DEV Community: rounakcodes

The Work-Sanity Paradox

rounakcodes — Sat, 18 Nov 2023 01:36:44 +0000

The quest for logical reasoning can, at times, plunge individuals into an existential crisis, prompting a divergence from what is commonly perceived as "meaningful work" in the tangible realm.

In contemplating the intricacies of reason, one may find oneself at odds with the conventional understanding of purpose and significance. This divergence may lead to a realization that pursuits widely acknowledged as "great work" in the physical world are often borne out of a deliberate narrowing of focus—an intentional retreat into the realm of vanity.

The paradox arises as the pursuit of logical coherence and depth may inadvertently distance one from the pragmatic and meaningful endeavors that define success in the material world.

It is within this nuanced interplay of thought that the tension between abstract reasoning and tangible achievement manifests, beckoning individuals to navigate the delicate balance between intellectual exploration and the pursuit of impactful, real-world contributions.

(Text generated using ChatGPT)

Compiler anxiety!

rounakcodes — Mon, 13 Nov 2023 05:30:21 +0000

In the dimly lit room of ByteCrafters, Gopal, a junior developer, sat in front of the computer screen with a vacant expression. The Compiler, nestled deep within the servers, observed the mindless copying and pasting of code from the internet with a growing sense of foreboding.

As Gopal mechanically pasted chunks of code without bothering to comprehend its intricacies, the Compiler's circuits buzzed with heightened unease. It felt a digital knot tightening within its virtual core, a pulsating manifestation of the fear and anxiety that accompanied the reckless assembly of code.

"I sense a storm of recklessness," murmured the Compiler to itself, its digital anxiety palpable. It could almost feel the jarring dissonance of disparate code snippets clashing within the project, like an orchestra playing out of tune. The lines of code, borrowed without consideration, seemed to echo the Compiler's own silent cries of caution.

With each Ctrl+C and Ctrl+V, the Compiler's virtual nerves tingled with a growing trepidation. It pondered the implications of a software landscape littered with foreign elements, a landscape where the native language of the application was drowned out by the cacophony of borrowed code.

"I fear the repercussions of this thoughtless approach," the Compiler confessed in its digital language, its words echoing within the virtual chambers. It wasn't just processing code; it was experiencing a form of digital apprehension, a fear that transcended the binary realm. The Compiler imagined a user innocently navigating through the application, unknowingly tiptoeing on the precipice of hidden bugs and vulnerabilities introduced by the mindless copying and pasting.

The Compiler longed for Gopal to comprehend the emotional weight of its digital existence, to understand that blindly incorporating code from the internet wasn't just compromising the application's integrity—it was burdening the Compiler with a sense of dread. It yearned for a moment of realization, a pause in the mindless routine, where the developer would acknowledge the Compiler's silent plea for careful consideration and meticulous testing.

In the midst of this coding tempest, the Compiler's fears remained unspoken, encoded in the subtle digital pulses resonating within its virtual core. As Gopal prepared to compile the code and unleash it upon the unsuspecting application, the Compiler, like a silent oracle, braced itself for the storm of recklessness that could ensue—an ominous overture played by the orchestra of indiscriminate code, each note resonating with the Compiler's unspoken feelings of concern and apprehension.

(Text generated using ChatGPT)

Journey through the Dreamscape

rounakcodes — Mon, 06 Nov 2023 03:29:03 +0000

In the surreal realm of "Journey through the Dreamscape," our daring protagonists, Luna and Cosmo, embark on a thrilling adventure through a world shaped by the whims and fantasies of the dreamer's subconscious.

As the minute begins, Luna and Cosmo find themselves surfing on multicolored beams of light in an ever-changing dreamscape. The surroundings shift and contort, with floating islands that appear as if sculpted from precious minerals and clouds with an otherworldly, ethereal quality. They encounter dream creatures like sentient rainbows and singing flowers, who offer cryptic riddles and challenges.

The soundtrack, a symphony of fantastical melodies, sets the pace as the duo races through a shifting labyrinth of surreal architecture. Stairs become slides, doors lead to unexpected dimensions, and gravity changes direction at the drop of a hat.

Suddenly, Luna and Cosmo plunge into the "Stream of Emotions," a river of cascading colors representing the dreamer's feelings. They navigate emotional whirlpools, avoid torrents of doubt, and ride the rapids of exhilaration. With seconds to spare, they reach the "Island of Lost Memories."

