There is a lot of money, information and power in the Ads world

There is a lot of money, everyone is fully aware of that, information and power in the Ads world. A good proof of that is this:

“Meta cracks down on ad-free Instagram client a day after it launched”

https://www.engadget.com/meta-cracks-down-on-og-app-instagram-client-005949126.html

New instagram client that promised be ads free was thrown down the day the published it in the App Store.

The big tech companies are not only doing a lot of money thank to Ads they are also gathering a lot of information about people and their interests and that gives them a lot of power.

Not only JavaScript & Node.js testing best practices

Today I found out one of those resources that can level your skills up very quickly.

https://github.com/goldbergyoni/javascript-testing-best-practices

Just with a quick read and a few of your will to implement few of the recommendations read there you will start creating very good test cases for your code and you will level your skills up as a developer.

After reading that exhaustive by comprehensive guide a realized that you will find very good recommendations not only for Javascript or Node.js in particular but for any language in general.

For instance, good test naming and tagging, seems obvious right? Well that’s the part the most of the people spend less time on and it’s the most important by far. Without proper description of the tests you’re running when they are failing, the developer needs to go deep in that test case and invest a lot of time to understand what another developer from the team was testing and how.

That amount of time can be easily reduced with proper naming and descriptions. As a recommendation you must always keep in your mind and include in your tests these 3 points:

(1) What is being tested? For example, the ProductsService.addNewProduct method

(2) Under what circumstances and scenario? For example, no price is passed to the method

(3) What is the expected result? For example, the new product is not approved

Another thing that I liked a lot from that guide was using the AAA approach. Arrange, Act & Assert. This is basically defining a very nice structure for your code inside your tests and by following that pattern anyone from the same development team or from another development team can easily read and understand.

1st A – Arrange: All the setup code to bring the system to the scenario the test aims to simulate. This might include instantiating the unit under test constructor, adding DB records, mocking/stubbing on objects and any other preparation code

2nd A – Act: Execute the unit under test. Usually 1 line of code

3rd A – Assert: Ensure that the received value satisfies the expectation. Usually 1 line of code

Another important and obvious to me part for testing is not just only testing your production code but also being sure that your about dependencies also works as expected and they have the latest security updates.

In my career I’ve faced several times fighting a lot with problems that at the end were caused by external third party dependencies.

Besides that nobody in the team will never remember about dependencies. In fact, nobody wants to really enter into the nightmare of dependency hell 😅so that’s another reason why enforcing to keep dependencies up to date is an important part to consider when building your testing flow.

Nowadays thank to tools like `npm outdated` or `npm audit` you can make your test fails if there are dependencies that are not up to date or with some security vulnerabilities.

Those are just few examples of all the goodies you can find in the guide I mentioned at the beginning so I strongly recommend you to read it, twice! and start from tomorrow implementing some of those good approaches. Your whole team and company will benefit from that.

Happy testing !

Apple killed Touch Bar, Apple killed innovation

I’m an Apple user.

One of the things that always has characterised Apple from my point of view is innovation. On October 18th Apple announced new MacBooks Pro with chips M1 Pro, M1 Max and without Touch Bar.

That was one of the things that surprised me the most, no Touch Bar! Everybody is really amaze by the new M1 family chips. Don’t get me wrong, I’m also amaze by the performance you can get with those new chips but that’s not innovation, that’s improvement.

In contrast most of the people is happy with Apple killing the Touch Bar.

I’ve been very curious about that and I’ve made a small investigation looking for the main reasons why people was so happy with removing the touch bar on the new MacBook Pro models. These are the two main reasons I could find.

• Hitting the Touch Bar by mistake
• Replace Touch Bar was costly
• It consumes battery
• Sun reflecting Touch Bar make it impossible to work with it

Now let’s analyze one by one and let’s dismantle those nonsense arguments.

Hitting the Touch Bar by mistake

Are you really seriously arguing that because you hit by mistake a new part on your keyboard that’s the reason for removing it? Then why don’t you remove every single key in your keyboard that you hit by mistake while typing?

Touch Bar was a new area on your keyboard a really powerful one, you could configure it per application! Yes, configuration per application, you can make different configurations to show automatically your most used functions, isn’t that innovation compared with the ancient F1-F12 function keys?

Since it was a new area in your keyboard that’s normal you need some time to get used to it. Do you remember when smart phones arrived? It was impossible to get use to typing on a touch screen. I remember myself typing insanely fast with the 1-9 keyboard or even faster while using Blackberry keyboards, however it took me a lot to get used to the new way of typing on the new smart phones. Imagine they decided to remove that just because you were hitting keys by mistake.

If customers reported Touch Bar is difficult to use because they constantly accidentally hit the wrong keys, why don’t we make it a bit wider? or why don’t we put a little bit more of space between the top side of the keyboard and the keyboard? Just few millimetres can make the difference.

Replace Touch Bar was costly

Another nonsense argument IMHO. Just one question to people arguing this. How much do you think it costs to replace your MacBook Pro screen, SSD or battery?

The same here, if it makes your laptop reparation more expensive it’s just matter of finding the right components for reducing costs when building it and place it in a separate layer in the laptop to be able to remove the keyboard only or the touch bar only or both. Thousands of possibilities.

It consumes battery

Arguing that it consumes battery nowadays it’s like saying the sun brights. For the same reason Apple could remove the illumination on your keyboard. Can you imagine having your laptop now without that amazing retro illumination keyboard? I can’t imagine mine without that even if it consumes battery it’s matter of optimise it but it’s a huge step forward.

The same happened with the Touch Bar, it was a huge step forward. A retro illuminated bar which is changing when you move from one application to another showing you the most used functionalities, making suggestions and auto corrections while you type, emojis with just a click and thousands of customisations, giving freedom to the users to configure their keyboards with amazing personal features.

Touch Bar consumes battery, matter of optimisation, reduce bright, use better components, turn off when you stop typing, etc…

Sun reflecting Touch Bar make it impossible to work with it

I almost died when I read this argument, in my opinion without any doubt the most stupid argument of all of them.

Why don’t you just sit down backwards to the sun and try to work with your laptop? Probably because you won’t see anything, the sun reflecting in your screen, so then the solution is to remove the screen of the laptop?

One more time people trying to find absurd arguments about the Touch Bar.

If user reported, “hey I can’t see anything while working outside due to sun reflections”, again, let’s improve it ! let’s find better components to reduce reflections.

Conclusion

I could not find yet any good reason for Touch Bar removal on the new MacBook Pro models, most likely the real reasons behind this decision were to reduce production costs. If you have a look at the new MacBook Pro they are exactly identical to the previous ones except for new chips, they might have invested a lot of resources on those new chips and they need to make them as profitable as possible.

Anyway this decision is a step back in terms of innovation and innovation is what companies and people as human beings must strive for. Innovation is the key to success in the long term, innovation is what really makes us to jump further in terms of progress not only technologically speaking, innovation is what makes us to start looking at things with a different perspective with a different angle and improve and change things that were settled down for a lot of time and now can be changed, can be better and can make us evolve.

Innovation is not always popular, in fact, just the opposite, when people or companies really innovate most of the people look at those innovations with disbelief and it’s only after several years when new generations start to assume that those “weird things” that those “crazy thinkers” did in the past are now the new standard.

