我: 微信95270640奈一次次令他失望山娃今年岁上五年级识得很多字从走出小屋开始山娃就知道父亲的家和工地共有一个很动听的名字——天河工地的底层空空荡荡很宽阔很凉爽在地上铺上报纸和水泥袋父亲和工人们中午全睡在地上地面坑坑洼洼山娃曾多次绊倒过也曾有长铁钉穿透凉鞋刺在脚板上但山娃不怕工地上也常有五六个从乡下来的小学生他们的父母亲也是高楼上的建筑工人小伙伴来自不同省份都操着带有浓重口音的普通话可不知为啥山娃不仅很快与他们熟识了

一比一原版(sdsu毕业证书)圣地亚哥州立大学毕业证如何办理

kgyxske

原版一模一样【微信：741003700 】【(sdsu毕业证书)圣地亚哥州立大学毕业证成绩单】【微信：741003700 】学位证，留信认证（真实可查，永久存档）原件一模一样纸张工艺/offer、雅思、外壳等材料/诚信可靠,可直接看成品样本，帮您解决无法毕业带来的各种难题！外壳，原版制作，诚信可靠，可直接看成品样本。行业标杆！精益求精，诚心合作，真诚制作！多年品质 ,按需精细制作，24小时接单,全套进口原装设备。十五年致力于帮助留学生解决难题，包您满意。本公司拥有海外各大学样板无数，能完美还原。 1:1完美还原海外各大学毕业材料上的工艺：水印，阴影底纹，钢印LOGO烫金烫银，LOGO烫金烫银复合重叠。文字图案浮雕、激光镭射、紫外荧光、温感、复印防伪等防伪工艺。材料咨询办理、认证咨询办理请加学历顾问Q/微741003700 【主营项目】一.毕业证【q微741003700】成绩单、使馆认证、教育部认证、雅思托福成绩单、学生卡等！二.真实使馆公证(即留学回国人员证明,不成功不收费) 三.真实教育部学历学位认证（教育部存档！教育部留服网站永久可查）四.办理各国各大学文凭(一对一专业服务,可全程监控跟踪进度) 如果您处于以下几种情况： ◇在校期间，因各种原因未能顺利毕业……拿不到官方毕业证【q/微741003700】 ◇面对父母的压力，希望尽快拿到； ◇不清楚认证流程以及材料该如何准备； ◇回国时间很长，忘记办理； ◇回国马上就要找工作，办给用人单位看； ◇企事业单位必须要求办理的 ◇需要报考公务员、购买免税车、落转户口 ◇申请留学生创业基金留信网认证的作用: 1:该专业认证可证明留学生真实身份 2:同时对留学生所学专业登记给予评定 3:国家专业人才认证中心颁发入库证书 4:这个认证书并且可以归档倒地方 5:凡事获得留信网入网的信息将会逐步更新到个人身份内，将在公安局网内查询个人身份证信息后，同步读取人才网入库信息 6:个人职称评审加20分 7:个人信誉贷款加10分 8:在国家人才网主办的国家网络招聘大会中纳入资料，供国家高端企业选择人才办理(sdsu毕业证书)圣地亚哥州立大学毕业证【微信：741003700 】外观非常简单，由纸质材料制成，上面印有校徽、校名、毕业生姓名、专业等信息。办理(sdsu毕业证书)圣地亚哥州立大学毕业证【微信：741003700 】格式相对统一，各专业都有相应的模板。通常包括以下部分：校徽：象征着学校的荣誉和传承。校名:学校英文全称授予学位：本部分将注明获得的具体学位名称。毕业生姓名：这是最重要的信息之一，标志着该证书是由特定人员获得的。颁发日期：这是毕业正式生效的时间，也代表着毕业生学业的结束。其他信息：根据不同的专业和学位，可能会有一些特定的信息或章节。办理(sdsu毕业证书)圣地亚哥州立大学毕业证【微信：741003700 】价值很高，需要妥善保管。一般来说，应放置在安全、干燥、防潮的地方，避免长时间暴露在阳光下。如需使用，最好使用复印件而不是原件，以免丢失。综上所述，办理(sdsu毕业证书)圣地亚哥州立大学毕业证【微信：741003700 】是证明身份和学历的高价值文件。外观简单庄重，格式统一，包括重要的个人信息和发布日期。对持有人来说，妥善保管是非常重要的。

Everything You Need to Know About X-Sign: The eSign Functionality of XfilesPr...

