#user-defined functions in sql with examples

[wemapacsb]

What is No-Code? Low-code vs No-code? How to build an app without coding?

What is No-code?

A no-code development platform is a tool for building software applications without coding; a well-liked and promising alternative to traditional software development for non-technical business users hoping to create their own full-fledged applications.

 If you are running a small business that lacks the budget to install software or outsource to a software development house, no-code platforms move the strength of innovation into the hands of your entire organization.

 Using a no-code platform, you'll equip more of your workforce with the tools they require to become citizen developers. Business developers and other non-programmer roles can step in to satisfy the stress of faster application delivery, building business, web, and mobile applications on their own.

 Is No-code different from Low-code?

There is a standard misconception that low-code and no-code are interchangeable terms, but they’re not.

 No-code platforms are for business people who don't have any coding knowledge. No-code uses declarative programming and is about what you tell the system/ machine what you would like, and build in it. In traditional software application platforms, code represents instructions that tell platforms the way to implement the desired functionality. With no-code, the app creator defines what the app does instead of how it does it.

 No-code platforms also can be employed by non-technical people. However, at some point, a developer is going to be required to end things off. No-code platforms or rapid application tools (like WEM APAC, , for example) have pre-built functionality that enables users to create their application to a particular point, before calling during a developer to then code or customize the rest. Developers tell the platform how they need to use the components.

If you’re considering using either sort of development platform, but still aren’t sure which is true for you, you'll learn more about low-code vs no-code.

  How to build an app without coding?

If you’re new to no-code platforms, you'll be wondering why there's no-code, or how it's possible to create applications without code. I mean, what can we need software developers for then?

 When you repose on a no-code platform, you're building with code, you merely don’t need to do any coding. No-code platforms have pre-built drag-and-drop elements that are coded for reuse and scale.

 A no-code development platform is actually an interface builder, where you'll rapidly drag-and-drop every website together, and instantly see how it'll look on mobile, tablet, and desktop. Using visual models replaces the complexity of coding, allowing you to manage your data easily. No-code platforms utilize declarative UI describing what the user should see, rather than how it should be laid out. This allows platform users to render an equivalent app across multiple devices.

 But no-code applications aren't primarily just drag-and-drop user interfaces.

Features of No-code platforms

Drag-and-drop interface:

A foremost common feature of no-code platforms may be a visual drag-and-drop i.e "what you see is what you get" interface that lets users create an application from scratch very quickly.

 AI and machine learning:

Some sophisticated no-code platforms make use of AI and machine learning techniques to predict user actions and make the event process even more streamlined and efficient.

 Data connections:

Counting on the business use case, some no-code platforms make it easy for you to attach the appliance with other sources of enterprise data, like Microsoft Excel and SQL databases.

 Security and privacy:

As a corollary to the above point, no-code platforms should follow best practices for security and privacy, keeping your codebase freed from vulnerabilities and protecting your sensitive data.

  Mobile capabilities:

Many enterprise software applications got to run on mobile devices or on both desktop and mobile. If you would like to develop applications for mobile, make certain to settle on a no-code platform that has these capabilities.

 Why use WEM for No-Code development?

 WEM is a no-code platform that empowers endeavors to profit by the quick changes in the market with purpose and at the speed fitting their personal preference. This sped-up business speed is accomplished by utilizing the No-Code undertaking application stage supplemented by Hyper Automation capacities, extra versatile application improvement abilities, and configuration administrations. WEM empowers developers to create awesome bespoke software at speed, without the limitations of a no-code solution. Our vision is to inspire the freedom to innovate bringing alignment between business and IT.

[security]

Tumblr's 4th Annual Security Capture the Flag

We've hosted an internal Security Capture the Flag (CTF) event for four years in a row now, with each year getting better than the last!

The event

Previously, we were only open to Tumblr employees. This year we decided to extend an invite out to the other teams housed under our parent company, Oath.

All participants had a three hour window to hack, a buffet of tacos, beer, and wine to dive into, and a stack of prizes for the top four players (see Prizes below for details)!