If it were for the way of thinking of many people we would still live in caves like in the Paleolithic.

Never give up keep innovating despite of the thoughts of the people !

Using Apple Maps is a pleasure nowadays on iOS 15

I’ve been using iOS 15 since the moment it got launched on my country. Since then I’ve been given a new try to Apple Maps application.

I’ve been incredibly surprised by the new improvements introduced to this app.

I still remember trying to use this app for my daily trips when I got my first iPhone and I couldn’t manage to use it at all. Most of the trips recommendations were really bad options, it did not have good maps of my area and it did not have traffic status either.

But everything has been changed drastically on the latest update.

It has now better maps of my area, the recommendations are great and the alternative routes are very good as well. Now I can enjoy not only traffic status but even alerts on speed radars. I’ve been trying during this time and I’ve been trying to cheat the application as much as possible moving around my area and taking rare routes that only people from here know and the new Apple maps has survived those tests very well.

The integration of Apple maps with the rest of the apps on your iPhone is super ! Specially with the calendar app, most of the time you type the location and if finds it perfectly and will alert you when it’s the best time to departure considering appointment time and traffic status.

The final and most important thing for me was the voice route indications while you’re driving. I never managed myself to understand the indications with Google maps and it was even worst while looking to my phone screen. I don’t really know if was due to how the map was rendered or the dimensions of the map and the next exit you must take but I was constantly confused by the voice over saying something and you seeing a different thing (or at least getting a different feeling) on your phone.

The navigator of my car is incredibly powerful in that sense, the voice indications are the best I’ve ever had, you do not need to look at the screen at all, in fact I hardly do it and I was expecting something similar on the new Apple Maps.

Again it surpassed my expectations. They way the map zooms in and out automatically in the new version of Apple Maps is really handy and useful and the voice route indications are perfect as well, same feeling as with my car navigator software, you don’t need to look at the screen.

After all these tests I’ve uninstalled all the alternatives I had on my phone! I’m getting less and less dependant every day on Google products (I’m no longer using Google search, but that’s a topic for other day …) Long live Google Maps, Waze, etc…

Stronger SSH Key authentication ED25519 algorithm

If you’re managing servers on your daily basis or if you don’t manage them but you need to access some of them most likely you’re using SSH Key authentication mechanism.

The SSH Key authentication mechanism is the default recommendation to harden access to your servers and of course user-password authentication must be avoided.

During the last years recommendations about increasing the size of the keys have been very common passing from using RSA 1024 to 2048 and nowadays you must use at least 4096.

What’s next? 8192, 16384, etc… When will this race end?

Is a longer key safer?

Consider these two block ciphers; which is more secure?

• Blowfish, which supports up to 448-bit keys.
• AES, which supports up to 256-bit keys.

If you chose Blowfish, you fell for the trap.

• Blowfish has a block size of 64 bits, whereas AES has a block size of 128 bits.
• Blowfish is vulnerable to attacks because of its small block size that AES is not.
• In the real world, AES has hardware acceleration (AES-NI) that makes it very fast while being immune to cache-timing attacks. Blowfish does not have hardware acceleration available.

The race for longer keys already finished since we can use on OpenSSH 6.5+ digital signature scheme that functions over elliptic curves.

Today thank to the newer versions of OpenSSH we can use Ed25519 algorithm that offers better security with faster performance.

RSA algorithm is still widely used but compared with Ed25519 is slower and in some cases it’s no longer considered safe if you are using keys smaller than 2048-bit length.

Another benefit of using Ed25519 is that it produces small keys so it’s also easier to manage, specially if you’re managing a lot of keys on your servers.

Generating Ed25519 keys

In your terminal app just type this command and hit enter:

ssh-keygen -o -a 100 -t ed25519 -f ~/.ssh/id_ed25519 -C "moi@example.com"

Right after hitting Enter you’ll be asked to enter a password for this key or you can just keep it blank.

Let’s explain the parameters used in the ssh-keygen command

• -o: It will save the private-key using the new OpenSSH format instead of the old PEM format.
• -a: It’s the numbers of KDF (Key Derivation Function) rounds. Higher numbers result in slower passphrase verification, increasing the resistance to brute-force password cracking attacks.
• -t: Specifies the type of the key to create, in this case we want Ed25519. I do hope on newer versions of OpenSSH this will become the default type instead of RSA.
• -f: Specifies file name and path where to save the generated key.
• -C: An absolutely optional parameter to specify a comment, but really handy specially when managing several keys on the same server.

Next step is to instruct our computers to start using this new generated key you can do it directly on the command line when connecting to the server, for instance:

ssh -i ~/.ssh/id_ed25519 moi@my_server

Or you can configure your SSH entries to start using the new key. Open your ~/.ssh/config file and edit your entries there to use the new identity file:

Host my_server
  HostName 198.164.1.33
  User moi
  IdentityFile ~/.ssh/id_ed25519
  IdentitiesOnly yes

Just SSH into your server using:

ssh my_server

Cómo ascender en tu empresa, qué debes hacer para pasar de junior a senior

Nunca he entendido por qué algunas personas despotrican contra las redes sociales. Como poco pueden entretenerte. Las redes sociales nos ayudan a estar cerca de nuestros seres queridos cuando están lejos, nos permiten seguir en contacto con antiguos amigos o compañeros de trabajos anteriores. Nos ayudan a conseguir nuevos trabajos, a conocer gente nueva, a compartir nuestras aficiones y hobbies con otros entusiastas, a jugar en línea, …

Esos son solo algunos ejemplos, pero aún hay más. Las redes sociales también sirven para aprender para compartir experiencias y conocimientos. Puedes aprender mucho de otras personas:

• que comparten sus experiencias de trabajo
• que explican conceptos difíciles de una manera muy sencilla y visual
• que han viajado a otros países y comparten lo que han aprendido
• que saben cocinar y enseñan a preparar recetas estupendas
• que conocen los mercados financieros y enseñan a invertir
• que son auténticos “manitas” y enseñan a reparar y mantener tu casa

En definitiva, gracias a como fluye la información y lo accesible que es hoy en día puedes aprender de todo, a jugar, a coser, a hablar, a ahorrar, a bailar, …

Entre todas esas cosas también es posible aprender a mejorar como persona, como profesional.

Recientemente me he topado con un estupendo video en una popular red social que ejemplifica muy bien que es lo que debes hacer si deseas ascender en tu empresa, mejorar como profesional, crecer y pasar de ser un profesional Junior a uno Senior.

En varias ocasiones ha habido gente o compañeros/as de trabajo que me han preguntado, “¿qué crees tú que lo que debería tener una persona para ser manager de este área?”. Para ser sinceros, no es una pregunta sencilla de responder y generalmente depende mucho del área en el que te muevas, pero he encontrado este par de videos que, en mi modesta opinión, ejemplifican de forma muy visual que es lo que un profesional que quiera ascender debe tener muy en cuenta.

Espero que disfrutes de los videos.

Vídeo parte 1: https://vm.tiktok.com/ZMdpfJsgK/

Vídeo parte 2: https://vm.tiktok.com/ZMdpm9SmW/

Powerful combination for your DevSecOps: Snyk & Bitbucket (or Github)

Today we have started to experiment integrating Snyk with Bitbucket to have vulnerability scans integrated inside our workflow and pipeline.

