• 开源镜像
  • 开源沙龙
  • 媛宝
  • 猿帅
  • 注册
  • 登录
  • 息壤开源生活方式平台
  • 加入我们

开源日报

  • 开源日报第846期:《gpt-3》

    27 7 月, 2020
    开源日报 每天推荐一个 GitHub 优质开源项目和一篇精选英文科技或编程文章原文,坚持阅读《开源日报》,保持每日学习的好习惯。
    今日推荐开源项目:《gpt-3》
    今日推荐英文原文:《As Trump suspends new H-1B visas, many tech workers face an uncertain future》

    今日推荐开源项目:《gpt-3》传送门:项目链接
    推荐理由:这个由Open AI创建的大型机器学习模型, 不仅可以自己写论文, 还会自动生成诗歌, 甚至连代码都能帮你写好.同时, 它也具备问答功能, 无论你的问题是脑筋急转弯还是逻辑性极强的数学问题, 它都能对答如流.
    今日推荐英文原文:《As Trump suspends new H-1B visas, many tech workers face an uncertain future》作者:Abrar Al-Heeti
    原文链接:https://www.cnet.com/news/as-trump-suspends-h-1b-visas-us-tech-workers-face-an-uncertain-future/
    推荐理由:Trump又有新的动作了, 这次是暂停发放新的H-1B签证, 这使得很多的美国科技工作者面临巨大的挑战, 在美国经营自己生活的人们开始质疑这一切.

    As Trump suspends new H-1B visas, many tech workers face an uncertain future

    When President Donald Trump temporarily suspended the issuance of work visas in late June, Sumana Kaluvai wasn’t immediately worried. Her dad, an engineer at a software company, is on an H-1B visa for highly skilled employees. Because he’s been in the US for more than two decades, the new policy wouldn’t affect him, she figured.

    Kaluvai was wrong. Her father had gone back to India in early March to get his visa restamped. But the process was delayed when the coronavirus pandemic forced the US embassy in Chennai to close. Then, Trump signed the executive order on June 22, pushing what had been a routine task into early next year. In the meantime, Kaluvai’s dad is working remotely. (CNET isn’t using her father’s name for privacy reasons.)

    “It really makes me question why people like myself, my father and other immigrants continue staying in a country that we call home, yet doesn’t welcome us and continues to take so much away from our community,” said Kaluvai, who works in biotech and pharma consulting and is on an F-1 Optional Practical Training work visa. “I don’t know how much longer hundreds of thousands of people like myself will continue to stay in this country.”

    Kaluvai’s sentiment is shared by many immigrants on work visas, including the H-1B. Many feel they can’t put down roots in the US, even though they’ve been here for years. Some have turned to countries, such as Canada, that have more-welcoming immigration policies. Others have returned to their homelands. Many immigrants who stay in the US live with day-to-day anxiety over their status, wondering if it might change overnight.

    Trump said the suspension of work visas, which will reportedly block more than 500,000 people from entering the US this year, will help unemployed Americans find jobs during the coronavirus pandemic.

    “Under ordinary circumstances, properly administered temporary worker programs can provide benefits to the economy,” Trump’s proclamation reads. “But under the extraordinary circumstances of the economic contraction resulting from the COVID-19 outbreak, certain nonimmigrant visa programs authorizing such employment pose an unusual threat to the employment of American workers.”

    Critics argue the executive order will stifle US economic growth and progress, especially in the tech and science industries. The H-1B visa program has been critical for bringing creativity and innovation to Silicon Valley, they say. The technology sector has long relied on H-1B visas to hire high-skilled workers for roles it can’t fill with Americans because of the shortage of STEM workers. The visa lasts for three years but can be renewed.

    Around three-quarters of the 85,000 H-1B visas allotted each year go to computer science workers, according to the Associated Press, some of whom work for Silicon Valley giants. Amazon, Microsoft, Google, Facebook and Apple — which were collectively granted around 27,000 H-1B visas in 2019 — have criticized Trump’s order, warning that a shortage of talent would inhibit technological advancement and progress. Immigration advocates have also spoken out about the impact this will have on families, who are at risk of being torn apart.

    “There is definitely a chilling effect,” said Kalpana Peddibhotla, an immigration attorney in the San Francisco Bay Area. “It’s sending a message that people are not welcome, people who can actually help spur the growth of our economy.”

    Planning for an uncertain future

    That’s a common sentiment among people on all kinds of temporary work visas, says Peddibhotla. It’s especially the case for those who’ve started families here.