Challenges were available Jeopardy-style, broken down by category. We had eight fun categories to select from:

Auth Bypass (authn | authz)

Cross Site Request Forgery (CSRF)

Cross Site Scripting (XSS)

Crypto

Forensics

Reverse Engineering

SQL Injection (SQLi)

XML Injection (+ XXE)

We also sprinkled a few "inside joke" Easter eggs around the system that awarded bonus points to anyone that discovered them! For example, if they attempted to find a hole in the CTF system itself and navigated to /wp-admin, we'd give them a flag on a prank WordPress page; or perhaps testing to find XSS with a <marquee> tag — only the greatest of all XSS tags!

While the Security Team walked around and helped out, we also setup a mini lockpick village just because.

Solving challenges & scoring points

To complete a challenge, the player had to achieve the goal within one of the listed categories.

In XSS challenges, the player would need to cause the browser to create an alert dialog (e.g. alert()).

Conversely, in SQL Injection challenges the player would need to read the flag column from the flags table in that challenge's database.

When the player successfully solved the challenge they were awarded with a flag, each in the format ofTumblr{s0mE_cHalL3nGe_j0kE-abcdef012}. That last piece is a unique hash for the user, per challenge, so that they couldn't directly share their flag. They can help others — even provide the solution — but they can't simply give away their flag.

Each challenge, when solved, is worth a certain number of points based on the challenge's difficulty and whether or not the player used the challenge's hints.

There were 3800 points available, though no player was able to break 1000!

At the end, we locked the leaderboard and announced the winners.

Prizes

We awarded the top four players based on their ranking on the leaderboard. First place got first dibs from the list. Second place gets to select theirs from the remaining lot, and so on.

Up for grabs this year:

Hak5 Elite Field Kit

Proxmark3 RDV2 Kit

Samsung Chromebook Plus

Lockpick set and a "how to" manual

Challenge snapshot

Throughout the eight categories we had a total of 46 challenges. We wanted to have a wide range of challenges that welcomed players of all backgrounds and experience levels.

The goal for XSS challenges was to get an alert dialog to appear. The player is presented with a vulnerable web page and they needed to determine where the vulnerability is and how to exploit it. Example:

These challenge levels ranged everywhere between simple non-sanitized output to DOM reflection to CSP bypasses.

One fo the more unique challenges to develop was SQL Injection. These offered players the ability to put their SQL skills to the test with a variety of basic input injection, blind injection, and filter bypassing challenges.

In at least one of the SQLi challenges, players had to inject into an INSERT statement. When creating challenges like this, special care had to be taken to give players the full capabilities of MySQL but also prevent them from revealing the flag to other players — it's a tricky thing making vulnerabilities secure!

The infrastructure

A frequent question I receive when I talk about deving on the CTF is "are you using CTFd?" Short answer? Nope! A slightly less short answer is that CTFd wasn't out when we started this =P.

The framework we're using is called "Security Training Grounds" and it's a custom-written project using PHP, PhantomJS, and MySQL (with HTML + JavaScript too, of course), running in Amazon Web Services.

An advantage of writing this in-house was that it gave us the ability to create a dynamic and robust system that has endless capabilities.

PHP + MySQL

The website was created from scratch, written in PHP with a little bit of jQuery + Bootstrap on the frontend and MySQL as the database.

The big thing here are the challenges themselves. Each challenge is hosted on its own subdomain. This enables us to provide live and interactive challenges like XSS or SQLi while still providing support static challenge types like Crypto or Reverse Engineering.

We accomplished this by allowing dynamic hostnames on the webserver and defining a subdomain hostname for each challenge that's stored in MySQL. When a web request comes in, the app checks whether it's a subdomain or not. If so, it hits the database to determine what to display.

For most challenges, we were able to handle all of the dynamic pieces directly in PHP. For some, such as the C or Java reverse engineering challenges, we did need to shell out to gcc or javac to build the custom binaries for each user.

PhantomJS

A difficulty for XSS and CSRF challenges is determining whether or not the participant successfully exploited the system. Surely we don't want to manually confirm for each flag, and attempting to pattern-match on their input would be crazy.

