Articles

Conversion chaîne en énumération - CVE-2020-36620 (50 Go)

Conversion chaîne en énumération – CVE-2020-36620 (50 Go): Découvrez comment convertir une chaîne en énumération avec 50 Go de données à l’aide de CVE-2020-36620.

## Discuter de la vulnérabilité CVE-2020-36620 et voir comment un package NuGet pour convertir une chaîne en énumération peut rendre une application C# vulnérable aux attaques DoS

En tant qu’informaticien enthousiaste, je vais discuter de la vulnérabilité CVE-2020-36620 et voir comment un package NuGet pour convertir une chaîne en énumération peut rendre une application C # vulnérable aux attaques DoS.

Imaginons une application serveur qui interagit avec un utilisateur. Dans l’un des scénarios, l’application reçoit des données de l’utilisateur sous forme de chaîne et les convertit en éléments d’énumération (chaîne -> énumération).

Le package NuGet en question est conçu pour faciliter ce processus de conversion. Cependant, le package ne vérifie pas si la chaîne reçue est valide et peut donc être exploité par un attaquant pour provoquer un déni de service. Lorsqu’un attaquant envoie une chaîne qui n’est pas valide, le package tente de convertir la chaîne en énumération et cela peut entraîner une exception et un plantage de l’application.

Pour résoudre ce problème, nous devons vérifier que la chaîne reçue est valide avant de l’utiliser. Nous pouvons le faire en utilisant le code C # pour vérifier si la chaîne est comprise dans l’énumération. Si ce n’est pas le cas, nous pouvons alors retourner une erreur à l’utilisateur et éviter ainsi tout plantage de l’application.

En résumé, le package NuGet pour convertir une chaîne en énumération peut être exploité par un attaquant pour provoquer un déni de service. Pour éviter cela, nous devons vérifier que la chaîne reçue est valide avant de l’utiliser. Nous pouvons le faire en codant une fonction qui vérifie si la chaîne est comprise dans l’énumération et retourne une erreur à l’utilisateur si ce n’est pas le cas. En appliquant cette méthode, nous pouvons éviter les attaques DoS et assurer la sécurité de notre application.

Source de l’article sur DZONE


TL; DR: ChatGPT Prompts for Scrum Practitioners

Last week, I ran an “interview” with ChatGPT as an applicant for a fictitious Scrum Master position based on questions from Scrum Master Interview Guide. While the overall results were broadly acceptable, I thought that changing the ChatGPT prompts might deliver better results. So, this time, I chose to present ChatGPT with three everyday scenarios based on more comprehensive prompts. Lo and behold, it worked very well.

Think twice if you still believe this technology is a fad or a toy. Instead, grab a cup of coffee and read for yourself.

Source de l’article sur DZONE

The majority of web products use AJAX (Asynchronous JavaScript and XML), where elements on the page are loaded at varying time intervals. This can lead to timing issues when automation testing is performed using the Selenium framework. What if a test is run on a WebElement that is not present in the DOM? The findElement function will raise ElementNotVisibleException.

Here are other scenarios that can cause issues in Selenium due to the dynamic loading of elements:

Source de l’article sur DZONE

IT modernization and innovative new technologies change the healthcare industry significantly. This blog series explores how data streaming with Apache Kafka enables real-time data processing and business process automation. Real-world examples show how traditional enterprises and startups increase efficiency, reduce cost, and improve the human experience across the healthcare value chain, including pharma, insurance, providers, retail, and manufacturing. This is part five: Open API and Omnichannel. Examples include Care.com and Invitae.

Blog Series – Kafka in Healthcare

Many healthcare companies leverage Kafka today. Use cases exist in every domain across the healthcare value chain. Most companies deploy data streaming in different business domains. Use cases often overlap. I tried to categorize a few real-world deployments into different technical scenarios and added a few real-world examples:

Source de l’article sur DZONE

IT modernization and innovative new technologies change the healthcare industry significantly. This blog series explores how data streaming with Apache Kafka enables real-time data processing and business process automation. Real-world examples show how traditional enterprises and startups increase efficiency, reduce cost, and improve the human experience across the healthcare value chain, including pharma, insurance, providers, retail, and manufacturing. This is part five: Machine Learning and Data Science. Examples include Recursion and Humana.

Blog Series – Kafka in Healthcare

Many healthcare companies leverage Kafka today. Use cases exist in every domain across the healthcare value chain. Most companies deploy data streaming in different business domains. Use cases often overlap. I tried to categorize a few real-world deployments into different technical scenarios and added a few real-world examples:

Source de l’article sur DZONE

Alert windows are widely used across websites where an alert message acts as a mode to ‘interrupt’ the current flow of the user journey. A simple example of a JavaScript alert would be someone filling in details on the sign-up page and submitting the details without entering some mandatory information. This user flow also needs to be verified when Selenium automation testing is performed on the web product. 

Handling pop-ups and alerts are one of the common test scenarios that should be tested using Selenium WebDriver. In this post of the Selenium Python tutorial series, we look at how to handle JavaScript alerts in Python. It is worth mentioning that the core fundamentals of JavaScript alerts and popups remain unchanged irrespective of the programming language used for Selenium.

Source de l’article sur DZONE

This article illustrates three scenarios that demonstrate how you can use IBM App Connect to build flows that integrate with apps. The three connectors that we will use for these scenarios are;

  1. Microsoft Azure Active Directory – a cloud-based identity and access management (IAM) solution that provides single sign-on and multi-factor authentication that helps to protect from cybersecurity attacks.
  2. Oracle E-Business Suite  – a complete set of business applications for managing and automating processes within your organization.                                                                 
  3. Salesforce Marketing Cloud – a customer relationship management platform that provides digital marketing automation and analytics software and services.