    “There’s so much uncertainty about their employment that it’s hard for them to make long-term plans and set up roots here in the United States, despite often having US-citizen children,” Peddibhotla said. “You’re in this in-between land while you’re raising your American children, and then you’re not pursuing home ownership or other ways of settling down here because of that uncertainty.”

    What makes things more challenging for holders of H-1B or other work visas is that if they lose their job, they have only 60 days to find a new one or change their visa status. Otherwise, they are forced to leave the country.

    That was the case for Asim Fayaz. The Pakistani immigrant worked as a product manager at Bay Area companies Premise and Elementum, but, like many tech employees, he experienced layoffs and was forced more than once to scramble to find a new job to keep his visa. After getting laid off in December, however, he and his wife decided the stress wasn’t worth it. He’d grown tired of the constant uncertainty over whether he’d be allowed back into the US every time he went overseas. So he moved to Toronto, where he’s now co-owner of a restaurant.

    “Nobody wants to live in this fear of, ‘What if my family’s sick back home and I need to travel?’” Fayaz said. “‘Will I be able to come back?’”

    Amn Rahman, a Pakistani immigrant and senior data engineer at application packaging company Docker, began working in the US in 2016 but is currently abroad and working remotely. Because her H-1B visa entry stamp has expired, she can’t reenter the US for work. Her company has been flexible, but she’s still apprehensive about her future and how long she’ll be able to hold onto her American job with visa restrictions in place.

    “It’s a very precarious situation to be in,” Rahman said. “You always feel like you’re walking on eggshells.”

    Implications for future generations

    International students, many of whom might want to seek employment in the US after graduation, also face uncertain visa situations. In early July, US Immigration and Customs Enforcement said international students whose universities remain online-only in the fall amid the coronavirus pandemic would have to either transfer to a school with in-person instruction or leave the country.

    More than half of graduate STEM degrees are earned by international students, according to OneZero. Harvard University, the Massachusetts Institute of Technology, 17 states and the District of Columbia sued the Trump administration to try to block the measure. On July 14, the administration rescinded the rule amid mounting opposition.

    Sudhanshu Kaushik, executive director of the North American Association of Indian Students, says he’s spoken with countless international students who nonetheless live on edge every day regarding their status in the US.

    “How much uncertainty and animosity can you take?” Kaushik said.

    For families like Kaluvai’s, the only certainty in their lives is that things could change at any moment.

    Her father will have to wait until 2021 to book a new appointment at the embassy. If he can’t return to the US soon, Kaluvai worries her dad will lose his job, forcing both of her parents to leave the country. That would leave her 16-year-old brother, the only US citizen in the family, without his primary caregivers.

    “What’s next?” Kaluvai said. “You’re always worrying about when it’ll be your turn to start freaking out.”
    下载开源日报APP:https://opensourcedaily.org/2579/
    加入我们:https://opensourcedaily.org/about/join/
    关注我们:https://opensourcedaily.org/about/love/
  • 开源日报第845期:《网站打包 nativefier》

    26 7 月, 2020
    开源日报 每天推荐一个 GitHub 优质开源项目和一篇精选英文科技或编程文章原文,坚持阅读《开源日报》,保持每日学习的好习惯。
    今日推荐开源项目:《网站打包 nativefier》
    今日推荐英文原文:《What I’ve Learned From Being Hacked》

    今日推荐开源项目:《网站打包 nativefier》传送门:GitHub链接
    推荐理由:一个很有意思的命令行工具,能够快速将网站打包成桌面程序,省去了打开浏览器和收藏夹的麻烦。在 Windows ,Mac 和 Linux 系统上均可运行,只需安装 Node.js ,然后在命令行输入命令npm install nativefier -g即可安装成功。
    今日推荐英文原文:《What I’ve Learned From Being Hacked》作者:Fernando Souza
    原文链接:https://medium.com/better-programming/what-ive-learned-from-being-hacked-4440dc4bb926
    推荐理由:从作者被骇的经历中吸取教训:时刻保持警惕,不要偷懒。

    What I’ve Learned From Being Hacked

    Take security seriously before it affects you

    (Photo by Michael Geiger on Unsplash.)
    Yes, I was hacked. This is the kind of situation that you think can only happen to other people. But guess what? You are the other people’s other people and it might happen to you!

    The moment I discovered it, I started to have a mix of feelings — like the five stages of grief. I was in a sort of parallel world, trying to escape reality and hoping the problem was never there in the first place or that it might resolve itself like magic.

    That didn’t happen, of course. After a few hours spent finding a solution and figuring out what had happened, I learned some valuable lessons.

    In this article, I want to share them with you.