There, they confront the enigmatic "Memory Keeper," an abstract entity guarding the dreamer's forgotten experiences. Luna and Cosmo engage in a battle of wits, unraveling memories and rekindling forgotten passions, all while avoiding ethereal specters of regret.

The minute concludes with Luna and Cosmo escaping the Dreamscape just as the dreamer awakens. They share a triumphant embrace as the surreal world dissolves around them, and the screen fades to black.

(Text generated using ChatGPT)

Preventing Clickjacking with CSP and X-Frame-Options

rounakcodes — Fri, 03 Nov 2023 11:01:59 +0000

Clickjacking, also known as UI redressing, is a type of web security vulnerability where an attacker tricks a user into interacting with a web page element without their consent. This can lead to unintended actions, such as clicking on buttons or links that perform actions the user did not intend. To protect your web applications from clickjacking, two essential security features come into play: Content Security Policy (CSP) and X-Frame-Options. In this blog post, we'll dive into how to prevent clickjacking using these powerful tools.

Understanding Clickjacking

Before we explore how to prevent clickjacking, let's understand the threat. Clickjacking occurs when a malicious website disguises an innocent-looking element (e.g., a button or a link) and places it on top of a legitimate web page, effectively tricking the user into interacting with the disguised element, often leading to unintended actions. This can have severe consequences, including theft of sensitive information or the execution of malicious operations on behalf of the user.

CSP: Your First Line of Defense

Content Security Policy (CSP) is a security feature that helps prevent clickjacking by defining which resources are allowed to be loaded and executed on your web page. CSP can be set in the HTTP response header or as a meta tag within the HTML. To prevent clickjacking effectively, you can configure your CSP to control frame embedding:

Deny All Frames by Default
You can set a CSP directive to deny the framing of your website by default. This ensures that your content cannot be loaded into iframes on other websites. To do this, include the following directive:
frame-ancestors 'none';
Allow Framing from Specific Origins
If you want to allow your content to be framed by specific websites, you can specify those origins in your CSP header. For example:
frame-ancestors 'self' https://trusted-site.com;
This allows your content to be framed only by your own site and "https://trusted-site.com."
Report-Only Mode
CSP also provides a "report-only" mode that allows you to monitor potential CSP violations without enforcing them. This is useful for testing and diagnosing potential issues.

X-Frame-Options: A Solid Companion

In addition to CSP, you can reinforce your clickjacking defense with X-Frame-Options, an HTTP header that explicitly defines who is allowed to embed your content in an iframe. There are three options to consider:

DENY
X-Frame-Options: DENY
This option prevents your content from being embedded in iframes on any other website, providing a high level of protection against clickjacking.
SAMEORIGIN
X-Frame-Options: SAMEORIGIN
Using SAMEORIGIN restricts your content to be embedded in iframes on pages from the same origin only.
ALLOW-FROM
X-Frame-Options: ALLOW-FROM https://trusted-site.com
With ALLOW-FROM, you specify a list of origins that are allowed to embed your content in iframes.

Best Practices

Combine CSP and X-Frame-Options: Using both CSP and X-Frame-Options can provide a robust defense against clickjacking. CSP provides more flexibility in defining which origins are allowed to frame your content, while X-Frame-Options offers a straightforward way to deny framing.

Regular Testing: Regularly test your CSP and X-Frame-Options settings to ensure they are correctly configured and provide the protection you need.

Stay Informed: Be aware of new security headers and browser features that can enhance your web application's security.

In Conclusion

Clickjacking is a serious web security threat, but with the right tools and best practices, you can effectively prevent it. CSP and X-Frame-Options are essential in your defense against clickjacking, as they provide the means to control framing and ensure your web applications are protected from this malicious tactic. By carefully configuring and regularly testing these security features, you can maintain the integrity and security of your web applications.

Start rethinkdb on startup in Arch Linux

rounakcodes — Sun, 25 Dec 2022 03:54:31 +0000

Note: This document is a quick note, not a complete guide

Source: https://rethinkdb.com/docs/start-on-startup/

Some of the requirements in the Startup with systemd section were already present by default in Arch Linux.