Our solution: execute what the player submits!

This is my own little baby, a piece of the system I'm so excited by. See, what better way to test XSS than to actually test XSS. As mentioned in the "Challenge snapshot" section above, when a player is working on a XSS challenge, they are given a website that has a XSS vulnerability. Their goal is to make an alert dialog appear. This is key and the requirement of the XSS framework itself.

On the client, we use this fancy little snippet:

var ctf_alert = alert; alert = function(msg) {    ctf_phantomjs_alert_test(document.location, msg); };

This overrides the window's actual alert() function and lets us put some processing logic in the middle. The logic is to take a snapshot of the current page - the URL, query string, POST parameters, the cookies and then pass the full snapshot to a backend PhantomJS service (via a PHP proxy, to help prevent tampering).

The PhantomJS service replicates that entire request and loads the target web page. If the page invokes an alert() call, which we catch via PhantomJS's onAlert, then we return with a "success" and the PHP proxy will return the user's flag. Our alert() overriding logic will then replace whatever message the user attempted to display and display their flag instead. Fancy af.

CSRF has a similar setup, except the player needs to submit their full CSRF payload:

After submitting the payload to the PHP proxy, we pass the payload to PhantomJS. This executes the payload in the context of an empty web page. If the PhantomJS worker successfully falls victim to the targeted action, the PHP proxy will return a flag to the user!

Open source

The framework code, as-is, is still relatively hacky and written with internal dependencies. We do believe in OSS though! We expect a near-future initiative to rewrite portions of it so we can release it for others to use for their CTF events, too.

Wanna Play?

Quick, come apply so you can participate in the next one: https://www.tumblr.com/jobs

[nadabananana-blog]

Python Web Development

https://nestack.com/services/outsource-python-development/

DJANGO:- There is support for Python 3.4 on Django, which was designed to leverage a lot of native Python rather than using third-party frameworks and libraries. Django makes use of controllers known as "Views", although it is an MVC framework. The Views controllers contain the logic that processes user requests and returning responses. Django uses an Object Relational Mapper, or ORM, to map objects to database tables. This is quite different from web2py which uses a Database Abstraction Layer, or DAL, to map objects to tables, queries, and records. The code works with various databases and improves portability between different types of databases. It works with PostgreSQL, MySQL, Oracle, and SQLite, and other databases can be utilized with third-party drivers too. It's not a CMS like Joomla, WordPress, or Drupal. With Django, you do need to write code in order to create your website - although of course, this can be handled at the Nestack offshore development center. Popular and highly trafficked sites like Pinterest, Instagram, Disqus, and Mozilla all use Django. With the help of Django, you can build web applications up from a basic concept to a launch within just a few hours. It takes a lot of the effort out of web development, making it easier to create your app without fussing with a lot of confusion. Django is also open-source and free.

Super fast: Django is designed so that it helps developers bring their applications from concept to completion in the fastest possible way.

Fully loaded: Django comes with dozens of extras that can be used to take care of common web development needs. Django handles user authentication, site maps, content administration, RSS feeds, and so much more. It does all this directly out of the box.

Highly secure: Django is serious about security so it makes it easy for developers to bypass a lot of common mistakes they might make with security, for example cross-site scripting, cross-site request forgery, SQL injection, and clickjacking. The Django user authentication system makes it easy to securely manage your user accounts and passwords.

Totally scalable: Django is used by many of the world's most highly trafficked websites to provide fast, easy, and flexible scaling to meet changing traffic demands at the highest level.

Brilliantly versatile: Django is used by various organizations, businesses, and governments. They can build all manner of things, from social networks to scientific computing platforms to content management systems.

PYRAMID:- Pyramid helps to make it easier than ever to write web apps. Start from the basics with this "hello world" web app which is minimal and works on a request/response basis. This can take you a long way, particularly if you're still learning, but can also make it easy to write more advanced software as your application grows thanks to its range of helpful features. Pyramid can run in all supported versions of Python and comes with helpful installation instructions to help you get Pyramid ready to run. There is a handy tutorial to take you through the process of writing single file applications, forms, database integration, and authentication. Developers can go deeper into the narrative documentation or broad API reference which Pyramid includes. Pyramid also offers you a whole pool of useful resources to help you use it. Extending Pyramid functions as a filterable and well-organized group of packages, add-ons, and applications which work with Pyramid.

