Product Management Night at Clearlink with Jon Sheppard – Digital Privacy

He works at Ghosterly. 

EU has stricter data laws due to past indiscretions by dictators (Hitler) using confidential identifying information.

Privacy by Design – 7 Principles

1.      Proactive not Reactive

2.      Privacy as the Default Setting

3.      Privacy Embedded into Design

4.      Full Functionality – Positive-Sum, not Zero-Sum

5.      End-to-End Security – Full Lifecycle Protection

6.      Visibility and Transparency – Keep it Open

7.      Respect for User Privacy – Keep it User-Centric

Dev Mountain Look Back

I've been wanting to write a blog post about DevMountain and my experience there for a while.  I learned a lot of things there.  I also was exposed to a lot of things and don't remember how to do them.  I'm continually working on what I know and do and so hopefully I'll be able to take full advantage of my experience there further on down the line.

I finished my MBA in the fall of 2014 and immediately started applying to jobs.  Between my wife and I we applied to over 100 jobs without much luck by way of interviews.  I think I got one or two calls just confirming that I had indeed applied and to see if I was interested if they wanted to bring me in to which of course I said, but never heard anything more from any of those applications.  In response to that frustration I began looking at my options.

In the spring of 2013 I began doing exercises on free sites like codeacademy.com and others to get experience with coding.  At that time I remember coming across coding boot camps, but due to cost, timing with a kid on the way and what not, I opted for a part time delivery job and continuing working till the baby came.

One big push for doing the coding boot camp at DevMountain came after talking to a friend, David Dame, in which conversation he told me that getting into tech is a great idea and that DevMountain or something similar would be really useful.  Between him and my wife's encouragement I decided to apply and was accepted to start their January 2015 track in the part time program.

I was encouraged by the placement stats of their graduates, which stats came from their part time students, since their full time program had just started.  I also went and met both the founder of DevMountain and another coding boot camp, DevPoint Labs, and got a much better feel for DevMountain despite it being more expensive.

So night one of actually coding was a disaster for me.  We were setting up things to work with Github and I was struuuuugling and needed a lot of help.  I left that night totally wrecked.  I cried in my car outside of my house cause I was so worried and felt so dumb.  I wanted to cry several times in class, but that's just too embarrassing so I didn't do that.

It slowly got better and I was able to actually comprehend some things and do some things on my own.  My brother and his wife were indispensable to my ability to getting things done and explaining some things.  They're really good at coding and are making and will make tons of money in the future.

What I really liked about DevMountain versus learning on my own is they know the material/concepts needed to break into the tech world as well as how long to spend trying to learn those as an entry level developer.  For example codeacademy has a lot of material on html, css, but in DevMountain you spend at most one week on that stuff, i.e. three days in class and then the classwork outside of it, so maybe six nights of coding.  I could be wrong, but time wise I feel like I spent more time on it when I was teaching myself than when I tasked with assignments by DevMountain.  In that sense I loved the direction DevMountain gave.

Another thing I absolutely love about DevMountain is that it is a very real alternative to going to a traditional school for 4 years to get a degree in computer science.  I can attest that the education gained in a traditional college environment is 100% legitimate as I have family that are some of the best coders I've met to date who are CS graduates.  I do think that both routes are perfectly fine.  There are the merits of having a certification/degree from a traditional school that a coding boot camp won't ever be able to provide.  As a means to breaking into the industry in a shorter, cheaper time frame with what I believe is also a lower salary point than a traditional degree is ok since the cost of going and time of course is cheaper and shorter.  In the time it'd take to get experience at a cheaper entry point is more than made up for by the time the traditional four year graduate has finished school and is just barely getting real world experience.

One thing that DevMountain didn't do so well I feel was job prep.  Not in the sense of technical training, but just how to network and find a job when you have no experience.  As is the case in most job fillings it typically happens due to someone knowing someone.  That is how it was for me and I know that's how it is for a lot of coders.  In my estimation the best way to "cold apply" to jobs is to put your resume out there for positions and titles you'd be interested in doing and then once you get an alert for it don't apply, but instead see who on LinkedIn that you know that could introduce you to the company or put in a good word for you.  That results in a much better chance of actually getting an interview and a job offer.

That is mainly everything about DevMountain that I can think of.  I hope you enjoyed it and if you have any questions for me leave a comment down below.