We already had integrated multiple different scanners into our workflow and pipelines and they were working very nicely allowing us to get alerts and detect any type of vulnerabilities just almost at the moment they appeared. Thanks to that and how we have defined our pipeline, we can create a patch for the affected packages and have a fixed version ready for the next release (most of the time less than 2 days).

But recently Bitbucket announced a seamlessly integration with Snyk. So it was time to try it out and see all the benefits of this integration.

The first impression was not really good. I had several troubles creating the required credentials to be able to connect Snyk with Bitbucket but after that was fixed, the results were very impressive.

Just out of the box Snyk scanned one of our repos and found a lot of vulnerabilities. Automatically was scanning, not only packages, but also the Dockerfile. Yes, we have everything dockerize. All our apps are deployed into production environments using Docker and Kubernetes.

In less than 5 minutes we were able to go from 15 Critical, 19 High and 14 Medium vulnerabilities to 1 Critical, 12 High and 11 Medium vulnerabilities.

The most interesting thing was that the Pull Request for fixing all those issues was done automatically from Snyk. Just by clicking “Fix vulnerabilities” Snyk created a very nice pull request with a very detailed information, have a look at the next screenshot.

Snyk has a limitation though, it’s not able to understand yet that despite the fact that we are now using the latest image, we’re also upgrading on every new image build, all the packages in the system. So the rest of vulnerabilities have been resolved before going to production.

In our company, security is extremely important and we take it very seriously. By continuing integrating tools into our workflows that allow us to maintain and detect problems and resolve them quickly we’re always keeping our software up to date and secure for our customers.

Definitely the first tests made for this new integration between Snyk and Bitbucket is something that we’re gonna keep for our workflows.

This integration has as well a lot more goodies I didn’t mention, for instance, having daily/weekly scans and alerts, be able to analyze new Pull Requests to be sure you’re not introducing new vulnerabilities while working on new features, etc.

As you can see if you integrate Snyk within your pipeline you can deliver better and more secure software.

Knowledge does matter, of course it does

When I started to write this post the first title was “Technical knowledge does matter, of course it does”. I decided to change it to the current one because we’re not going to talk necessarily about technical things this time.

I’ve recently read this article: “If Your Boos Could Do Your Job, You’re More Likely to Be Happy at Work“.

Despite of the click-bait headline the article is quite interesting and IMHO very valuable. The authors carried out a study over 35K people from U.S. and Britain and can you guess what the conclusion is ?

OpenSearch open source replacement for ElasticSearch and Kibana

Last week, Elastic announced they will change their software licensing strategy, and will not release new versions of Elasticsearch and Kibana under the Apache License, Version 2.0 (ALv2). Instead, new versions of the software will be offered under the Elastic License (which limits how it can be used) or the Server Side Public License (which has requirements that make it unacceptable to many in the open source community). This means that Elasticsearch and Kibana will no longer be open source software.

To fix this situation Amazon has joined forces with other big companies Red Hat, SAP, Capital One, and Logz.io to offer and maintain a new open source replacement called OpenSearch.

OpenSearch a community-driven, open source fork of Elasticsearch and Kibana based on Elasticsearch 7.10.2. You can see the fork at GitHub https://github.com/opensearch-project/OpenSearch and read all the details about this story here and here.

AWS is already offering ElasticSearch as a service and with this change they will rename that service to Amazon OpenSearch Service. Aside of the name change they will be offering both alternatives all previous ElasticSearch versions up to 7.10 and the new versions of OpenSearch.

Analyzing Fastify to build highly performant web applications in Node.js

I found a couple of exceptionally interesting and highly recommendable articles about Fastify.

This one and this one.

If you don’t know what Fastify is. It is a framework to build web applications, similar to Express.

An efficient server implies a lower cost of the infrastructure, a better responsiveness under load and happy users. How can you efficiently handle the resources of your server, knowing that you are serving the highest number of requests possible, without sacrificing security validations and handy development?

Enter Fastify. Fastify is a web framework highly focused on providing the best developer experience with the least overhead and a powerful plugin architecture. It is inspired by Hapi and Express and as far as we know, it is one of the fastest web frameworks in town.

https://www.fastify.io/

I also watched this video

From Mateo Collina one of the Fastify authors, where he explores the goals, the reasons and the path they took to achieve that insanely fast performance.

On their own words Ludicrous performance 😉

You might remember that from Spaceballs movie:

https://en.wikipedia.org/wiki/Spaceballs

As I said I strongly recommend you to read those articles and watch that video, you’ll be switching to Fastify right after that.

What are the benefits of migrating from Express to Fastify?

• Validation and logging out of the box. No need to choose and integrate libraries for these tasks.
  
• Native support for async code. Fastify natively handles promises and supports async / await.
  
• Automatic parsing and serialization of JSON.
  
• Absurd performance.

Apart of all the features mentioned here what I really loved about the video is that you can watch how he compares multiple frameworks performance, in terms of requests per second, the tools he used to profile Node.js apps using flamegraphs to detect hotspots and optimize them, ie: https://github.com/davidmarkclements/0x and without any doubt how you can build a web server in Node.js core and then from that point using that to compare with other frameworks.

He also analyzes problems you may easily incur in when working with closures and how out of the box you avoid them, optimize them and how Fastify gives you a better way of working to avoid all those memory problems.

In Fastify there are no closures at all it uses this library instead:
https://github.com/mcollina/reusify

And finally routing. Another important part when you want to build an API or a web application. Parsing and analyzing the routes can be a heavy task and Fastify is using this amazing library https://github.com/delvedor/find-my-way that uses a highly performant Radix Tree (https://en.wikipedia.org/wiki/Radix_tree) data structure.

JetBrains Code With Me

I’m looking forward to try this new feature !

Pair programming tools are an amazing way of working together, share ideas, build amazing prototypes and of course share knowledge.

For info here: https://www.jetbrains.com/code-with-me/

5 ways to prevent code injection in JavaScript and Node.js world

I’ve been reading recently an article about 5 techniques to prevent code injection in JavaScript / Node.js world.

These are the 5 ways to prevent code injection:

1. Avoid eval(), setTimeout() and setInterval()
2. Avoid new Function()
3. Avoid code serialization in JavaScript
4. Use a Node.js security linter
5. Use a static code analysis (SCA) tool to find and fix code injection issues

If you’re interested in the full article, you can read it here:

https://snyk.io/blog/5-ways-to-prevent-code-injection-in-javascript-and-node-js/

In my opinion the most interesting and at the same time spooky part of the article are the code examples they’re using to demonstrate each of those techniques, because according to the article they’re using real code from production applications or from popular libraries.

1. Avoid eval(), setTimeout() and setInterval()

For this technique they’re demonstrating the code injection on these libraries: dustjs-linkedin and dustjs-helpers.

• dustjs-linkedin, an open source package, has a security flaw in which it is incorrectly sanitized input strings in its escapeHtml function.
• dustjs-helpers, an open source package, uses an insecure coding convention in the likes of the eval() function to dynamically evaluate code at runtime.

Do you want to see how they exploited this vulnerability and hacked a real live working application just based on this exact vulnerability? Check it out:

I told you was spooky 😉

The author is also recommending to avoid whenever possible or at least being very careful with setTimeout() and setInterval() because both function have a little less known fact, is that they also receive code strings. For example, it can be used as follows:

setTimeout("console.log(1+1)", 1000);

2. Avoid new Function()

This constructor allows dynamically to define a function based on string literals.