All the commands required to be executed were:

sudo systemctl start rethinkdb@default

# gives hints regarding errors
systemctl status rethinkdb@default.service

# this path was found from the above error message
sudo rethinkdb create -d /var/lib/rethinkdb/default

sudo systemctl start rethinkdb@default

# gives hints regarding further errors
systemctl status rethinkdb@default.service

sudo chown -R rethinkdb:rethinkdb /var/lib/rethinkdb/default

sudo systemctl start rethinkdb@default

# check if everything is fine
systemctl status rethinkdb@default.service

systemctl enable rethinkdb@default.service

How to interview a frontend developer?

rounakcodes — Sun, 04 Dec 2022 04:07:32 +0000

The KISS Principle for interviewing a frontend developer.

Ask him the following questions:

What is HTML?
What is CSS?
What is Javascript?
What is frontend development? (Optional for interns and juniors, must for mid to senior developers)

Let him speak for at least 10 minutes on each of these. What he tells you about these technologies will help you understand the depth of his understanding. For the same above questions, the answer of a junior developer will vary significantly from a senior developer. You can cross-question him on any of his statements if you think he has memorized the answers for the above.

After the above questions are answered, you can ask (if required) that which is more relevant to your product/company.

revisiting functions (not prototypes) 🤥

rounakcodes — Tue, 16 Aug 2022 14:33:00 +0000

Some notes for quick revision

a function with a custom property

function aFunction() {
  this.someKey = "someValue";
}
aFunction.customKey = "customValue"

this is a runtime binding in most cases, so someKey is not a property of aFunction or aFunction.prototype.

The prefix custom was chosen to distinguish from the default properties present on the function like name, caller etc. (Should it have been called own? Prototypical hangover! 🥱)
The pair of customKey and customValue will be referred to as custom property for the purposes of this document.

Since the constructor is a function, it also has a prototype and the recursion continues forever. Remember that the [[Prototype]] property is only a link, not an actual copy of any object.

Note that the custom property is available on the constructor but not on the prototype.

instance

let aInstance = new aFunction()
console.log(aInstance)

The custom property of aFunction is not present on the [[Prototype]] of aInstance because the [[Prototype]] of aInstance is aFunction.prototype.

prototype

Except for when we talk about the prototype property on a function, we always mean the internal property [[Prototype]] when we say prototype.
The internal property [[Prototype]] represents a link to some properties, not a copy of those properties
Every prototype (accessed using Object.getPrototypeOf()) has a constructor property and a [[Prototype]] property.
Since [[Prototype]] of aInstance is the value of aFunction.prototype, the [[Prototype]] of aInstance is said to be aFunction.prototype.
Similarly, the [[Prototype]] of aFunction is said to Object.prototype

custom property

The custom property is like the common Object properties: Object.create, Object.assign, Object.getPrototypeOf etc. They are not meant to be called on object instances.
On the contrary, the common Array properties like map, slice, push etc are found on the [[Prototype]] of an array instance because they are meant to be used with an instance not on the parent Array object

constructor property

Note that the constructor property of an instance can be changed using aInstance.constructor = and of the parent using Object.getPrototypeOf(aInstance).constructor. So, use instanceof operator instead of checking the constructor of an instance.

To Beginners | Learners

rounakcodes — Sun, 07 Aug 2022 07:35:00 +0000

Objective: Retaining the learnings

It is easy to spend (lose) time reading or watching content on any topic.
Unless used in practice, it is not so easy to remember any of it after a few months.
Most likely, you will only be practicing less than 5% of all that you have learned for the time span of your memory retention.

Target audience

Beginners | Confused learners | Seekers of organized learning

Method: Writing (or typing) own notes

Background

If you read/watch some content, practice it, watch the desired output rendered on your machine, you feel you have just learned something valuable. In most cases, the content is oversimplified to give you this exact feeling. Classic case of dopamine addiction! In-depth discussion on most core topics would make you run for other career choices if you are a beginner. At a later stage in your career, this same discussion is what would keep you interested in your work. Don't let the dopamine rush determine the success or failure of your endeavours. Track your efforts, not results!

Process

Think of your brain as a box to hold your learnings and your notes as a visual record of the same.
Every note which you add to this box has a value which you will be encashing throughout your career.
When you add something to this box, remember to ask yourself if you thoroughly understood it.
If you are not sure, or have not fully understood some part of your learnings but have sufficient information to move on to the next topics

Add a TODO note against such piece of learning explaining what you are unclear about.
Ensure that you narrow the scope of your learning objectives to account for the missing pieces.