When You Need Pyramid: Megaframeworks make all of the decisions on your behalf. This can lead you to fight their decisions if your ideas don't fit their point of view. Microframeworks don't force any decisions, making it easy for you to get started. When your application grows, however, it's all up to you and you're on your own. Whichever you're using, the main focus is on the beginning of the process: there's either too much, or not enough. Whatever the case, it's hard to complete your project and keep it finished. It's best to use an end-focused framework with architecture that scales down to help you get started and then scales up as your application is growing. Pyramid was created with this in mind, as the Goldilocks frameworks - it's not too big, not too small, but just right. It's the Start Small, Finish Big, Stay Finished Framework.

TORNADO:- Tornado is an asynchronous networking library and Python web framework which was first developed at FriendFeed. Tornado is highly scalable up to thousands of open connections because it uses a non-blocking network I/O. This makes it an excellent framework for WebSockets, long polling, and various other applications which need long-lived connections to each user.

FLASK:- Flask is a Python-usable microframework that is based on Jinja 2 and Werkzeug.

WEB2PY:- Chicago-based Massimo Di Pierro, a Professor of Computer Science, is the lead developer of the Web2py platform. It offers fantastic documentation which includes a 600-age PDF giving an introduction to Python. It's an excellently complete platform. There are answers to everything in the web2py documentation so it's a great option if you're new to Python Web development. The security is built-in, giving you sets of generated forms with field validation. Sessions are stored on the server-side which means that there's no point in attempting to tamper with cookies. The database support includes built-in SQL generation that covers ten of the most popular databases as well as the Google App Engine. Web2py is based on the MVC architecture and generates html from code rather than messing with PHP embedded tags. You can use a complete free administrative interface as soon as you've defined your models. There isn't Python 3.x support just yet, although it is apparently in the works. However, it is still an excellent web framework if you're looking to outsource a project using Python 2.7.

BOTTLE:- Bottle works as a single file module with no dependencies aside from the Python Standard Library. It's a quick, easy, and lightweight WSGI micro web framework for use with Python. • Routing: Support for strong, dynamic URLS via requests to function-call mapping • Templates: Quick Python template engine built-in to allow support for templates from cheetah, jinja2, and mako. • Utilities: Easy access to form data, file uploads, headers, cookies, and a variety of other HTTP-relevant metadata. • Server: HTTP-development server comes built-in and includes support for fapws2, bjoern, paste, gae, cherrypy, or whichever other WSGI-enabled HTTP server you might want to use.

[jbaquerot]

6 Popular Big Data Technologies that You Must Know

Do you know what could be the key differentiator between a market leader and a has-been leader?

Do you know what could be the key differentiator between a market leader and a has-been leader? It is “data management” and any organization that cannot handle the influx of data and put it into good use is likely to give way to wiser companies that know how to make their data work. They are constantly on the quest for finding new strategies to make innovative use of Big Data. In fact, the power of Big data and mobility can truly elevate businesses to new levels. Hence, Big Data is the term given to huge amounts of data. As the data comes in from a variety of sources, it could be too diverse and too massive for conventional technologies to handle. This makes it very crucial to have the skills and infrastructure to handle it intelligently. This data must be analyzed computationally to reveal patterns and trends, thereby aiding in marketing and promotional campaigns. Here are a few examples of organizations that make use of Big Data: · Government organizations track social media insights to capture the onset or outbreak of a new disease. · Oil and gas companies integrate their drilling equipment with sensors to ensure safe and more productive drilling. · Retailers track web clicks to help identify the various behavioral trends to improve their ad campaigns. Now, let’s look at some of the trendy big data technologies that you can use to promote your business:

1. Apache Spark

With its built-in modules for streaming, machine learning, graph processing and SQL support, Apache Spark certainly deserves a mention as the fastest and general engine for big data processing. It supports all important Big Data languages including Python, Java, R and Scala. It complements the main intention why Hadoop was initially introduced. The main concern with data processing is speed, so you need something to diminish the waiting time between queries and the time it takes to run the program. Even though Spark was introduced to speed up the computational computing software process of Hadoop, it is not an extension of the latter. In fact, Spark uses Hadoop for two main purposes only — storage and processing. Use case: Apache Spark is a major boon to companies aiming to track fraudulent transactions in real time, for example, financial institutions, e-commerce industry and healthcare. Suppose a credit card was swiped for a huge amount, say, Rs. 50,000 whilst your wallet was lost and it wasn’t you who swiped, it is possible to detect where and when the fraud took place.

2. Apache Flink

If you have heard of Apache Spark and Apache Hadoop, then you will have heard about Apache Flink as well. Flink is a community driven open source framework, founded by Professor Volker Markl — Technische University, Germany. Flink meaning “swift” in German is high performing and extremely accurate data streaming. The capabilities of Flink is inspired by MPP database technology (for functioning like Declaratives, Query Optimizer, Parallel in-memory, out-of-core algorithms) and Hadoop MapReduce technology for functions like Massive scale out, User Defined functions, Schema on Read).

3. NiFi

NiFi is a powerful and scalable tool to possess, thanks to its capacity to store and process data from a variety of sources with minimal coding and a comfortable UI. And that’s not all. It can easily automate the data flow between different systems. If NiFi doesn’t contain any sources that you require, then the straightforward Java code lets you write your own Processor. The specialization of NiFi is data extraction and is a highly useful solution for filtering data. As NiFi is an NSA project, the security for this tool is commendable.

4. Kafka

Kafka is a must because it is a great glue between various systems right from Spark, NiFi to third party tools. And streams of data can be handled efficiently and in real time. Kafka is open source, horizontally scalable, is fault tolerant, extremely fast and a safe option. Being a distributed system, Kafka stores the messages (simple byte arrays and developers store any object in any format) in topics, and the topics themselves are partitioned and replicated across different nodes. When Kafka was first introduced, it was a distributed messaging system built initially at LinkedIn, but now is part of the Apache Software Foundation and is used continuously by thousands of companies. Use case: Pinterest uses Apache Kafka. The company built a platform called Secor using Kafka, Storm and Hadoop for real-time data analytics to ingest data into MemSQL.

5. Apache Samza

The main purpose of the conception of Apache Samza is to extend the capabilities of Kafka and is integrated with the feature alike Fault Tolerant, Durable messaging, Simple API, Managed State, Extensible, Processor Isolation and Scalable. It uses Apache Hadoop YARN for fault tolerance and Kafka for messaging. Thus, you can say it is a distributed stream processing framework. And it comes with a pluggable API to run Samza with other messaging systems.

6. Cloud Dataflow

Cloud Dataflow is a native Google cloud data processing service integrated with simple programming model for both batch based and streaming data processing tasks. With this tool, you no longer have to worry about operational tasks including performance optimization and resource management. Through its fully managed service, it is possible to dynamically provision the resources to maintain high utilization efficiency while minimizing latency. And you no longer have to worry about programming model switching cost through its unified programming model method. This method aids in batch and continuous stream processing, making it easy to express computational requirements without worrying about data source. Conclusion The big data ecosystem is constantly evolving and new technologies come into existence very frequently, many of them evolving further and further beyond the Hadoop-Spark stacks. These tools can be utilized to ensure seamless work with security and management, sans any hiccups. Data engineers require these tools to pull, clean and set patterns for data to help data scientists explore and examine them thoroughly, and build models.