You must be already aware how harmful this can be in your code base.

3. Avoid code serialization in JavaScript

If we talk about serialization we’ll perform those task on our apps using by sure a popular library. The more popular the better, right?

Let’s analyze the example the author took, js-yaml with 28 million downloads per week.

Versions of js-yaml were found vulnerable to Code Execution due to Deserialization. The way in which the vulnerability manifests, is due to the following use of the new Function() constructor:

function resolveJavascriptFunction(object /*, explicit*/) {
  /*jslint evil:true*/
  var func;

  try {
    func = new Function('return ' + object);
    return func();
  } catch (error) {
    return NIL;
  }
}

The author even made a proof-of-concept exploit for that vulnerability. Let’s have a look:

var yaml = require('js-yaml');

x = "test: !!js/function > \n \
function f() { \n \
console.log(1); \n \
}();"

yaml.load(x);

4. Use a Node.js security linter

Developers are aware of linters on their IDEs or outside of them, on the CD/CI pipelines. Linters are usually used to follow some code styling rules but you can use them as well to protect your code:

eslint-plugin-security

https://www.npmjs.com/package/eslint-plugin-security

It’s a pretty interesting one that will help identify potential security hotspots.

For Node.js world you can consider this package as well:

eslint-plugin-security-node

https://www.npmjs.com/package/eslint-plugin-security-node

5. Use a static code analysis (SCA) tool to find and fix code injection issues

Those kind of tools will help you to detect potential issues in your code or on the third party libraries you have incorporated in your project.

Some of these tools could be:

• npm audit
• snyk
• OWASP dependency check
• Retire.js
• Nessus
• Fortify

Some of the mentioned tools are free, open source some of them are commercial, start trying them and use what fits better for you.

Most of them are easily scriptable and can be included within your CD/CI pipelines so you can start deploying more secure code just on every new release.

Please, remove defective code

“When debugging, novices insert corrective code; experts remove defective code.” – Richard Pattis

Linux Find command with examples

The Find command on linux is one of the tools every developer, devops or just linux user must master.

It’s amazingly powerful but with great power comes great amount of parameters to remember 😅

I’m gonna show you just with several examples how easy and powerful is to use the Find command.

1. Find directories matching a given name

find path/ -type d -iname '*my_dir*'

2. Find files by extension

find path/ -name '*.doc'

3. Find files matching a path

find path/ -path '**/log/**/*.log'

4. Find files matching a multiple patterns

find path/ -name '*pattern1*' -or -name '*pattern2*'

5. Find files matching a a given pattern, excluding some directory

find path/ -name '*.py' -not -path '*/exclude_dir/*'

6. Find files larger than some specific size

find path/ -size +500k

7. Find files between certain sizes

find path/ -size +500k -size -10M

8. Find files modified on the last 7 days and delete them

find path/ -mtime -7 -delete

9. Find files and change permissions

find path/ -type f -exec chmod 0644 {} \;

10. Find directories and change permissions

find path/ -type d -exec chmod 0755 {} \;

Code reviews through Pull Requests best practices

As we all know, an important part when managing teams, is helping them to approach the problems to solve and review the solutions used to tackle those problems. We’re talking more specifically about code reviews through Pull Requests.

I have been reviewing other developers’ code for a large part of my career and throughout all these years, I have learned some interesting aspects, if you want to know more about this, keep reading.

It’s always great to have different point of views on how to solve a specific problem. I’ve always liked the idea of solving the same problem in 1000 different ways. It’s amazing how your mind can open up and discover whole new worlds.

VPN with WireGuard

Introduction

During last years I’ve seen people suffering big security issues on internet affecting their personal lives. I’ve also seen the same on companies, having big difficulties to get out from tough situations because of security issues, not only affecting their sensitive data and customers but also affecting really hard their image and credibility.

How can companies improve their privacy and security and avoid those big security issues that most of the time are caused by misconfigurations ?

Your code must tell a story, a really good one. Part 2

As we discussed in our previous article, your code must tell a story, a really good one.

Let’s have a look now at few examples of all the things exposed in my article.

Your code must tell a story, a really good one. Part 1

I’ve always thought that your code must tell the story of the things you’re trying to solve. Just by reading the name of the methods anyone should have a solid and clear idea about what the problem is and how you’re solving it.

Make columns same height on Bootstrap 3.x, even for Safari and iOS

When you work in the frontend side it’s rather easy to get things done with Bootstrap in a good and nice way, however sometimes things get more complex.

Today I faced one of those issues. On one of my projects I needed to display custom categories saved in the database by the customers and those categories could have images or icons to be displayed nicely.

The Zen of Python

In my opinion this must be the Zen of any programming language and of every developer.

Beautiful is better than ugly.

Explicit is better than implicit.

Simple is better than complex.

Complex is better than complicated.

Flat is better than nested.

Sparse is better than dense.

Readability counts.

Special cases aren’t special enough to break the rules.

Although practicality beats purity.

Errors should never pass silently.

Unless explicitly silenced.

In the face of ambiguity, refuse the temptation to guess.

There should be one– and preferably only one –obvious way to do it.

Although that way may not be obvious at first unless you’re Dutch.

Now is better than never.

Although never is often better than *right* now.

If the implementation is hard to explain, it’s a bad idea.

If the implementation is easy to explain, it may be a good idea.

Namespaces are one honking great idea — let’s do more of those!

 

Another knowledge pearl from Guido van Rossum

It’s always great to see Guido van Rossum in action. This is another hidden knowledge pearl: https://t.co/xPm8MkWcZE I found in Twitter.
Spoiler: for Python lovers only 😉

Hope you enjoyed as much as I did, specially the history part behind the scenes.

Cambios importantes a partir de Chrome 80 en la gestión de Cookies. Seguridad y Privacidad.

Acabo de leer un artículo muy interesante que recomiendo encarecidamente a cualquier desarrollador de apps. Especialmente aplicaciones web.

docker on MacOS mkmf.rb can’t find header files for ruby

After the latest upgrade on MacOS when I tried to use docker on my mac to build my new images I got this error:

mkmf.rb can't find header files for ruby at /System/Library/Frameworks/Ruby.framework/Versions/2.3/usr/lib/ruby/include/ruby.h

After trying multiple and different solutions the only thing that worked for me to get this fixed was removing the previously installed developer tools for command line and install them again by following these steps:

sudo rm -rf /Library/Developer/CommandLineTools 

xcode-select --install 

sudo xcodebuild -license accept 

open /Library/Developer/CommandLineTools/Packages/macOS_SDK_headers_for_macOS_10.14.pkg

After running those commands and, of course, wait a bit to get everything downloaded and installed, docker commands are now working again.

Algunas frases que oirás como Freelance de tus clientes

Desgraciadamente a todos nos ha pasado al trabajar como “freelance” ( trabajador autónomo ), sientes que trabajas y trabajas y al final no recibes una remuneración justa por tu trabajo. No importa cuantas horas dediques al trabajo, en ocasiones incluso decides echar más horas y la cosa sigue igual.

Starting with Docker

Over the past years, Docker has become an essential technology used in software development. Developers, DevOps, Companies has adopted this new technology quite fast.

