Full-text search across article titles and summaries. Refine with sector, year, content type, and reading-time filters.
A post from GitHub explaining how it tamed its disparate vulnerability remediation processes with the creation of a Security Findings tool. The tool features a dynamic UI that can aggregate findings from various sources and display them at various levels to suit developer experience. The post also discusses the changing requirements that led to folding security exceptions into the tool.
This blog post discusses preventative measures that can be taken to ensure secure defaults in AWS. The post includes tools to prevent public exposure of resources, prevent some risky behaviors, and enforce security measures. This is part of a series and assumes that SCPs from a previous post have been applied.
Sponsored
Nucleus [11] integrates with your existing security tools to aggregate, normalize, prioritize, correlate and act on all of the vulnerability data in your enterprise [11].
A reconnaissance tool for capturing and displaying SSIDs from a device's Preferred Network List.
ShellSweep is a tool that detects potential web shells in servers. The tool includes three utilities that work together (ShellScan, ShellCSV, and ShellSweep) to provide a comprehensive defense against web shells. The article suggests using the tools alongside regular audits.
A VSCode extension that allows users to generate live graphs of Terraform resources as they write Terraform code.
A threat actor recently sold the Zeppelin ransomware source code for just $500, potentially reviving the Russian ransomware, which has been used in the past in attacks on critical US infrastructure. Zeppelin is a VegaLocker derivative written in Delphi. The CISA and FBI released IoCs on Zeppelin TTPs in 2022. This cheap sale may signal a ransomware-as-a-service revival.
Bitwarden's Windows Hello implementation had an unexpected consequence - allowing remote theft of credentials without knowing the password or requiring biometric authentication. The issue enabled accessing Bitwarden vaults on compromised workstations without end-user interaction. It has since been fixed in v2023.4.0.
AWS launched a new feature of EKS called Cluster Access Management to simplify granting and managing access to EKS clusters. This new feature broadly allows managing access to an EKS cluster via the AWS API. This allows for mapping AWS identities to pre-defined AWS-managed Kubernetes permissions, mapping AWS identities to Kubernetes groups, and gaining visibility into shadow admins.
This post dives into the newly released CVEs of 2023. We ended 2023 with 28,902 published CVEs, up over 15% from the 25,081 CVEs published in 2022.
Merck has settled a dispute with insurers over a $1.4 billion claim related to the NotPetya malware incident that disrupted its operations worldwide in 2017.
Keybase suffered an outage as the New Year started that was caused by a root CA expiring. Users must manually update their apps to restore functionality.
A recent study found that 94% of links presented in SGE did not match the top 10 organic search results. On average, each SGE contained 10 links, but only 4 were unique. The study also revealed that 13% of the analyzed keywords failed to generate an SGE response. The findings underscore how traditional SEO tactics need to be revisited to face the changes brought by SGE.
The Chrome web browser disabled cookies for 1% of its users on Jan 4, 2024. If you’re one of the 30 million users in this initial test phase, the first thing you’ll see is a popup in Chrome. It describes Google’s new “Tracking Protection”. There’s also a little eyeball logo in the URL bar when tracking protection is on. Click on that eyeball if you want to allow a particular website to use cookies. Chrome will also disable tracking protection if it detects a website is having problems.
A landing page will convert poorly with underwhelming copy. To start, answer strategic questions about the target audience, the objective of the page, and the traffic source. Then, define where the page fits within the buying journey and select the main message of the page. Spend ample time on defining the positioning, tone of voice, and semantic keywords, and avoid generic language. Conduct research with a swipe file, then work carefully on your hero section.
Many B2Bs prioritize low-impact optimizations, such as bid adjustments and negative keywords. Instead, try these 3 high-impact tactics that don’t increase budget: redistribute campaign budget by increasing budget on campaigns with below-average cost per lead (CPL) and decreasing it on campaigns with above-average CPL, pause ad groups that are 25% above your average CPL starting with the highest spending campaigns, and pause any keywords that are 25% higher than the average CPL.
This article covers 18 marketing ideas from successful companies. It discusses techniques related to buzz generation, brand-building, acquisition, and retention. For acquisition, the ideas include reframing competition like Asana, offering concierge migration services as ConvertKit does, and launching mini-tools from features such as GitGuardian. For retention, tactics include introducing time-limited features like Thursday and gamifying onboarding experiences like TwilioQuest.