[ilikeict-blog]

The Net and the Web

The Internet has revolutionized communication. Back in the early  times, cave walls and scrolls were used to keep records of history and   activities of people. With the invention of the printing press, radio,   telephone and television, widespread dissemination of information was   made possible. Now that we have the computer and high-speed   telecommunication systems, information publishing has become even better and faster on a global scale. Internet or simply called the "Net" is an interconnection of computer networks  that can be accessed by people around the world. It uses wired or  wireless connection that connects computers and network devices. You can connect on the Net using your PC and smartphone. There are billions of  computers and devices connected on the Net, some are designated as  servers and most are client devices. Clients request services from servers, just like customers request food services from restaurants.  Servers provide services such as email, application, database and web  services. When you access Facebook to browse your network of friends or  download and upload some files, you are actually using the web and file  services of that site. When you check your email in Yahoo!, you are  using its mail service. When you search for information in Google, you  are using a database service on its search engine. Websites with  millions of users worldwide have server farms and data centers to manage requests and store its information. Some servers are dedicated for  domain name service and web hosting. If you want to locate the server  that publishes the website that you want to access, you must know its  server name or domain name. The Uniform Resource Locator or URL contains the protocol and the name of the server that make up the Internet  address of the site you want to access. A good example is  https://www.facebook.com. :-) The  computers and network devices both servers and clients, use protocols to communicate with each other. Protocols are rules or standards for  communication between network devices. Some common protocols are HTTP or  Hypertext Transfer Protocol for web access, FTP or File Transfer  Protocol for file transfer, SMTP or Simple Mail Transfer Protocol, for  email. Data packets are used to carry the data to be transmitted  back and forth from server to client. A proxy server is used to control  which data packets are allowed to pass through on a company's network.   Certain ports are opened such as port 80 for web access, port 25 for   mail, and some ports are intentionally blocked to implement network   security. What about the WWW? The World Wide Web or simply called the "Web" is a system for publishing  information on the Internet. Websites are collection of web pages of  certain companies or individuals that are stored on web servers. The web pages contain the information that we access on a website. The content  of a web page has many formats such as text, graphics, audio, video and  animation. The web content are defined using HTML or HyperText Markup  Language and are displayed or rendered using web browsers such as  Internet Explorer, Mozilla Firefox, Google Chrome, Opera and Safari. Most companies use websites to have an Internet presence to promote   their business. They take advantage of web technologies to advertise and market their products and services. Facebook and Google generate its   revenues mostly from its advertisers or sponsors. Companies have also   installed e-commerce systems to connect to their customers, suppliers   and business partners. Online ordering system and online banking system are just some of the examples of these web applications. The Web  is characterized by its features and functionalities. It started with  HTML which created and linked static web pages using hyperlinks then  JavaScript and CSS to provide interactivity and style. Dynamic content was made possible because of  server-side development tools such as PHP, J2EE and ASP.NET. Relational  Database Management Systems such as MySQL Server, MS SQL Server and  Oracle are used extensively to support social networking sites and cloud computing. These software technologies have contributed much in the  development of sophisticated web applications. The Web has also  some issues about security and connectivity. There are lots of hackers  and viruses that are "on the wild" on the Net that create security  threats and risks to people and organizations. That is why WWW is also  called the Wild Wide Web. Due to the increasing demand of Internet  connection, there is a great challenge for Internet Service Providers or ISPs on how to cater such demand and at the same time provide quality  services to its subscribers. WWW could also mean World Wide Wait to  those who are affected by poor and erratic Internet connection. Setting up websites has been easier nowadays due to some content management  systems or website templates that are widely and freely available such  as WordPress and Joomla!, and the inexpensive web hosting fees offered  by web hosting providers. These provide many opportunities for people  who have skills not only in web design and development but also in  content writing. There are lots of content writers and bloggers around  the world writing different topics of interests for certain companies  and organizations. Most  people have referred to the Net and the Web as the same entities. Technically, they are not. You can think of the Net as an interconnected computer systems that store information and run programs. On the other  hand, the Web is a system for organizing and accessing information on  the Net. Think of the Net as the hardware component and the Web as the  software component. Anyway, we are free to use those terms  interchangeably, provided it should be used in the right context. In this article, I have presented to you a brief description of the   Internet and its services. Protocols and data packets were also   mentioned. The World Wide Web has provided us vast amount of information of any topic we can imagine. It also created opportunities as well as   risks both for companies and individuals. I plan to write an article about web application development as soon as I have the time, so stay tuned.