    The Context

    I work for a small company that offers solutions in predictive maintenance and asset management. In a simple way, we connect different sensors’ data into a gateway and then send all the collected info to a cloud system where it is analyzed.

    There’s a dashboard where you can visualize the data and manage the system. All data are stored on a MongoDB database and accessed via an API.

    This API is the only way to access the database and each user has their own token generated by the API. All the connections are done using HTTPS.

    A few months ago, we installed the system in a big company as a proof of concept so they could evaluate it and decide whether they would buy it or not. That represented a huge opportunity for us.

    After two months of tests, everything was running smoothly. All sensors were collecting data on time.

    But one day, one of my colleagues called me saying he could not access the dashboard. He was getting an “invalid password” error. At first, I thought it might be a mistake. Maybe the server was down or something like that.

    When I accessed the server, however, I realized the problem was much more serious. All the data had been deleted. We had been hacked.

    The Problem

    It was a strange moment. Confusing feelings started to grow inside me, like the five stages of grief:
    + Denial: This could not have happened to me. Maybe a coworker changed something, set up a different server. A prank maybe. But then I remembered I was the only one who had access to the servers. + Anger: With a lot of other companies out there, why us? + Bargaining: Maybe we could afford to pay what they were demanding. It was a small amount anyway. Everything could go back to how it was before. + Depression: I felt like I was not good enough for this job, I hadn’t learned anything in ten years of software development. I was a fraud. In reality, it was just impostor syndrome all over again. + Acceptance: That was it. I was going to be fired and would never find another job in this field. All these feelings lasted for about five minutes, but it felt like an eternity. Time had stopped.

    (Photo by Ben White on Unsplash.)
    Then the emotions settled, I calmed down, and started to figure out what the problem was and how to solve it.

    The Solution

    Upon inspecting the database, all the tables and collections had been erased. A new table called READ_ME_TO_RECOVER_YOUR_DATA was there.
    (Ransom note from attacker. Photo from Help Net Security.)
    After a little research on the internet, I learned this is a very common ransomware attack on MongoDB databases that has been happening since 2017. They attack databases that don’t have security enabled and are open to the world.

    Just a couple of days before the incident, I disabled the firewall and opened the Mongo service to accept connections from any IP.

    Why would I do that?

    Because I didn’t want to enter my login credentials to get a backup of the data.

    (Photo by Holger Link on Unsplash.)
    That’s right. I was hacked because I was lazy. I’m not proud to admit it. I can say I even feel ashamed of that. But that is the truth.

    Lessons Learned

    After learning about the attack, we warned the client. We worked together to recover the data from our last backup (one day of data was lost), implement the official security checklist from MongoDB, update all the systems and services, and change all the passwords, along with other best practices for security.

    Here are some lessons I’ve learned.

    Don’t be lazy

    Just to save five minutes, I could have lost a big contract and a lot of money. Don’t try to save time just because you don’t want to enter your password every time you have to do something or access your system.

    Because of that laziness, I ended up working all weekend to solve a problem that should not have happened in the first place.

    Be honest

    The first action you may consider in this situation is to cover up the problem. Don’t do that.

    As soon as we found out what happened, we warned our client. It is really important to inform all the people who might be impacted by the situation so they can also act early and mitigate any problems that might appear.

    By being honest, the client and other interested parties can trust that you are not hiding any information from them and that you are doing your best to protect their data.

    Since we do not store any sensitive data in our database and all the architecture is isolated, we did not have any damages.

    Backup

    Constantly back up your data. I mean, do it right now. Create a script to automate it for you. Just do it!

    If we did not have any backup, two months of data and hard work would have been lost.

    Default configuration

    Change the default configuration for any system you are using — especially for the admin user and their password. And keep it in a safe place.

    Check for updates

    Check for exploits and security updates often. Sites like CVE have a list with a lot of vulnerabilities in systems and programs. Check them often and make sure your system is up to date.

    Conclusion

    I hope my experience can help others to not make the same mistake I did. Only a brief moment of distraction can create an accident.

    And this can happen to anyone. It doesn’t matter how experienced you are. Even though I have worked with security systems for quite some time, I made a mistake that could have been devastating.