LiveReload with Sublime Text 3

So one extension I just heard about that I'll now be using going forward, especially since we use Sublime Text 3 in our department, is LiveReload.  This extension auto updates your file in chrome, firefox, or safari to adjust for changes you've made to your code after you've saved it.  You're welcome front end developers.

I'm going to try and recap more

I'm going to start cataloging more of the things that I'm learning on the job.  One to chronicle it here for myself and others.  Two so I can see the progress I'm making.  Three so that I can see when I've stopped learning more and have mastered my skill set so that I can know to ask for more to stretch myself or to ask for a promotion within Red Bell or if neither of those happen then I'll know it'll be time for me to move on to somewhere else to get said experience and a raise.

I'll start to be more active here too as it pertains to my story and what my advice would be for others looking to get into tech.

Guesterly Info Night @ DevMountain

Conventional Web-To-Print Companies...
  What you see is what you get
  Traditional Web Application

New Web-To-Print Companies...
  Online Preview
    HTML
    CSS
Convert to Print Ready
    InDesign
    Javascript

They're able to use InDesign, but they want to and are making a product that operates outside of it that closely mirrors InDesign.  They're doing this through simple, yet powerful html/css manipulation.  Pretty cool idea and definitely growth for this niche market.

Security Talk hosted at Adobe

Jeff Walter - Adobe - Event Organizer
Brent Shaffer - Adobe - security basics 101 - Matrix Architect - He writes sdk's and the night's presenter

Framework/language does a lot, but not everything.
Your site is vulnerable.
Friends may embarrass you, bots, hactivists.
Many attacks easy to prevent.

Bot hacked github repository, spun up servers to mine bitcoin. brand new developer.

All inputs are evil! don't trust your users' cookies, parammeters, http headers.
All servers are evil - good assumption for end-users.
Whitelists better than blacklists (???).  I need to learn more about this!
Don't store passwords in plain text.
Dont store your passwords in source code.
Dont leak error messages -
.Openwest conference -

Cross site scripting - xss 
Javascript injected that will run on behalf of another user.  steals cookies. exploits user's trust. 84% of all website vulnerabilities were this type.  Chrome has dev tool ability to stop these types of attacks.

Defense? 
Validate user input when storing.  Escape when using variables in output - based off the content type its being used in.  Escaping html for a variable in JavaScript will not save you.
Use templating language or markup language if you want user-input rich text, i.e. markdown, textile, rst(restructured text).


Code Injection - comes in many forms, i.e. command-line injection, sql-injection, html/javascript.
Access filesystem using "upwards" paths
Access everything if system commands are being used
Commands like exec, passthru, and system are often used to execute bash commands
Commands like eval are used to dynamically evaluate PHP code.

Defense?
Strip upwards paths
ensure all files are relative to a safe "root"
be strict on validation, output-escaping, use with extreme caution

SQL injection - sanitize your inputs! use "bound variables", use ORMs/Database Abstraction Layers when possible

cross site request forgery - csrf (pronounced sea surf)
Exploits the browsers running on the client, exploits a site's trust in its users
Victim is logged into vulnerable website.  Attacker has victim make a request to vulnerable website without them knowing.
The infamous "Samy Worm" - Attack on myspace, w/in 20 hours over a million users ran the attack

Defense?
Validate the referrer.  The http referrer header says which url initiated the request.  this blocks any referrer that isn't you.  only works if a whitelist can be constructed for where the requests will come from.
Use a csrf-token
a token that is generated for each request based on the client's session ID.  Each form submits this back to the website.  Very difficult for an attacker to spoof.
<input type="hidden" name="csrf" value="eanorsytnoiarenstoiearnst">

session hijacking
similar to csrf
Attacker obtains the victim's cookie, and is then able to perform actions on their behalf.  Typically done for websites not secured with SSL/HTTPS.  Open networks and insecure networks (WEP) commonly found in public areas make it possible to view other traffic on the same router.  Plugins make this incredibly easy, like FireSheep, Cookie Cadger, DroidSheep.  Sniffing is easy with tools like WireShark.

Defense?
use ssl/https throughout all site

Honeypot is a secret field that a normal user wont see/use, but a bot will and if used the whole request would be rejected.

Rate limiting helps to block Denial of Service (DOS).

In the beginning were 1's and 0's

We all know that computers operate in binary and that is about the extent of our knowledge.  This blog will take you through my musings on coding.  This will range from past, current, and future things I want to learn.  It will discuss things I've done to learn to code including free sites, bootcamps, and meetups.

Enjoy!