XfilesPro

8 Best Automated Android App Testing Tool and Framework in 2024.pdf

kalichargn70th171

Preparing Non - Technical Founders for Engaging a Tech Agency

ISH Technologies

Preparing non-technical founders before engaging a tech agency is crucial for the success of their projects. It starts with clearly defining their vision and goals, conducting thorough market research, and gaining a basic understanding of relevant technologies. Setting realistic expectations and preparing a detailed project brief are essential steps. Founders should select a tech agency with a proven track record and establish clear communication channels. Additionally, addressing legal and contractual considerations and planning for post-launch support are vital to ensure a smooth and successful collaboration. This preparation empowers non-technical founders to effectively communicate their needs and work seamlessly with their chosen tech agency.Visit our site to get more details about this. Contact us today www.ishtechnologies.com.au

Unveiling the Advantages of Agile Software Development.pdf

brainerhub1

Quarter 3 SLRP grade 9.. gshajsbhhaheabh

aisafed42

Baha Majid WCA4Z IBM Z Customer Council Boston June 2024.pdf

Baha Majid

IBM watsonx Code Assistant for Z, our latest Generative AI-assisted mainframe application modernization solution. Mainframe (IBM Z) application modernization is a topic that every mainframe client is addressing to various degrees today, driven largely from digital transformation. With generative AI comes the opportunity to reimagine the mainframe application modernization experience. Infusing generative AI will enable speed and trust, help de-risk, and lower total costs associated with heavy-lifting application modernization initiatives. This document provides an overview of the IBM watsonx Code Assistant for Z which uses the power of generative AI to make it easier for developers to selectively modernize COBOL business services while maintaining mainframe qualities of service.

Mobile App Development Company In Noida | Drona Infotech

Drona Infotech

如何办理(hull学位证书)英国赫尔大学毕业证硕士文凭原版一模一样

gapen1

原版定制【微信:bwp0011】《(hull学位证书)英国赫尔大学毕业证硕士文凭》【微信:bwp0011】成绩单、雅思、外壳、留信学历认证永久存档查询，采用学校原版纸张、特殊工艺完全按照原版一比一制作（包括：隐形水印，阴影底纹，钢印LOGO烫金烫银，LOGO烫金烫银复合重叠，文字图案浮雕，激光镭射，紫外荧光，温感，复印防伪）行业标杆！精益求精，诚心合作，真诚制作！多年品质 ,按需精细制作，24小时接单,全套进口原装设备，十五年致力于帮助留学生解决难题，业务范围有加拿大、英国、澳洲、韩国、美国、新加坡，新西兰等学历材料，包您满意。【业务选择办理准则】一、工作未确定，回国需先给父母、亲戚朋友看下文凭的情况，办理一份就读学校的毕业证【微信bwp0011】文凭即可二、回国进私企、外企、自己做生意的情况，这些单位是不查询毕业证真伪的，而且国内没有渠道去查询国外文凭的真假，也不需要提供真实教育部认证。鉴于此，办理一份毕业证【微信bwp0011】即可三、进国企，银行，事业单位，考公务员等等，这些单位是必需要提供真实教育部认证的，办理教育部认证所需资料众多且烦琐，所有材料您都必须提供原件，我们凭借丰富的经验，快捷的绿色通道帮您快速整合材料，让您少走弯路。留信网认证的作用: 1:该专业认证可证明留学生真实身份 2:同时对留学生所学专业登记给予评定 3:国家专业人才认证中心颁发入库证书 4:这个认证书并且可以归档倒地方 5:凡事获得留信网入网的信息将会逐步更新到个人身份内，将在公安局网内查询个人身份证信息后，同步读取人才网入库信息 6:个人职称评审加20分 7:个人信誉贷款加10分 8:在国家人才网主办的国家网络招聘大会中纳入资料，供国家高端企业选择人才【关于价格问题（保证一手价格）】我们所定的价格是非常合理的，而且我们现在做得单子大多数都是代理和回头客户介绍的所以一般现在有新的单子我给客户的都是第一手的代理价格，因为我想坦诚对待大家不想跟大家在价格方面浪费时间对于老客户或者被老客户介绍过来的朋友，我们都会适当给一些优惠。

