DEV Community: Backlog Slayer

Dev Dependency Day

Backlog Slayer — Thu, 18 Jul 2019 22:09:05 +0000

Earlier today, I made this tweet.

We need a developer holiday.

I propose Dependency Day.

A day in the year, when we fix all project dependency issues on the Github projects we manage.

It wasn't well received, of course, because "a holiday should be for resting".

I know this borders on unrealistic, but I'd like to make my case anyway.

If you're like me, you already have a ton of emails from Github about projects you manage, that have security issues because of its dependencies.

For some reason, this is targeted at JavaScript devs, and NPM tries to make fixing this easy by offering the npm audit command, which shows you which packages have security issues, and npm audit fix which attempts to automatically bump up the dependency versions to values where those security issues no longer exist.

One problem with that, is the higher versions your dependency gets bumped to, might be incompatible with your code, so you might need to check the docs to figure out what changes are necessary to keep your code working.

Another problem arises when there's no higher version of a dependency that resolves the security issue. Perhaps, because the developer is like us, and hasn't made out time for a fix. This is a bigger challenge, because now you have to raise an issue and wait for a reply, or make a PR and hope it gets attended to.

But if every developer got 24 hours without office work, dedicated to resolving these issues, I imagine it would be really helpful. I wonder what the internet thinks.

Why is Slack changing its internals?

Backlog Slayer — Mon, 15 Jul 2019 18:01:18 +0000

This post by @changoman inspired many tools for changing Slack's visual themes.

It used to be fairly easy to find and edit Slack's ssb-interop.js file, to load a custom CSS which would change the way it looked.

With the recent release of v4.0, the file is gone, and exists as a bundled file within app.asar, a compressed file.

To achieve the same functionality, you'd have to extract app.asar into a folder, edit the dist/ssb-interop.bundle.js file, and compress the folder back into app.asar before restarting the application.

This means, that Slack's program loads content from the compressed file.

I wonder what the benefits of such an arrangement would be to Slack's internal architecture. Does anyone know?

PHP: Testing only changes

Backlog Slayer — Fri, 13 Jul 2018 09:21:03 +0000

Ref: [USATF Mid-Atlantic](https://mausatf.com/background-screening-process-changes/)

I recently found this awesome 😍 tool that let me run tests on only files that have been modified since the last commit, like I'm familiar with in the Jest framework.

Because I couldn't find a way to do this with PHPUnit Watcher or PHPUnit itself, and it worked for me with a few minor blocks, I have decided to share.

If you know how, please tell me in the comments.

The Blocker

The package's PHPUnit dependency was marked as ^6.0, so it wasn't working on my project, which had a dependency marked as ^7.0.

The Fix

I've made a fork here and I use its dev-master branch in my project by adding it to composer.json like:


"repositories": [
    {
        "type": "vcs",
        "url": "https://github.com/mykeels/WhatsChanged"
    }
],
"require-dev": {
    "icyapril/whats-changed": "dev-master"
}

This is so that composer resolves the package from my GitHub fork rather than use the official package.

Usage

Now, when run ./vendor/bin/whatschanged, I get:

tests/Feature/AuthTest.php     OK (3 tests, 6 assertions)
tests/Feature/IntentTest.php   OK (5 tests, 21 assertions)

rather than

🎉💃 Happy Coding!

Reading Passwords from STDIN in PHP

Backlog Slayer — Wed, 04 Jul 2018 12:41:50 +0000

Hi Everyone,

Recently, I had to create an artisan command that submitted some data on behalf of a user.

I needed it to have access to the user's password to do that.

My first thought was to store the password in an environment variable. I really did not want to do that, and preferred to make the user of the script enter the password every time it was necessary.

[Secure Password Prompt](http://osxdaily.com/2015/02/04/terminal-wont-show-password-when-typed)

How it was done

It was important to ensure that the password was entered securely (invisible too), so I looked into how to and here's what I came up with.

private function getPassword($prompt = "Enter Password:") {
    echo $prompt;

    system('stty -echo');

    $password = trim(fgets(STDIN));

    system('stty echo');

    return $password;
}

How I understand it

The stty command, as I understand it now sets the terminal properties.

stty -echo sets the echo property to false, so the terminal will NOT echo the input it receives to the screen, rendering the password invisible
fgets(...) retrieves input from a stream interface (STDIN).
STDIN is the input stream that fgets reads the input from
stty echo restores the echo property to true, so we can now see output on the screen again

I hope you learned something from this, as I did. Happy Coding. 😍