Forecasting pay-per-click costs and revenue is challenging due to the many variables and unforeseen factors. To achieve reasonably accurate forecasting, it’s best to start with historical ad spend and revenue metrics. From there, use Google’s Keyword Planner and Forecast tools to predict future keyword volume and costs. It’s also helpful to prepare both a “mild” and “aggressive” forecast to help others understand the potential revenue from higher spend.
Creating good content that resonates with your audience is difficult, but an active community is a great source of fresh ideas. Rather than relying on keyword research, listen carefully to community members' conversations and questions and create content around it, actively facilitate user-generated content from your community, and invite contributions, such as community members’ own stories and advice.
Treating marketing as an investment instead of a cost benefits businesses by promoting smarter resource allocation, data-driven decision-making, and a focus on long-term growth. Content marketing can be compared to stock investing in the sense that both can bring long-term returns when done right. This article uses examples from Salesforce, NerdWallet, and Hootsuite to illustrate how an investing mindset for content creation can create long-term growth and market dominance.
This article delves into the profound impact of holistic content experiences using a Van Cleef & Arpels' ad as an example. To craft impactful content, the brand evoked specific feelings and emotions through various elements like visual appeal, language, and subtle marketing. 3 main steps are outlined to achieve similar results: start by defining what feeling you want to evoke, test, and optimize for the selected emotional response, and expand the right experience across channels.
Notion has become a buzzing hub where creators build and sell functional templates that make the day-to-day operations of millions of users smoother.
YouTube TV continues to get new subscribers and maintains its position as the largest ‘cord-cutter’. Meanwhile, traditional cable continues to bleed subscribers.
A list of must-see keynotes, featured speakers, and companies that’ll be at CES 2024 on Jan 9 - 12, 2024 in Las Vegas.
The JavaScript Rising Stars is an annual report that highlights popular projects and trends in the JavaScript ecosystem. In 2023, projects like shadcn/ui, Bun, Excalidraw, and Next.js were very prominent. React continues to be the most-used front-end framework, while HTMX and Svelte are growing as popular alternatives. The report also covers developments in build tools, mobile development, styling/CSS in JS, testing, desktop applications, static sites, state management, and GraphQL.
Next.js 14’s App Router introduced intercepting routes, which allows users to intercept or stop the default routing behavior and present an alternate view or component when navigating through the UI while still preserving the intended route for scenarios like page reloads. This can be useful if you want to show a route while keeping the context of the current page. This post provides practical examples of when intercepting routes can be used to improve your website’s UX.
This article discusses "senseless" JavaScript features, such as the floating-point format and why 0.1 + 0.2 doesn't equal 0.3, type coercion and why using === is preferred over ==, automatic semicolon insertion and its limitations, the presence of two bottom values (null and undefined), and the use of increment (++) and decrement (--) operators. These quirks are important to understand as they can lead to hard-to-debug issues. By avoiding certain constructs as shown by examples in the article, developers can make their code more readable.
This solo developer has been working on a text editor for nine years, building the application using AppKit and Objective-C. In this post, they describe various implementation details and challenges experienced while developing the application, such as the application’s architecture, the decision to avoid third-party dependencies, and how storyboards were used to create a well-structured codebase. They also show how they read framework code and analyze stack traces to understand how Apple frameworks work.
The web development community has common assumptions that are not always true. For example, the engineers that create web browsers do not necessarily know how to develop web applications well. Another common belief is that all sites should work without JavaScript. While this is an admirable goal, some sites should actually use more JavaScript. Generally, using JavaScript well leads to better user experiences on the web.
It’s helpful to have a comprehensive suite of tests to make refactoring easier. Take small steps when making changes, run tests frequently, adopt continuous integration, refrain from adding extra functionality during refactoring, and make refactoring an integral part of the development process. Automate refactoring when possible and avoid excessively long functions or classes.
Quick-lint-js finds bugs in JavaScript programs, such as syntax errors, using await in a non-async function, and assigning to a const variable.
Better Commits is a CLI tool that lets developers generate conventional commits through a series of prompts. This allows for better commit messages while inferring ticket and commit type from the branch for consistency.