Nothing to be surprised about, its containerization concept has made it easy to set up, share and deploy software projects.

In this article we’ll what Docker is, what a container is and how to start playing with it.

BitBucket Pipeline configuration for PHP, MongoDB and Symfony

Recently I’ve been playing around with BitBucket and their Pipelines. Just to let you know BitBucket Pipelines is an integrated CI/CD service built into Bitbucket. It basically means that on every commit you make your tests will be ran and your code will be deployed.

They say in their official website that it has a really basic and simple configuration and as far as I could experiment, it really is.

La evolución de Ferrari a lo largo de la historia.

Projects killed by Google

There’s a saying that states “you will learn more from your failures than successes” and I do agree on that. But you can go further on that and try to learn as well from other’s failures.

30 aniversario de Internet

Hoy, 12 de marzo de 2019, Internet cumple 30 años. Nació el 12 de marzo de 1989. Han pasado ya 30 años desde que el ingeniero británico Tim Berners-Lee propuso un “vago pero ilusionante espacio, libre y abierto, para que toda la humanidad pudiera compartir ideas y conocimientos”.

9 Kubernetes Security Best Practices

Today I was reading an interesting article about the 9 Kubernetes Security Best Practices everyone must follow.

In that article they basically enumerate and briefly describe how to follow and accomplish those 9 security recommendations. I’ve extracted them here for you to simply go quickly through them.

Using ES6 in Chrome 49

Recently I started to implement all my new projects using ES6. Lately I faced some JavaScript issues in one of those projects.

Thanks to Sentry.io I could realise that despite being an old browser Chrome49 is still used by the users using my projects. So I decided to fix those issues.

JavaScript things to learn for 2019

I was reading for new topics to learn in the JavaScript ecosystem or just things to keep in mind if you consider to start a new project.

I found this article Top JavaScript Frameworks and Topics to Learn in 2019 from Eric Elliot quite interesting.

Quora.com hacked

“Another one bites the dust“, this time Quora.com has been hacked and information for all the users exposed.

As you can read in their security update blogpost this was the information exposed:

• Account information, e.g. name, email address, encrypted (hashed) password, data imported from linked networks when authorized by users
• Public content and actions, e.g. questions, answers, comments, upvotes
• Non-public content and actions, e.g. answer requests, downvotes, direct messages (note that a low percentage of Quora users have sent or received such messages)

What happened

Last Friday the Quora.com team discovered that some user data was compromised by a third party who gained unauthorized access to one of their systems.

They’re conducting an investigation and while that investigation is still ongoing, in their own words “we have already taken steps to contain the incident, and our efforts to protect our users and prevent this type of incident from happening in the future are our top priority as a company”.

What’s Quora doing

Meanwhile they’re doing the investigation and working together with some external security and digital forensics firms they’re taking some steps to improve security and minimise the impact, such as:

• Notify users whose data has been compromised.
• Logging out all Quora users who may have been affected, and, if they use a password as their authentication method, we are invalidating their passwords.

They “believe” they’ve identified the root cause and taken steps to address the issue, although the investigation is ongoing and they’ll continue to make security improvements.

Conclusion

We as software engineers, sysadmins, DevOps, or whatever cool name appears in the near future, should take seriously the security of our applications and the privacy of our users.

This won’t be the last security issue we’ll see in this cloud world.

I realised how good is Dilbert when I was studying Computer Science. It’s absolutely timeless.

Does Switching Jobs Make You a Worse Programmer?

Today I was doing some personal research for my new role in my company team and while I was looking for some topic about productivity and team management I found quite interesting this comment from Slashdot.org.

GitHub + Microsoft

Confirmado, Microsoft adquirió GitHub, y lo hizo por 7.500 millones de dólares, una de las operaciones económicas más costosas de su historia.

Según ha puntualizado Microsfot: “GitHub mantendrá su marca y operará de forma independiente.”

La operación es la tercera adquisición más importante en cuanto al montante económica de la misma. Microsoft pagó 26.200 millones de dólares por LinkedIn en diciembre de 2016 y 8.500 millones de dólares por SKype en mayo de 2011.

Al igual que hizo con LlinkedIn, Microsoft no influirá en la forma de operar de GitHub, por lo que inicialmente el servicio seguirá funcionando igual y GitHub seguirá operando de forma independiente “proporcionando una plataforma abierta para todo tipo de desarrolladores e industrias”.

Donde parece que habrá cambios es en la parte directiva de GitHub.

Dentro de un tiempo veremos como nos afecta esto al resto de desarrolladores que utilizamos GitHub.

 

How to use NPM link simultaneously work on an application and a dependency

In the previous article we talked about how to create, publish and use your private NPM packages.

This time is the moment to talk about how to simultaneously work on an application and a dependency used by that application.

Un español inventa un sistema para mandar mensajes de texto sin cobertura

No pierden la esperanza, pierden la cobertura del móvil. Eso es lo primero que les pasa a aquellos que tienen la mala suerte de perderse en el mar, en la alta montaña o que se ven envueltos en una catástrofe natural. Y justo eso, la telefonía, es precisamente lo que más necesitan, porque los mensajes de texto les podrían salvar la vida. Pero estas situaciones de tremenda vulnerabilidad están a punto de desaparecer. Y todo, gracias a un invento de un español.

How to create, publish and use private NPM packages

After a long time working with different package systems I decided to migrate all my packages and dependencies to NPM. And the result couldn’t have been better.

When NPM reached the 5.x version they included a lot of things that improved the performance, speed and security of the packages.

There’re two commands that I specially like a lot.

npm outdated
npm audit

Dart lang syntax cheat sheet

Many of you have asked me for a quick Dart syntax cheat sheet.
Here you can find 4 different illustrations to help you out when working with Dart.

GIT Commit Messages Shareable Format

Recently I faced the requirement to create a git commit messages convention to be shared across a software developer team.

I was looking for something simple and straightforward that every developer could do easily in his/her daily basis.

Exploring ES6 – From jQuery to ES6 #1

Recently I started to migrate all my code from ES5+jQuery to ES6 for different projects. I discovered a lot of cool things. Of course, I also faced some issues and I thought would be great to share all the stuff I’m learning and fixing with the rest of the people planning to migrate to ES6 as well.

I’m gonna write a serie of small articles covering all the new ES6 features and how to migrate your code from previous ECMAScript versions or from jQuery code.

Kubernetes with Fluent Bit to send logs to Loggly

I’m going to show you how easy is to deploy Fluent Bit into your Kubernetes cluster. I’ll configure Fluent Bit to work together with Loggly, an external logging tool to manage all your cluster logs.

But first, some quick concepts about the tools we’re going to use.

Kubernetes, in short, is a tool that allows you to manage, in a better organized and simpler way, your containerized applications.

Y Flash sigue vivo!

El otro día andaba navegando por internet… buscaba un operador de telefonía móvil que ofrezca una tarifa de datos barata, porque en realidad últimamente es para lo único que utilizo mi teléfono, seguramente como nos pasa a todos.

De pronto hice una de esas maravillosas búsquedas en Google que me tanto me encantan y esto fue lo que me encontré.

Cancelando cuentas en Twitter y Facebook

Recientemente leí un artículo sobre un fallo grave de seguridad que afectaba a Github y Twitter. Aquí puedes leer el anuncio sobre este, en mi opinión, gravísimo fallo de segurdad.