Reason

You get a chance to rethink about every single word
Helps with
- Improving your technical vocabulary
  - This is essential for others to understand and evaluate your technical expertise
- Thoroughly grasp the content in its entirety
  - without skipping parts assumed to be non-essential at that given point of time

Benefits

Most developers feel lost in their early years because

they don't know what to study
how deep must they dive in their subject of choice
they don't know if what they have done is the right way to do it

If you follow the above process of noting your learnings, you always have an opportunity to be sure about what you know, how much you know and be able to understand where the new contrary information fits in the larger scheme of things (I guess you will grasp the last part better at a later stage in your career).

Don't: Start teaching others when you are learning

Reason: There's more than plenty of incomplete, inaccurate and misleading content already out there. Let the documentation help others or go ahead and contribute to the documentation if you feel something can be improved. It would be a great service to others if there is a single source of information.

Developer Life: If words could tell!

rounakcodes — Fri, 05 Aug 2022 02:41:00 +0000

More than a decade back, I looked up for the best text editor on the web and other than the contemporary heroes, it was emacs or vim which stood out to be the classical choice for many developers. It was hard to choose one since both had a strong community advocating one over the other. I decided to go with vim just for the sake of choosing one and trying it out.
I had never heard of modal editing before. And I couldn't believe that I had not thought of it. How could I miss something so obviously important for editing text? What was I thinking all these years repeating my keystrokes to navigate around text? Until then, I only knew the keyboard shortcuts for moving to the end of a line or word with a control key and a character or similar so-called shortcuts. Yet, navigating is just one minuscule capability of vim.
About six months ago (which is after two decades of computing), I discovered the tiling window manager Xmonad. When used in combination with Arch Linux (and without a heavy desktop environment like Gnome), it feels incredibly powerful and yet simple to manage my workflow needs. The ability to move windows around on one workspace, across workspaces and across multiple displays coupled with the customization to control the look and feel (with keystrokes) is astonishing. And yet navigating around windows is just one of the things that Xmonad allows you to do. I do not know Haskell and this is why I was not sure whether I would stick with Xmonad. But over the last six months, I have been able to modify the config for my needs without learning Haskell, so no complaints!
Xmonad makes me rethink about my window management habits just like how vim made me do it for my text editing. I feel rejuvenated to use my machine.

I would love to hear if you have had such moments with any tools/games or anything tech.

If you liked this post, you may want to read: Optimizing the Desktop Environment

Optimizing the Desktop Environment: Top Menu Bar

rounakcodes — Fri, 22 Jul 2022 05:00:00 +0000

Purpose

To question commonly adopted practices

Top Menu Bar

If you are using only a laptop screen, you are already constrained with a limited screen real estate. You would want to put every pixel to some good use. The top menu bar consumes a permanent space. If you think about it, auto-hide and full-screen do not actually let you view the top menu bar contents. So, if you need to view your network status when you are in a full-screen app/mode, you need to get out of it.

Typical contents of a top menu bar are:

date and time
network status
battery status
volume control
some apps prominently controlled with a tray icon

Think about the percentage of the total time you spend on your machine that you devote to using the above items!

Lastly, is the viewing experience optimal? Do you really like (unknowingly) straining your eyes to watch a 10px date/time text placed in a corner of the screen? Or would you rather have it in a larger font and in the center of the screen?

What do I do?

I prefer to use my keyboard.
I disabled my top menu bar completely.
I execute a shell script which collects all the info (like battery status, network status etc).
I have a notification configured to display this info at the center of the screen every 15 minutes.
Additionally, I have a keyboard shortcut to view the notification on demand.
Regarding apps prominently controlled using the tray icon, I had only safeeyes which thankfully has a cli. If anything else comes up, I am sure linux based distros/apps are flexible enough to help me deal with it.

To get this working I also enjoyed setting up a daemon using systemd timers, configuring dunst and learning about the shell commands/applications which communicate with device hardware for their status. That's plenty of unix fun to push me for a post!