一比一原版(UMN毕业证)明尼苏达大学毕业证如何办理

dakas1

UMN硕士毕业证成绩单【微信95270640】购买（明尼苏达大学毕业证成绩单硕士学历）Q微信95270640代办UMN学历认证留信网伪造明尼苏达大学学位证书精仿明尼苏达大学本科/硕士文凭证书补办明尼苏达大学 diplomaoffer,Transcript购买明尼苏达大学毕业证成绩单购买UMN假毕业证学位证书购买伪造明尼苏达大学文凭证书学位证书,专业办理雅思、托福成绩单，学生ID卡，在读证明，海外各大学offer录取通知书，毕业证书，成绩单，文凭等材料:1:1完美还原毕业证、offer录取通知书、学生卡等各种在读或毕业材料的防伪工艺（包括烫金、烫银、钢印、底纹、凹凸版、水印、防伪光标、热敏防伪、文字图案浮雕，激光镭射，紫外荧光，温感光标）学校原版上有的工艺我们一样不会少，不论是老版本还是最新版本，都能保证最高程度还原，力争完美以求让所有同学都能享受到完美的品质服务。 #毕业证成绩单 #毕业証 #成绩单 #學生卡 #OFFER录取通知书 #雅思#托福等…… 国外大学明尼苏达大学明尼苏达大学毕业证offer制作方法（一对一专业服务） 1客户提供办理信息：姓名生日专业学位毕业时间等（如信息不确定可以咨询顾问：我们有专业老师帮你查询）； 2开始安排制作毕业证成绩单电子图； 3毕业证成绩单电子版做好以后发送给您确认； 4毕业证成绩单电子版您确认信息无误之后安排制作成品； 5成品做好拍照或者视频给您确认； 6快递给客户（国内顺丰国外DHLUPS等快读邮寄） — — 制作工艺【高仿真】— — 凭借多年的制作经验本公司制作明尼苏达大学明尼苏达大学毕业证offer《激光》《水印》《钢印》《烫金》《紫外线》凹凸版uv版等防伪技术一流高精仿度几乎跟学校100%相同！让您绝对满意。 — — -公司理念【诚信为主】— — — 我們以質量求生存.以服务求发展有雄厚的实力专业的团队咨询顾问为您细心解答可详谈是真是假眼见为实让您真正放心平凡人生,尽我所能助您一臂之力让我們携手圆您梦想! 此贴长年有效【贴心专线/微-信: 95270640】敬请保留此联系方式以备用！如有不在线请给我们留言！我们将在第一时间给您回复!上散发着一抹抹的光晕而这每处自然形成的细节融合在一起浑然天成的美实在令人心生愉悦小道的周边无秩序的生长着几株艳丽的野花红的粉的紫的虽混乱无章却给这幅美景更增添一份性感夹杂着一份纯洁的妖娆毫无违和感实在给人带来一份悠然幸福的心情如果说现在的审美已经断然拒绝了无声的话那么在树林间飞掠而过的小鸟叽叽咋咋的叫声是否就是这最后的点睛之笔悠然走在林间的小路上宁静与清香一丝丝的盛夏气息吸入身体昔日生活里的繁忙多

Enums On Steroids - let's look at sealed classes !

Marcin Chrost

All you need to know about Spring Boot and GraalVM

Alina Yurenko

E-commerce Development Services- Hornet Dynamics

Hornet Dynamics

Oracle 23c New Features For DBAs and Developers.pptx

Remote DBA Services

Enhanced Screen Flows UI/UX using SLDS with Tom Kitt

Peter Caitens

Recently uploaded (20)

Migration From CH 1.0 to CH 2.0 and Mule 4.6 & Java 17 Upgrade.pptx

Malibou Pitch Deck For Its €3M Seed Round

UI5con 2024 - Boost Your Development Experience with UI5 Tooling Extensions

ppt on the brain chip neuralink.pptx

一比一原版(USF毕业证)旧金山大学毕业证如何办理

一比一原版(sdsu毕业证书)圣地亚哥州立大学毕业证如何办理

Everything You Need to Know About X-Sign: The eSign Functionality of XfilesPr...