Plaintext passwords in internal logs at Twitter and Github

• Github notified a small subset of users that their passwords were visible in internal logs: link
• Twitter asks for a password reset after discovering a similar issue: link

HT208535 macOS High Sierra 10.13.3 Supplemental Update

Recently my Mac informed me about a new security update for macOS High Sierra. As always I was reading about this security update… And I was totally in shock after reading the issue and how to solve it.

Vagrant Ignoring ffi-1.9.14 because its extensions are not built. Try: gem pristine ffi –version 1.9.14

If you’re like me and don’t want to see errors or warnings every time you work with some tool in your system I  have something for you.

Have you ever seen these kind of warnings when working with Vagrant ?

Ignoring ffi-1.9.14 because its extensions are not built.  Try: gem pristine ffi --version 1.9.14
Ignoring ffi-1.9.10 because its extensions are not built.  Try: gem pristine ffi --version 1.9.10
Ignoring nokogiri-1.6.7.1 because its extensions are not built.  Try: gem pristine nokogiri --version 1.6.7.1
Ignoring nokogiri-1.6.3.1 because its extensions are not built.  Try: gem pristine nokogiri --version 1.6.3.1
Ignoring unf_ext-0.0.7.2 because its extensions are not built.  Try: gem pristine unf_ext --version 0.0.7.2
Ignoring unf_ext-0.0.7.1 because its extensions are not built.  Try: gem pristine unf_ext --version 0.0.7.1

La construcción del primer ordenador cuántico

Un equipo internacional ha anunciado el primer plan práctico para construir un ordenador cuántico más potente del mundo y que supondrá para la ciencia, la industria y el comercio “una revolución similar a la que trajo el primer computador”, según el estudio publicado en Science Advances.

Las leyes de la robótica propuestas por Europa

La Eurocamara pide poner en marcha una serie de normas de seguridad, éticas y legales para regular los avances en Inteligencia Artificial y robots.

Los avances en Inteligencia Artificial son imparables y los expertos hablan ya de la cuarta revolución industrial en la que las personas podrían ser sustituídas por robots en ciertos empleos.

Software libre para predecir la producción energética de sistemas fotovoltaicos

Un equipo de investigadores del Instituto de Energía Solar de la Universidad Politécnica de Madrid ha desarrollado un modelo para predecir la producción de energía de un sistema fotovoltaico partiendo de una mínima información meteorológica.

El modelo permite predecir la producción de energía de un sistema fotovoltaico disponiendo solamente de los doce valores mensuales de la radiación solar, la turbidez de Linke (transparencia de la atmósfera), y la temperatura ambiente.

La UCM desarrolla una red social para el aula basada en software libre

Usando el micro-blogging o micro-anotaciones, ingenieros de la facultad de Informática de la Universidad Complutense de Madrid han desarrollado Bolotweet.

Basada en un software libre, la herramienta quiere contribuir a implantar el Proceso de Bolonia y conseguir una evaluación continua de los alumnos, provechosa tanto para estudiantes como para profesores.

Emoji Reactions the new super cool stuff your software needs or you’ll be dead

I’m writing this post because I think this is getting really disgusting. Seems that if your software doesn’t allow users to add reactions to comments, posts, links, cards, etc.. you’re dead.

In Slack, now you’re able to add emoji reactions to comments.

El smartdrone o drone inteligente

 3D Robotics ha presentado un modelo de dron que ofrece muchas posibilidades tecnológicas, su nombre es SOLO y es un smartdrone volador. 

Humor para informáticos – Chistes CSS

This slideshow requires JavaScript.

 

Acuario marino domótico: automatización del acuario con Raspberry Pi

Poco a poco, el agua se va “ciclando” y el sustrato se está poblando. Ya no tiene ese color blanco cegador que daba un efecto algo “artificial”. Nuestro acuario ya va pareciendo un mini-arrecife.

Tenemos que esperar a meter los primeros animales y mientras vamos a ir trabajando en la instalación de los aparatos que debe llevar conectados y en la forma de automatizar todos los procesos.

Infografía: el uso de las tablets en los negocios

Design Thinking

El iPad y el resto de tablets se están convirtiendo en el reemplazo de los portátiles, ya que para muchos usuarios su uso es más versátil, son más ligeros y pueden resultar realmente útiles sobre todo a comerciales, profesionales que necesitan hacer frecuentes viajes, profesores o estudiantes.

Antes de crear una aplicación, es importante considerar en que dispositivo se utilizará, a que usuarios va orientada y el uso que harán de ella. En la siguiente infografía se muestra el uso de las tablets para trabajar, el tipo de usuario y algunos usos inteligentes que a nivel de empresarial se le pueden dar a una tablet.

View original post 3 more words

ECMAScript 6 today

Very surprisingly discover these results about ECMAScript 6 support today (2015-02-22) on the most advanced and most used web browsers. I can see to much “red boxes” on the attached picture.

El agujero en Linux GHOST afecta a WordPress y PHP

Investigadores de seguridad han descubierto que el agujero en Linux GHOST, también afecta a apps PHP, incluyendo el Sistema de Gestión de Contenidos WordPress, utilizado en millones de sitios web.

GHOST es el acrónimo de “Glibc Gethostbyname Buffer Overflow”, un agujero crítico de Linux que afecta al GNU C Library (glibc) y permite a un atacante tomar el control de los sistemas sin conocer usuario o contraseña.

Actualizan PHP y solucionan 3 fallos de seguridad

Los desarrolladores de PHP ha lanzado una actualización de seguridad que soluciona 3 vulnerabilidades de seguridad que podían causar desde una denegación de servicio hasta tomar el control del sistema afectado.

Nuevo libro sobre Dart: Web programming with Dart – Moises Belchin & Patricia Juberias – Apress

Después de unos meses de mucho trabajo, Patricia y yo estamos muy orgullosos y contentos de anunciar nuestro nuevo libro: Web programming with Dart.

Primer boletín de seguridad Microsoft 2015

Microsoft ha publicado el primer boletín del año: boletín de seguridad microsoft enero 2015, en el que se incluyen ocho actualizaciones de software para resolver diversas vulnerabilidades y exposiciones comunes (una de ellas crítica) que afectan a sistemas Windows, incluyendo la vulnerabilidad que ha provocado una gran polémica entre Microsoft y Google.

Las consecuencias potenciales de estas vulnerabilidades van desde la ejecución remota de código, elevación de privilegios o denegación de servicios entre otros.

Acuario marino domótico – 4

En post anteriores os enseñé los primeros pasos del proyecto:

• Como calcular las medidas para un acuario
• Diseño del tanque o acuario
• Diseño y construcción del mueble y la elección e instalación de las luces Led para acuarios.

Como habéis visto, podéis montar un acuario totalmente a medida y a vuestro gusto, de forma sencilla.

Y ahora viene la mejor parte, ya podemos empezar a llenarlo y a “jugar con el” 🙂 que ganas!!!

Estamos super contentos, ya tenemos portada para nuestro nuevo libro, que os parece? 

El proceso está siendo genial y el resultado estamos seguros de que también lo será. Con mucho trabajo todavía por hacer, pero muchas ganas de verlo ya en las librerías y en vuestras manos 😉

Aprende Dart. Gracias!

