Right Hand Side Table of Content

This pull request resolves the RHS of issue #93
Details
Wrote a script to retrieve a table of content for every MD and save it in a final JSON (config/post.json), and then read the JSON in the js and render a React component(components/Toc.JS).
The Toc component uses a custom scroll-spy component I created to navigate the right heading in the markdown...
Since the scrollspy component checks, if the heading actually exists in the content in other to scroll, we're using markdown for the site content in which the headings don't have IDs assigned to them
Screenshot

WONTFIX as now done separately.


DNNE.targets produces error in Visual Studio error list on open solution

Visual Studio reports an error in the Error List, despite the fact that this error does not occur in a full build.
Severity	Code	Description	Project	File	Line	Suppression State
Error		Generated source file(s), C:\Users\andarno\source\repos\vs-threading\obj\src\SosThreadingTools\Debug\net7.0-windows\dnne/SosThreadingToolsManaged.g.c, not found. In order to generate source an export must exist. Create an export by adorning a function with UnmanagedCallersOnly.	SosThreadingTools	C:\_nugetpackages\dnne\2.0.0\build\DNNE.targets	121

The thing is, I do have such an attribute.
Repro steps
git clone https://github.com/AArnott/vs-threading.git
cd vs-threading
git checkout 00d95df58e51bbee9500ff17fff9b41354978433
.\init.ps1  # or init.cmd if using cmd.exe
.\Microsoft.VisualStudio.Threading.sln

See how the Error List populates with the error.

This also breaks the design-time build to such an extent that when I open source files within the impacted project, I get errors everywhere that I reference the DbgEngExtension or Microsoft.Diagnostics namespaces.

Your fix works. Thank you!


Expense Security Checks: Optimize queries and improve performance

[ ] Improve Order stats query performance: https://github.com/opencollective/opencollective-api/blob/820a22f0eb029cec5b5fc81c2aa6851bb879f9da/server/lib/security/order.ts#L19-L26
[ ] N + 1 issue on Expense.securityChecks for the host dashboard. The field is not using loaders despite having multiple heavy SQL queries.
[x] As a quick win, indexing users IPs as we're filtering on nested JSON in findRelatedUsersByIp seems like a necessity.

https://opencollective.com/nmhep/contribute/heppy-10th-birthday-new-mexico-health-equity-partnership-45814/checkout/profile?amount=100&platformTip=20&contributeAs=raju-sheikh&amount=100&platformTip=20

Related: https://github.com/opencollective/opencollective/issues/6739

Also, there's an optimization to make on the call to PayoutMethod similar; it is not batched (N + 1 issue) and the query filters on unindexed JSONB data, making it extremely slow in some cases (I get some timeouts locally).

Some fields have since been migrated to add loaders, but we're still missing 2 important calls:

findRelatedUsersByConnectedAccounts
PayoutMethod.findSimilar


Coverage isn't generated for source files when tsc source maps used

Link to bug demonstration repository
https://github.com/rohit-gohri/nyc-bug-source-map-demo
Might be related to #1348

Expected Behavior
Source maps get loaded and coverage generated is for the .ts file. The __coverage__ object has the src files.
Observed Behavior
Coverage for the src file is not correct. The __coverage__ object only has dist js files.
Troubleshooting steps

[x] still occurring when I put cache: false in my nyc config

Environment Information

  System:
    OS: macOS 11.6
    CPU: (8) x64 Intel(R) Core(TM) i5-1038NG7 CPU @ 2.00GHz
    Memory: 134.09 MB / 16.00 GB
  Binaries:
    Node: 16.13.0 - ~/.nvm/versions/node/v16.13.0/bin/node
    Yarn: 3.2.0 - ~/.nvm/versions/node/v16.13.0/bin/yarn
    npm: 8.1.0 - ~/.nvm/versions/node/v16.13.0/bin/npm
  npmPackages:
    nyc: ^15.1.0 => 15.1.0
    source-map-support: ^0.5.21 => 0.5.21
    typescript: ^4.6.2 => 4.6.2

Hello, I am also facing the same issue. Did you find any working solution ?


notebook output is wrong

See that I'm logged in
run the endgame github issues notebook release notes query
see issues that don't belong to me

that would rely on $MINE being set correctly, did you run the top cell first?
if you replace $MINE with assignee:@me does it work correctly?

I tried that and it did not work. reloading fixed it 🤔

My guess is that the macro wasn't set properly somehow. I'll close for now but if it comes up again, I can try to look into how that all works.


allow entry of URL for streaming

seems fairly self explanatory, but I should be able to tune into a stream with this.