    下载开源日报APP:https://opensourcedaily.org/2579/
    加入我们:https://opensourcedaily.org/about/join/
    关注我们:https://opensourcedaily.org/about/love/
  • 开源日报第844期:《设计模式 design_patterns》

    25 7 月, 2020
    开源日报 每天推荐一个 GitHub 优质开源项目和一篇精选英文科技或编程文章原文,坚持阅读《开源日报》,保持每日学习的好习惯。
    今日推荐开源项目:《设计模式 design_patterns》
    今日推荐英文原文:《There Is No “I” in Software Development》

    今日推荐开源项目:《设计模式 design_patterns》传送门:项目链接
    推荐理由:这个项目是对诸如工厂模式这样的场景设计模式的讲解,通过使用 UML 图与示例代码来让读者更容易理解,如果一时间搞混了 UML 图中的各类图标,项目里也介绍了 UML 图可以帮助读者重新回忆学习。
    今日推荐英文原文:《There Is No “I” in Software Development》作者:Igor Vlahek
    原文链接:https://medium.com/better-programming/there-is-no-i-in-software-development-4ec478631d6b
    推荐理由:在团队合作中自己只是一小部分,别忘了除了你之外还有别人会影响你的代码

    There Is No “I” in Software Development

    Try changing it to “we” next time

    The famous “I” word

    “I” — this is a word I have been hearing a lot of lately. And this “I” word is often coming from developers that are working solo on back-end applications that often do not have any real users. Put aside the notion that we are talking about the back-end developer now.

    If you are a developer, we can all agree that you can get attached to your application and call it your own. That’s especially true if you have been working on it intensively for years and you know the code by heart. It’s not a surprising fact that sometimes developers feel like they are the only user of the application. And often they start to use “I” instead of “we” when talking about the application we control.

    In this article, I will talk about my experiences with developers working on back-end, front-end, and firmware applications, and their wrong vision of our application. We will mention the importance of saying “we” and not “I” when we talk about:
    • application logs
    • application code
    • the solution as a whole

    “I” Sentences

    Let’s start with my favorite.

    “I find logs in my application readable, and I can manage just fine.”

    This is my favorite. Well, the logs are not just for you. There is a long list of clients that are interested in your logs. All the persons listed here are acting as a line of defense for you from the clients. They will bug them first and not you when your application is not behaving as expected.

    Let’s name your clients:
    • DevOps — They are the ones deploying your application. If they can figure out why your application is not working as expected early, they will save a lot of time for the people later in the chain.
    • Developers— You are not going to work indefinitely on your application. Other developers will come and continue your work. And they will need to figure out why your application is not working as expected in production. Logs are there for them too. Think of other developers working on your application even if you are the only one working on it at the moment.
    • QA — If they can figure out who is to blame in a situation when two applications are communicating, they will not bug two persons, they will bug only one person, thus saving valuable time.
    • Support — There is no sweatier call than when someone reports a bug in production. Think of those guys too. Give them just enough information to know whether this is a bug or not.
    Make sure you log the following:
    • Configuration parameters during startup — DevOps can make mistakes while configuring your application. Log loaded configuration parameters during your application startup. This will save a lot of your time.
    • External calls to other services — If you are calling external services, log what is sent and to whom you are sending. If you are calling REST services, log the URL you are targeting and request body you are sending. If you are sending a message to Kafka, log which Kafka server and which Kafka topic you are targeting. You can load the correct parameters, but sometimes you are passing the wrong parameter used to route calls to external applications.
    • Request/Response — Log requests coming to your application and responses generated by your application. This is the most valuable piece of information you can get when a report from a production environment comes. With this information, you can rule out your application as a potential suspect for a bug.
    • A critical decision in your application — If your application needs to decide which path to go, log which path it has taken and the parameters that made it go on the path. Often you can see application going the way you did not anticipate. Log what: the path the application has gone. And log why: the parameters that made you go that path. It will be easier to analyze later.
    The general rule: Put a log where you would normally put comments in your code. You would normally comment on what you are doing in your code to explain your intentions. Don’t do that; rather, log it. This way a third-party person will know what are you doing just by looking at the log file.

    “I can find my application code readable, and I can manage just fine”

    This is the deadliest “I” construct, in my opinion. You can fix logs rather quickly. And you can fix logs without affecting the application logic. In each iteration, you can add logging without fear that you will break something. But if the code does not follow any rules but your rules, then we are in for trouble.

    There are a lot of coding styles on the internet you can follow. The most important thing is to follow one of the guides. By following the guide, you are admitting that you are a part of a collective and that the time you are working on the application is finite. One of the days you will resign or go to another position. When the time comes, your application is not going to be yours anymore. It is going to be passed to another developer. Be kind to them.