Queríamos agradeceros desde aquí, todo el apoyo que nos habéis dado con nuestro libro Aprende Dart!.

 

Por tantos comentarios, muestras de apoyo e interés a lo largo de todo el mundo, muchísimas gracias!!. Nos alegra muchísimo que el libro os esté gustando tanto y os esté resultando útil, esa era nuestra intención y nos alegra haberlo conseguido aunque debemos confesar que no podíamos imaginar cuando comenzamos con este proyecto que despertaría tanto interés.  🙂

El doodle dedicado a John Venn, el maestro de los diagramas

Hoy Google nos enseña un nuevo doodle con el que conmemora el 180 aniversario del nacimiento del matemático, John Venn, el creador de los famosos diagramas.

Desarrollan un material que soporta 160.000 veces su peso

En EEUU, investigadores  del Laboratorio Nacional Lawrence Livermore (LLNL) y el Instituto Tecnológico de Massachusetts (MIT )han desarrollado un material con el mismo peso y densidad de un aerogel, pero con 10.000 veces más rigidez.

Este material, desarrollado con procesos de microfabricación de aditivos, podría tener un profundo impacto en la industria aeroespacial y de automoción, así como otras aplicaciones donde se necesitan materiales de peso ligero, de alta rigidez y alta resistencia.

Project Zero, la solución de Google para las empresas con vulnerabilidades

Google ha estrenado, Project Zero, un ambicioso proyecto que incluye a un equipo de especialistas en seguridad que trabajarán para localizar vulnerabilidades en software de terceros. Cuando los investigadores de Project Zero detecten problemas avisarán a los desarrolladores y las vulnerabilidades que vayan encontrándose serán publicadas en una base de datos externa.

Además se dispondrá de un programa de recompensas, abierto a investigadores externos que descubran problemas en algún software de terceros, del mismo modo que el programa actual de recompensas para Android, llamado Patch Reward Program

Android 4.4.4 Kit Kat

 

Google ha confirmado la nueva versión de Android, haciendo su presentación ante la versión KTU84P.

KitKat es el comienzo de una estrategia de Google para llevar la última versión de Android a todos los dispositivos Android, tanto si son de gama alta o baja.

Aprende Dart, en la lista de libros de la web oficial del proyecto

Aprende Dart, ya forma parte de la lista de libros de la web oficial de Dart:  https://www.dartlang.org/books/

Estamos encantados 🙂 y aprovechamos este post para dar las gracias a Kathy Walrath de Google, por su colaboración y la aprobación de nuestros Pull Requests en GitHub.

Aprende Dart, primer libro sobre Dart en Castellano

Libro Aprende Dart, Moisés Belchín & Patricia Juberías

Después de muchos meses madurando la idea y trabajando muy duro en ella, podemos decir con gran satisfacción que ya se encuentra disponible el primer libro sobre Dart en Español.

Finally!!
Here are my T-shirt and sweatshirt. Go beavers !!!

 

Acuario marino domótico – 2

A muchos os habrán surgido preguntas sobre las medidas de los acuarios:

– ¿ Pueden tener las medidas y forma que yo quiera?

– ¿ Hay alguna formula para calcular las medidas perfectas de un acuario?

Los acuarios podrían tener cualquier medida si fuesen a estar vacíos, pero como contienen agua, deben seguir una proporción exacta  por la presión que ejercerá el agua sobre el tanque cuando esté lleno.

Acuario marino domótico – 3

Como ya sabéis, estoy embarcado en mi nuevo proyecto “marino”, que consiste en un acuario Mixto (de arrecife + peces). Es bastante complicado si se empeza dede cero, así que os iré contando el proceso por si os ayuda a los que estéis pensando en crear vuestro própio pedacito de arrecife en casa 🙂

Ya os enseñé los bocetos, que he ido ampliando y parece que ya va tomando forma el proyecto, por fín!!

Vulnerabilidad de Google permite a cualquier dar órdenes a sus servidores

Investigadores de Detectify han detectado un fallo de seguridad relacionado con Google Toolbar (la barra de herramientas de Google) gracias al cual cualquier puede dar órdenes a los servidores del buscador.

Los usuarios de Google Toolbar, pueden personalizar los botones que desean y para ello tan solo es necesario un archivo XML. Al parecer,  gracias a este archivo, cualquiera puede introducir órdenes para que los servidores de Google las ejecuten. Se supone que Google solo lee estos archivos, pero sorprendentemente también ejecuta las acciones que en él aparecen.

Más de 1300 apps de Android afectadas por Heartbleed

 

Tras analizar  casi 400.000 aplicaciones alojadas en la Google Play Store para comprobar si Heartbleed afectaba a estas aplicaciones Android,  la empresa Tred Micro asegura que aproximadamente 1300 de estas aplicaciones son vulnerables al bug.

Desarrollan unos bio-robots microscópicos que se mueven como espermatozoides

Los Investigadores de la Universidad de Illinois han diseñando un nuevo robot microscópico capaz de explorar entornos viscosos, como el interior del cuerpo humano, que podrá ser utilizado en el futuro de la cirugía mínimamente invasiva.

El bio-bot creado simula el movimiento de algunos tipos de bacterias y de los espermatozoides y constituye  la primera forma artificial capaz de moverse a través de fluidos viscosos, como la sangre dentro del cuerpo humano.

Seguridad: Heartbleed, el gran error en OpenSSL

Investigadores de Google y de la empresa de seguridad Codenomicon, han descubierto un fallo de seguridad, que permite capturar y desencriptar nombres de usuario y contraseñas: Heartbleed.

Procede de un error de implementación de la función Heartbeat de OpenSSL  y su gravedad radica en que se trata de un bug que permite comprometer los datos y las comunicaciones de los usuarios de sitios web, correo electrónico, aplicaciones de mensajería instantánea o redes virtuales privadas.

Seguridad: Gmail encriptará todos sus emails

Noticias breves de seguridad: Gmail encriptará todos sus emails

Google va a modificar la configuración de su servicio de correo para que el 100% de los mails estén encriptados. Otras empresas, como Yahoo!, han informado de que tomarán esta misma medida de seguridad en los próximos meses

Nueva Pre-Release de App Engine 1.9.2

Ya está disponible la nueva pre-release del SDK de App Engine.

En esta ocasión con muy pocas novedades, tan solo algunos cambios en el SDK de PHP, aunque como siempre con correcciones y mejoras de estabilidad y rendimiento.

Un auténtico placer, ofrecemos la presentación sobre Google Dart, en Dart Flight School, el evento organizado el 29 de marzo, por GDG Madrid. Espero que os haya gustado!!

http://gdg-dart.herokuapp.com/

 

Dart Flight School Madrid

¿Quieres aprender a desarrollar aplicaciones web con Google Dart? ¿Te apetece pasar un buen rato con otros desarrolladores? Entonces, no te lo puedes perder: Dart Flight School Madrid.

Un evento gratuito organizado por GDG Madrid. Presentaré el lenguaje Dart con todas sus ventajas y descubrirás que es sumamente potente y funcional.

Código fuente de MS-DOS

Se ha publicado el código fuente del histórico MS-DOS, el sistema operativo de 1982 para las computadoras personales compatibles con IBM.

Yo nací un año antes, he tenido la suerte de crecer en la era de la informática y haber vivido todos estos sistemas hasta llegar a los que tenemos hoy en día.