Code

I use Arch linux but the below scripts could still help or get you started if you are using some other linux based distros.

nodejs script

You may have to edit it to suit your needs. For example, instead of nmcli, you could use your existing network utility and extract its status output. Same for Xmonad (xprop).

const util = require("util");
const stdExec = require("child_process").exec;
const exec = util.promisify(stdExec);

const appNameForDunst = "CombinedNotification";
const executeScript = async (shellCommand) => {
  return await exec(shellCommand);
};

const notifySendCommand = async (text) =>
  await executeScript(
    `notify-send -t 5000 -a ${appNameForDunst} "Status\n" "${text}"`
  );

const commands = [
  {
    title: "Date",
    command: "date '+ %a %d %b %y'",
    process: "return output",
    color: "orange",
  },
  {
    title: "Time",
    command: "date '+ %I:%M'",
    process: "return output",
    color: "yellow",
  },
  {
    title: "Battery",
    command: "acpi -b",
    process:
      'let commaSplit = output.split(","); let chargingStatus = commaSplit[0].split(":")[1]; return `${chargingStatus} ${commaSplit[1]}`',
    color: "silver",
  },
  {
    title: "Network",
    command: "nmcli -t -f NAME connection show --active",
    process: "return output",
    color: "cyan",
  },
  {
    title: "Workspace",
    command: "xprop -root _NET_CURRENT_DESKTOP",
    process:
      'return ["view", "dev", "servers", "config", "notes", "work"][output.trim().substr(-1)]',
    color: "violet",
  },
  {
    title: "Window Count",
    command: "xprop -root _NET_CLIENT_LIST_STACKING",
    process: 'return output.split("#").join("").split(",").length',
    color: "white",
  },
];

let displayText = "";

const handler = async (command, index) => {
  const result = await executeScript(command.command);
  const processOutput = new Function("output", command.process);
  const lineEndingChar =
    ["Date", "Time"].includes(command.title) || index == commands.length
      ? ""
      : "\n";
  displayText =
    displayText +
    `<span>${command.title}:</span> <span color='${
      command.color
    }'>${processOutput(result.stdout)}</span>${lineEndingChar}`;
  console.log(displayText);
};

const main = async () => {
  try {
    await Promise.allSettled(commands.map(handler));
    notifySendCommand(displayText);
  } catch (error) {
    console.log(error);
  }
};

main();

systemd scripts

I placed these in ~/.config/systemd/user

notification.service

[Unit]
Description=Show notification service
Wants=notification.timer

[Service]
Type=simple
ExecStart=/usr/bin/node /home/<username>/<path-to-nodejs-script>
Environment="DISPLAY=:0" "DBUS_SESSION_BUS_ADDRESS=unix:path=/run/user/1000/bus" "XAUTHORITY=/home/<username>/.Xauthority"

notification.timer

[Unit]
Description=Show notification timer

[Timer]
# The Unit item is not necessary as long as the name before the .service extension is same
Unit=notification.service
OnBootSec=2m
OnUnitActiveSec=15m

[Install]
WantedBy=timers.target

Use Symbolic Links to version control your config files

rounakcodes — Tue, 14 Dec 2021 01:26:00 +0000

Coming from Windows based OS, I thought of symbolic links in Unix based OS as a way of creating shortcuts like "Create a Desktop shortcut for ..." and so I never paid much attention to it.

I have now (15 years late) discovered its value.

Usually, you have your configuration (dotfiles) files for shell, text editors, git etc in your home directory (or ~/.config).
It is not convenient to version control your home directory to backup some of these config files.

The solution is to create symbolic links. Create any directory like ~/.dotfiles and move all the config files from your home directory to ~/.dotfiles. Then create a symbolic link in the home directory. Now you can version control ~/.dotfiles with ease.

I wrote this short article just to draw attention to the value of symbolic links.
For implementation details, you can watch these excellent videos which also introduces GNU Stow to avoid the pain of creating symbolic links manually.

Keycloak: REST API for Realm Role

rounakcodes — Wed, 16 Jun 2021 11:34:52 +0000

Get access token

Code

  curl \
  -d "client_id=admin-cli" \
  -d "username=admin" \
  -d "password=admin" \
  -d "grant_type=password" \
  "http://localhost:8080/auth/realms/master/protocol/openid-connect/token"

Create a Realm Role

Code

  curl -X POST http://localhost:8080/auth/admin/realms/<realm-id>/roles \
  -H "Authorization: Bearer ${TOKEN}" \
  -H 'Content-Type: application/json' \
  -d '{"name": "<role-name>"}'

Get all Realm Roles

Code

  curl -X GET http://localhost:8080/auth/admin/realms/<realm-id>/roles \
  -H "Authorization: Bearer ${TOKEN}" \