    Be good to the programmers inheriting your codebase, even if you are the one-man team behind it:
    • Employ one of the following code styles found on the internet. Just google it. It will give you plenty of choices. I suggest Oracle code convention and Google Java Style guide for Java application.
    • Read “Clean Code” by Robert C. Martin. I cannot stress enough how important this book is for every developer, and for a Java developer especially. Once you have read it, you will realize that you have been programming the wrong way all along. Just read the book if you haven’t. It will be an eye-opener.
    • Write unit/integration tests. Tests are here to warn us if someone changed the application behavior. And they are also here to teach developers inheriting your application.
    • Employ CI to your application. By employing CI to your application, you will leave a template for how your application should be built on another developer’s PC. If it works on the CI server, it will work on another developer’s PC also.
    Employ a code style for your application. Write clean code backed with unit and integration tests that are running on the CI server on every commit. Do that and those who inherit your application will be thankful.

    “The bug is not in my component. My part of the overall solution is working just fine.”

    This is also an interesting one. This can be heard from developers on the front end and back end, and from the firmware people. But in my surroundings, the firmware people win this category.

    For me, this is a normal response from a developer that is doing their job right. When saying right, I mean the developer that is testing applications on the dev or local environment, or just taking time to test the application and not passing it straight away to QA. You can’t get mad at a good developer saying this. Why? Because we all think that our application is bulletproof. And especially if the developer is testing the application against other components. But even if you are such a developer, you must remember that your application is almost always only a small part of a bigger system. Even if you have tested the application by yourself and you have tested the application for input, they are still saying it’s not working as expected.

    What can we do if someone approaches us saying that the bug is in your component? At the least, you can write a test and show that the bug is not in your component. Remember, we are only earning money when the whole solution is working as expected. Your goal is to remove the suspect from your component as soon as possible. As soon as you remove the suspect, they will be looking for another suspect and they will leave you alone. And when your application has been identified as a false suspect a number of times, you will get respect and you will not be bothered so often.

    In this situation, the fact that your application is working fine does not make it better. It makes you better, but in the eye of the clients, you are looking bad as the one who made the bug. We are all looking bad in the eyes of the clients. Only when all components are working as expected will we be earning money. Be a team player and cooperate with others in identifying a component that caused a bug.

    Remember, we are only making money if the solution as a whole is working.

    Thanks for reading!
    下载开源日报APP:https://opensourcedaily.org/2579/
    加入我们:https://opensourcedaily.org/about/join/
    关注我们:https://opensourcedaily.org/about/love/
  • 开源日报第843期:《Java诊断:arthas》

    24 7 月, 2020
    开源日报 每天推荐一个 GitHub 优质开源项目和一篇精选英文科技或编程文章原文,坚持阅读《开源日报》,保持每日学习的好习惯。
    今日推荐开源项目:《Java诊断:arthas》
    今日推荐英文原文:《Windows 10 update fixes bugs in Excel, File Explorer and Wi-Fi connections》

    今日推荐开源项目:《Java诊断:arthas》传送门:项目链接
    推荐理由:Arthas 是 Alibaba 开源的 Java 诊断工具,深受开发者喜爱。Arthas 支持 JDK 6+,支持 Linux/Mac/Windows,采用命令行交互模式,同时提供丰富的 Tab 自动补全功能,进一步方便进行问题的定位和诊断。
    今日推荐英文原文:《Windows 10 update fixes bugs in Excel, File Explorer and Wi-Fi connections》作者:Alison DeNisco Rayome
    原文链接:https://www.cnet.com/news/windows-10-update-fixes-bugs-in-excel-file-explorer-and-wi-fi-connections/
    推荐理由:windows10的各种Bug各种不稳定以及频繁的更新历来被众人吐槽, 这次微软为几个主流的win10版本提供了可选的Bug修复补丁.

    Windows 10 update fixes bugs in Excel, File Explorer and Wi-Fi connections

    Microsoft has released a new, optional update for Windows 10 versions 1809, 1903 and 1909 that addresses a number of bugs in the operating system. This is the first update since Microsoft said it would pause optional nonsecurity update releases in March due to the coronavirus pandemic. 

    For all three version of Windows 10, the update fixes a problem that caused the Magnifier in Microsoft Excel to stop working, which also caused Excel to crash. For versions 1903 and 1909, Microsoft also addresses problems in File Explorer: It will fix an issue that caused File Explorer to stop working when you browse directories of raw images and other file types, and you’ll now be able to delete previous terms from the search box. 
    下载开源日报APP:https://opensourcedaily.org/2579/
    加入我们:https://opensourcedaily.org/about/join/
    关注我们:https://opensourcedaily.org/about/love/
←上一页
1 … 47 48 49 50 51 … 262
下一页→

Proudly powered by WordPress