I would love to be able to support this, but the truth is that most streams are not served with the correct headers to allow for cross origin access, which we need in order to do visualizations, EQ, and balance.
Was there a particular stream you had in mind? It could be possible to setup a Winamp2-js player hosted on that domain. I'd be happy to help you set that up.

understood. know all about those same-domain cross-origin access policy problems.
the use case I had in mind initially was just to replicate this winamp functionality which is not present in the js implementation.
with the understanding that sources from another domain would be problematic and why, the idea of pulling a stream or an mp3 file from the same server would probably be sufficient.
if there was some way to set this information initially via code, it could work for me.

So, you’re open to hosting a version of winamp2-js on the same domain as the content?
Have you tried this? My guess would be that it should more or less work. If not, i’d Be curious to hear the specifics of what’s not working (I would imagine the duration might display badly or cause problems).
If you haven’t tried, but are interested, i’m Happy to help you figure out how to try.


The differences between pretrained model "mobilestylegan_ffhq_v1.ckpt" and "mobilestylegan_ffhq.ckpt"

In the file "model_zoo.json", two pretrained models(mobilestylegan) are provided. I wonder about the differences between the two pretrained models. Thank you for your help!!

@zuimeiyujianni hey, thanks for your interest. Yes, there are two pre-trained models are available:

mobilestylegan_ffhq_v1.ckpt - the first version of the MobileStyleGAN with FID=12.38, as we reported in our paper.
mobilestylegan_ffhq.ckpt - the new version of the MobileStyleGAN with FID=7.75. This model has the same computational complexity as the previous version (we improved only the training pipeline), but better quality of generated images.

Thank you very much for your reply!!!


[AutoPR adhybridhealthservice/resource-manager] adhybridhealth: correct definitions of types

Created to sync https://github.com/Azure/azure-rest-api-specs/pull/4043

Closing PRs that have been open for more than 1 month.


Prevent circular imports via linting

The problem
Circular dependencies can cause surprising bugs. For example, variables may not be defined before being used.
The solution
https://github.com/import-js/eslint-plugin-import/blob/main/docs/rules/no-cycle.md
If someone wants to use a circular dependency they can always disable the rule.

Hi @Jagrutiti as they rule authors say, this can be computationally expensive, so the main thing to check is that this doesn't make linting take an unreasonable amount of time.  I had a quick go locally and, well, it's still computing :(
So, if we are going to include the rule, we have to configure it to have a small enough max-depth.  That will take a bit of trial and error.

Hi @ojeytonwilliams thank you for explaining.
I am full of doubts here:

I had a quick go locally and, well, it's still computing

What are the steps to check this locally?
What should I look for?

So, if we are going to include the rule, we have to configure it to have a small enough max-depth.

What did you mean by the rule?
I have never configured eslint. I'll need some more guidance.
If you think I am the right fit to work on this issue, I'll be more than happy to learn.

Hey @Jagrutiti if you're interested in learning how to configure eslint, I recommend taking a look at the docs I linked.

What are the steps to check this locally?

Well, you'd just turn on the rule and then run npm run lint:js.  We've already installed eslint-plugin-import, so there's no need to worry about that.

What did you mean by the rule?

Just the eslint rule we're talking about.

Hi @ojeytonwilliams I hope this  is my last question

Well, you'd just turn on the rule

But, how do I turn on the rule? And in which file?

Sure. This is how you configure the rules.  The file in question is here: https://github.com/freeCodeCamp/freeCodeCamp/blob/main/.eslintrc.json

@ojeytonwilliams thank you for being patient with me. It means a lot.

No problem at all.  Best of luck!

So, this has already been helpful - I'll create an issue to remove that cycle!

It does take really long. The higher the number the longer it takes. What is the maximum waiting time we can consider?

That's a good question.  "Too long" is somewhat subjective, but I'd say 10 minutes to lint is probably the upper limit.
What I recommend is creating a PR with maxDepth of 3 (or 2 if you think that would take too long) and we can see how long it is in practice.

https://github.com/freeCodeCamp/freeCodeCamp/blob/main/.eslintrc.json

Could you suggest a faster alternative? import/no-cycle is costing me a lot of time


Decouple file extension and template engine/transformer

Hey! Thanks for this plugin.
One issue I have is the tight coupling between a file extension (ex. .html.hbs) and its corresponding transformer (ex. jstransformer-handlebars). I'm using the metalsmith-permalinks plugin, and it's not building proper permalinks from templates if they're not a .html file (source).
So. I can't use .html for my templates since this plugin won't transform them with Handlebars, and I can't use .html.hbs in order to get pretty permalinks.
I've tried putting the .use(permalinks()) call both before and after my inPlace() call. I noted that inPlace is behaving differently from metalsmith-markdown, for instance. The Markdown plugin will process an .md file to HTML and pass it to permalinks, but inPlace doesn't seem to process .html.hbs files to HTML at once and pass to permalinks:
src/
   lol.md