8 Best Automated Android App Testing Tool and Framework in 2024.pdf

Preparing Non - Technical Founders for Engaging a Tech Agency

Unveiling the Advantages of Agile Software Development.pdf

Quarter 3 SLRP grade 9.. gshajsbhhaheabh

Baha Majid WCA4Z IBM Z Customer Council Boston June 2024.pdf

Mobile App Development Company In Noida | Drona Infotech

如何办理(hull学位证书)英国赫尔大学毕业证硕士文凭原版一模一样

一比一原版(UMN毕业证)明尼苏达大学毕业证如何办理

Enums On Steroids - let's look at sealed classes !

All you need to know about Spring Boot and GraalVM

E-commerce Development Services- Hornet Dynamics

Oracle 23c New Features For DBAs and Developers.pptx

Enhanced Screen Flows UI/UX using SLDS with Tom Kitt

Liran Tal - StrangerDanger - Finding Security Vulnerabilities Before They Find You - Voxxed Days Frontend Bucharest 2019

1. StrangerDanger!  Finding Security Vulnerabilities Before They Find You! Liran Tal | Developer Advocate at Snyk @liran_tal VoxxedDays Frontend, May 2019

2. Liran Tal Developer Advocate at Snyk @liran_tal

3. @liran_tal Open Source is Awesome

5. @liran_tal Open Source is written by   People

6. @liran_tal Do you know   which dependencies   you have?

7. @liran_tal Open Source is written by   People Strangers

8. @liran_tal

10.

11. @liran_tal

12. @liran_tal ﬂatmap-stream eslint-scope crossenv

13. @liran_tal A typical JavaScript app has   100s or 1,000s of dependencies Some direct, most indirect

14. A Serverless use-case 19 Lines of Code 2 Direct dependencies 19 dependencies (incl. indirect) 191,155 Lines of Code

15. @liran_tal Your App

16. @liran_tal Your Code Your App

17. @liran_tal AppSec Challenges 1. Software delivery sped up with little thought to security 2. Lack of security focus throughout the app lifecycle 3. Silo-ed security expertise

18. @liran_tal What happens when we neglect  open source security?

19. @liran_tal

20. @liran_tal Source: Josh Corman & Dan Geer Responsible disclosure to Apache March 6th Fixed version released March 7th Exploit script appeared Java Struts 2 RCE Vulnerability  CVE 2017-5638

21. @liran_tal Source: Josh Corman & Dan Geer March 6th Fixed version released May 13th - July 30th Equifax breach Java Struts 2 RCE Vulnerability  CVE 2017-5638

22. @liran_tal Live Hacking Let’s learn about vulnerabilities in  open source libraries

23. @liran_tal Attackers are   targeting open source One vulnerability, many victims

24.

25. @liran_tal What if security was easier? developer-friendly? actionable?

26. @liran_tal

27. @liran_tal

28. @liran_tal

29. @liran_tal

30. Open Source is Awesome  Please enjoy responsibly! Liran Tal | Developer Advocate at Snyk @liran_tal VoxxedDays Frontend, May 2019 https://snyk.io

Liran Tal - StrangerDanger - Finding Security Vulnerabilities Before They Find You - Voxxed Days Frontend Bucharest 2019

Recommended

Recommended

More Related Content

What's hot

What's hot (20)

Similar to Liran Tal - StrangerDanger - Finding Security Vulnerabilities Before They Find You - Voxxed Days Frontend Bucharest 2019

Similar to Liran Tal - StrangerDanger - Finding Security Vulnerabilities Before They Find You - Voxxed Days Frontend Bucharest 2019 (20)

Recently uploaded

Recently uploaded (20)

Liran Tal - StrangerDanger - Finding Security Vulnerabilities Before They Find You - Voxxed Days Frontend Bucharest 2019