The Angular developer survey for 2023 found that 96% of developers use the latest standalone APIs, with 26% already using Signals. Developers appreciate Angular for its integration between core modules, runtime performance, and dependency injection, but identified areas for improvement in its documentation, component authoring format, and initial load performance. The roadmap for 2024 includes continued work on documentation, improving initial load times, and enhancing the component authoring experience.
It’s difficult to keep costs low as system complexity grows in traditional Application Performance Monitoring systems. This leads to a cost/visibility tradeoff, where to cut costs, teams have to cut down on visibility into their application’s performance. There are several options to address this, such as focusing on efficient event handling, embedding custom attribute tracking in code, and using open-source observability tools.
React Native saw significant improvements in 2023, including first-class TypeScript support, better styling and layout using Flexbox, and new features like Bridgeless mode. React Native receives updates often, has active community support, and has a growing presence in the top 100 apps on mobile app stores.
A simple in-browser code sandbox for experimenting with HTMX.
Developing a better engineering mindset involves writing often, fostering productive relationships with product managers, and developing proper company values.
Writing as a software engineer is important as it allows you to leverage yourself to make a greater impact.
Microsoft partners will start shipping a new Copilot key on a variety of new PCs and laptops. The button will provide quick access to Microsoft's AI-powered Windows Copilot experience. It is the first big change to the Windows PC keyboard layout in nearly three decades. The new Copilot key will replace the menu (or application) key. If Windows Copilot isn't available in the user's country, the button will launch Windows Search instead. It is unclear whether Microsoft plans to allow users to use the key in combination with other keys.
Bard Advanced is an upgraded version of Bard that may soon be available through a paid subscription to Google One. It appears to be powered by Gemini Ultra, an upgrade over the current version of Bard which runs the mid-tier Gemini Pro. There may be a feature that allows users to create custom bots, but it is unclear whether users will be able to share these bots. It is unknown when or if the feature will become official.
The DeepMind robotics team has revealed three new advances that will help robots make faster, better, and safer decisions in the wild. One involves a system for gathering training data with a set of safety-focused prompts instructing the model to avoid choosing tasks that involve humans, animals, sharp objects, and electrical appliances. The others are a neural network architecture designed to make the existing Robotic Transformer RT-2 more accurate and faster and RT-Trajectory, which adds 2D outlines to help robots better perform specific physical tasks.
Elon Musk recently made a post on X saying that SpaceX might need to make up to 300 spaceships a year to achieve Mars colonization. Establishing a settlement on Mars will require rocket travel to be nearly as routine as air travel. While SpaceX will be able to reuse Starship and its Super Heavy boosters, the parts that travel into orbit won't be able to be reused as often. Ships often have to orbit the planet several times before they line up with pickup sites, so they might only be able to be used once a day.
Terminal usually draws lines of text at fixed intervals. When scrolling, the sudden jumps are incompatible with how eyes track motion, making it a blurry mess that's hard to read. This blog post discusses how to implement smooth scrolling in Terminal. While smooth scrolling uses a lot more resources, it makes it possible to easily skim text as it scrolls by. A video demonstrating the difference between normal scrolling and smooth scrolling in Terminal is available in the post.
mise-en-place manages dev tools like Node, Python, CMake, Terraform, and more. It manages environment variables for different project directories and tasks used to build and test projects. It can also work as a task runner that can replace make or npm scripts.
Amazon's global order volume in the final two weeks before Christmas was up 21% from the week of Thanksgiving and Black Friday. The company's speedy delivery is a key competitive advantage. 70% of Prime orders in the US arrive within two days, with almost a quarter being delivered within a day. Amazon plans to double its number of same-day delivery facilities in the coming years.
OpenAI's GPT Store will feature custom apps based on its text-generating AI models. Developers will have to review OpenAI's updated usage policies and GPT brand guidelines as well as verify their user profiles before they will be eligible for listing in the store. Making a bot doesn't require any coding experience - developers can just type the capabilities they want their bots to offer in plain language and a GPT-building tool will attempt to make it. Bots can be as simple or complex as a developer wishes. It is unclear whether the GPT Store will launch with a revenue-sharing scheme.