Es un placer, poder echarle un vistazo al código, una auténtica “pieza de museo”, que además, recodemos  en el momento de su lanzamiento, Microsoft tenía menos de 100 empleados y el sistema operativo ocupaba menos de 300kb. Increible!!!!

Justo dentro de un año, podremos disfrutar del día más friki de todos los tiempos 🙂

Acuario marino domótico – 4

Me habéis pedido que os enseñe como he diseñado y construido y el mueble para mi acuario marino, y aquí está.

Malware roba Bitcoins

El troyano se llama OSX/CoinThief.A  y se oculta como una aplicación para enviar y recibir pagos con la moneda virtual, llamada StealthBit, que se descarga de GitHub. La primera vez que se ejecuta, el troyano instala extensiones en los navegadores Safari y Chrome que no alertan al usuario. Esas extensiones monitorean todo el tráfico web de la víctima con el fin de robar las contraseñas de inicio de sesión de los monederos Bitcoin, que son los que permiten realizar transacciones con la moneda virtual.

Apple patenta un sistema para recargar MacBooks con energía solar

La Oficina de Patentes y Marcas de Estados Unidos recibió otra patente de Apple, un nuevo sistema para poder recargar sus MacBooks a través de energía solar.

Este sistema, está hecho a partir de placas fotovoltaicas de doble cara con un cristal inteligente que sería el responsable de tomar la energía proporcionada por el sol y proporcionársela al dispositivo.

Google App Engine 1.9.0 Pre-Release SDKs disponible

Ya han publicado la nueva pre-release de google app engine versión 1.9.0.

Algunas de las mejoras y novedades que trae para PHP/Python son estas:

• Nuevos identificadores para las aplicaciones app engine.

Para Python:

• Han cambiado la forma de calcular los límites del Search API, ahora se calculan por índice (10GB por índice) en lugar de 10GB por aplicación. Ahora mismo no existe límite de índices.
• Ahora es posible incrustar imágenes en los emails que se envían a través de la cabecera Content-Id attachment.
• Han corregido un error en NDB en el proceso de backup y de restauración que dejaba corruptas algunas entidades comprimidas.

Depurar y optimizar aplicaciones Web: User Timing API

Depurar aplicaciones puede ser una tarea increíblemente dolorosa o puede ser algo realmente divertido si consigues obtener información de tu aplicación y mejoras el rendimiento, optimizas consultas, reduces tiempos y, por lo general, mejoras la experiencia de usuario.

La realidad es que no puedes optimizar una aplicación si no eres capaz de obtener información de ella.

Hackean Snapchat y filtran los datos de sus 4 millones de usuarios

Snapchat es una aplicación original que no genera beneficios pero su base de usuarios está en continuo crecimiento. La app ha despertado incluso el interés de Facebook que ofreció al cofundador de la apliación, Evan Spielgel, 3.000 millones de euros.

Una oferta que el jóven de tan sólo 23 años rechazó seguro de que su compañía valdrá mucho más de lo que estaban dispuestos a pagar por ella.

Google Dart 1.1 ya está aquí !!

Acabo de recibir la noticia del anuncio de la nueva release estable de Dart 1.1. Con solo dos meses desde la publicación de la versión 1.0 de Dart, nuevas funciones, mejoras de las herramientas de desarrollo y un mejor rendimiento hacen de esta nueva versión algo imprescindible para cualquier usuario de Dart.

HTML5 Vibration API

Desde que los dispositivos móviles nos han invadido, los desarrolladores nos hemos tenido que adaptar a las nuevas necesidades e inquietudes de los usuarios de nuestros servicios.

Muchos han optado por desarrollar directamente en el SDK correspondiente a cada plataforma, Android, iOS, Windows Phone. Otros han optado por desarrollar completamente en la web, ya tenían una infraestructura montada y la han adaptado, mejor o peor, a los nuevos dispositivos.

Como eliminar CSS que no utilizas en tus proyectos

He podido utilizar a lo largo de varios años diferentes aplicaciones para optimizar y comprobar tanto los ficheros JavaScript como los ficheros CSS de mis proyectos.

También he utilizando diversas herramientas para comprimir (minify) ficheros JavaScript, entre ellas, YUI Compressor desarrollado por Yahoo y Closure Compiler desarrollado por Google son de las que mejor experiencia y opinión tengo.

SourceCode TVFilm – Programación en películas

Me he tropezado con una curiosidad en internet, de esas que parecen super frikis, pero que con el tiempo se convierten en “paridas de culto”.

Como amante de la programación y de los sistemas informáticos, me gusta, siempre que resulta posible, leer y estudiar código escrito por otros programadores, siempre puedes aprender y obtener nuevas ideas de implementar tus algoritmos.

Disponible la nueva Pre-Release 1.8.9 del SDK de Google App Engine

Con el año nuevo y tras las largas vacaciones que algunos hemos podido disfrutar, ya tenemos aquí la nueva pre-release, en este caso la 1.8.9, del SDK de Google App Engine.

En esta ocasión no trae grandes novedades aunque sí corrige algunas cosas interesantes. También han marcado algunos métodos como obsoletos, por lo tanto, tendremos que estar atentos para actualizar nuestras aplicaciones en caso de utilizar estas funciones obsoletas.

Un ordenador capaz de descifrar cualquier contraseña

La NSA o Agencia de Seguridad Nacional deEstados Unidos está trabajando en la construcción de un ordenador cuántico criptológicamente útil, es decir, una máquina exponencialmente más rápida que los ordenadores clásicos capaz de descifrar cualquier contraseña, según una filtración del ex-contratista Edward Snowden.

La investigación se realiza en salas grandes y blindadas conocidas como jaulas de Faraday Tal y  el programa de investigación estaría dotado con 79,7 millones de dólares.

Desarrollo Web: Nuevas Tecnologias para 2014

Este nuevo año 2014 va a ser increíblemente interesante en cuanto a desarrollo web se refiere. Tenemos a nuestro alcance lo que creo que serán las 5 tecnologías más interesantes de cara a 2014 para plataforma web.

1. asm.js: rendimiento casi nativo en la web.

2. Parallel.js: paralelizar código JavaScript

3. ECMAScript 6: evolucionando el lenguaje.

4. Web Components: una nueva infraestructura para crear componentes web.

5. CSS Grid layout: creación de GUIs de manera casi nativa.

Acuario marino domótico – 1

Ya estoy embarcado en mi nuevo proyecto “marino”. Como sabéis, llevaba tiempo pensando en cambiar mi acuario marino por uno Mixto (de arrecife + peces) y ya está en proceso. Os iré contando (y enseñando) la evolución el proceso.

He tenido ya unos cuantos acuarios marinos y he ido recopilando mucha información, consejos y tips que me han resultado muy útiles y espero que a vosotros también os puedan ayudar con vuestros proyectos.

Consejos y trucos para mejorar tu código jQuery

Recientemente hemos estado charlando y comentando cómo optimizar y mejorar el código jQuery que escribimos para nuestros proyectos. No solo a nivel de rendimiento sino también a nivel de legibilidad, lo cual es muy importante en proyectos de cierta envergadura.

Así que hemos decidido compartir con vosotros algunos de los trucos que empleamos y que otros autores (Mathew Carella) también apoyan.