1. Using Microsoft Azure AD With IBM App Connect

You can use App Connect to perform actions on the following objects:

Source de l’article sur DZONE

Working with data, there are several scenarios to transform data from input files using the Mule 4 connector.

There are several scenarios for files with special characters or language-based characters.

Source de l’article sur DZONE

MySQL semi-synchronous is a plugin mechanism on top of asynchronous replication that can offer better durability and even consistency. It helps in high availability solutions, but can in itself reduce availability. In this article, we will look at some basics and follow up to present scenarios requiring higher-level intervention to ensure availability and avoid split-brains.

Overview

As a quick recap, semi-synchronous replication is a mechanism where a commit on the primary does not apply the change onto the internal table data and does not respond to the user until the changelog is guaranteed to have been persisted (though not necessarily applied) on a preconfigured number of replicas. We limit our discussion to MySQL 5.7 or equivalent.

Source de l’article sur DZONE

Picture a dark office, blinds drawn. Picture a UX designer smoking a cigar. See the light filtered through the smoke whipped to fog by a spinning ceiling fan. Watch as the UX designer sits at a desk and considers the website.

The UX designer has devised a series of tests to determine if a green button is better than a red button. One of them involves tipping a tortoise onto its back. He looks the website over carefully and says, “Describe in single words, only the good things that come to mind about your mother.”

The website pauses, sweating under pressure, then replies, “Let me tell you about my mother…”

BLAM! The website pulls the trigger of an unseen gun, and the UX designer collapses, leaving the project to be rebuilt from scratch in Material by Harrison Ford, with overuse of Post-its delegated to Edward James Olmos.

Who Does UX Testing Actually Serve?

In the past’s bleak dystopian future (1982’s Blade Runner was set in 2019) no one benefitted from asking the wrong questions. And little has changed.

Designing any test to verify UX is fraught with as many complications as administering the test. Questions are skewed by bias, conscious or otherwise, and competing agendas. Even with something as apparently simple as a split test, the potential for distortion is immense.

When planned by a designer, a UX test offers little benefit to a client; the benefit is to the designer, who can then say their ideas are validated (or not).

Imagine hiring a developer to code a website, only to discover that the developer didn’t know CSS and expected to be paid to learn it before completing the work. You would hire someone else because that developer isn’t qualified.

From a client’s perspective, a UX designer should know, through experience, whether a green button is better than a red button. Designing an elaborate test to split-test the button color serves little purpose other than indemnifying the designer against mistakes.

The ROI of UX Testing

It’s widely accepted that there is substantial ROI (Return On Investment) from UX testing. We’ve all heard apocryphal stories about sites that split-tested their checkout and improved retention by 5%.

I’m going to go out on a limb and say that without user testing, that site could have improved its checkout retention by 4.9% simply by hiring a competent, experienced designer. But what about the remaining 0.1%? Well, for most sites, 0.1% represents very little profit. And the cost of recovering it via testing far exceeds the benefits.

When a company the size of Amazon, Netflix, Spotify, or Google split tests a website, it can afford to allocate $25k for user testing because it stands to gain 0.1%, and that represents far more than $25k. To meet the same 0.1% improvement, a small business has to design and run the same tests, incurring the same costs. But in the case of a small business, $25k could eat up all of its profits.

UX testing almost always works. But it is only profitable at scale.

If a good UI designer with a grounding in UX can improve checkout retention by 4.9%, tripling the project budget for just 0.1% more is a tough sell. Bluntly, that $25k is better spent on advertising.

What UX Designers Can Learn From Psychiatry

We all have the tendency to think we’re unique. It’s a survival trait attributed to our prehistoric brain. That belief in uniqueness is particularly strong in highly competitive people. We all think our site, our side-project, our approach are original. And we’re all wrong.

When a psychiatrist sits down with a patient, they have two immediate goals: categorize that patient into an established diagnosis, and assess the severity of the condition. It may be that the patient is depressed or anxious or even suffering from a potentially more debilitating condition like schizophrenia. What the psychiatrist is not trying to do, is define a new illness.

Occasionally — perhaps once per decade — a genuinely unusual patient will present themselves, and a new form of illness is considered. New treatments are found and tested. These treatments are rarely developed on behalf of individual patients; doctors work with grants from governments, medical schools, or the pharmaceutical industry and publish their results.

The vast majority of websites face similar problems. They deal with similar demographics, work within a similar culture, and deal with similar technology. As such, they can be categorized in the same manner a psychiatrist categorizes patients.

The key to delivering successful UX solutions is not UX testing in individual cases, but rather UX research, examining similar projects, and cribbing their solutions. If you categorize a project accurately, you’ll find a solution readily available.

Replacing User Testing With UX Best Practices

Your client doesn’t need to pay for UX testing to benefit from it. Enterprise sites, government sites, and even personal projects will test UX patterns. Sites like Shopify or Stripe will user-test their checkout processes at scale and enable companies to benefit from the results by adopting their platforms.

If you’re currently testing designs for small business, one of two things is true: either you’re wasting your client’s money investigating a problem someone else has already solved, or you’re designing something so original that it has no precedent (and you probably shouldn’t be).

Designers should be opinionated. Designers should know UX best practices and how they apply to a range of scenarios. Designers should be capable of making an educated guess. Designers should be self-validating.

Once or twice in your career, you may find a legitimate need to test something. However, the vast majority of the time, the correct answer is to tip the tortoise back onto its feet and choose whichever color button has the higher contrast.

Featured image: Still of Brion James in Blade Runner. Copyright Warner Bros. Entertainment

Source

The post The Case Against UX Testing first appeared on Webdesigner Depot.

Source de l’article sur Webdesignerdepot