// ...
.use(markdown())
.use(permalinks());

Turns into
build/
   lol/
      index.html

since permalinks already got a lol.html to play with (I debugged the output).
It would be super cool if we could override a certain extension to be transformed with a certain transformer:
.use(inPlace({
  transformer: 'jstransformer-handlebars'
}))

I realise this is trickling down in to the other repo (https://github.com/superwolff/metalsmith-engine-jstransformer/blob/master/lib/render-file.js#L36), but the option needs to live up here I guess.

Hi,
Glad you like it. Unfortunately jstransformers kind of revolve around file extensions, and to circumvent that would break the whole jstransformer idea.
You should be able to solve this easily by running metalsmith-permalinks after in-place. Since in-place has then already renamed the files to .html metalsmith-permalinks shouldn't have any problems.
Let me know if that works!

Whoa, it works now 🎉 I put it like this in my build file:
.use(inPlace())

  .use(permalinks({
    relative: false
  }))

  .use(layouts({
    directory: 'src/layouts',
    partials: 'src/partials',
    pattern: '**/*.html',
    engine: 'handlebars',
    default: 'layout.html'
  }));

Before, I had put permalinks() below the call to layouts().
Thanks for taking the time!

The Markdown plugin will process an .md file to HTML and pass it to permalinks, but inPlace doesn't seem to process .html.hbs files to HTML at once and pass to permalinks:

What do you mean exactly? Because in-place processes all files, and only when it's done with all of them will the next plugin in the chain be started. Which is how all metalsmith plugins should handle files.
And if you're processing say index.html.hbs, in-place should process it and rename it to index.html. Is it not doing that?

Ha, posted at the same time again. Great! Glad that it worked out!


⚠ Bofrost.de has degraded performance

In f9f76f3, Bofrost.de (https://www.bofrost.de) experienced degraded performance:

HTTP code: 200
Response time: 1280 ms

Resolved: Bofrost.de performance has improved in 84ad233 after 9 minutes.


Crash

Microsoft PowerToys version
0.68.1
Installation method
Microsoft Store
Running as admin
Yes
Area(s) with issue?
General
Steps to reproduce
2023-08-17.txt
✔ Expected Behavior
Run
❌ Actual Behavior
Crash
Other Software
Chrome
Steam
Nord VPN

Hi @lilyj-sudo
Can you please update PowerToys to the latest version? We are on version 0.72.0 that includes several fixes to PowerToys Run.
Also there is no error in the attached logs and a /bugreport would be nice.


Add DOI to documentation

I noticed we don't have how to cite the tool on the documentation, I will add the DOI in key locations

closed with PR #216


Remove unsupported use of proc in title patterns

This will allow puppet generate types to function
Example:
Error: /etc/puppetlabs/code/environments/production/modules/splunk/lib/puppet/type/splunk_alert_actions.rb: title patterns that use procs are not supported.

https://tickets.puppetlabs.com/browse/MODULES-4505?focusedCommentId=418416&page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel#comment-418416
https://github.com/treydock/puppet-module-keycloak/pull/21

I had to look up the ->(x) notation here.  This looks correct to me.

The build failures are still due to https://github.com/voxpupuli/puppet-splunk/issues/169 I think.


Why should payload type 0 be standardized?

0: control packet
Control packets may be used in some applications (for example, the Siemens message infrastructure) for accessing configuration state.

There seems to be insufficient motivation to standardize the type value of 0 when all other type values are source specific. Considering that the only standard definition of control packet is a proprietary protocol all encoding's of type field should be source dependent.

That's a fair comment, and something that had occurred to me also.  The type field is currently defined as default length of 2 and must be discoverable if larger.  In the spirit of making this as general as possible, how do you feel about the following:

type field default width is 0 and must be discoverable if larger

(i.e. all packets from this source are the same type, which will be the most likely case for non-Siemens systems)

In section 3.3:

If type field width is 0, only instruction trace is supported
If type field width is 1, 0 is instruction trace, 1 is data trace
If type field width is 2, definition is as currently defined

Looks good but the type field width of 2 case can be just dropped as section 3 is about E-trace which only defines Instruction and data trace. The definition for width=2 can be provided by an application of encapsulation that uses such width.

I'm sorry that I'm giving my comment a bit delayed. But if the document says that the type field width must be detectable if > 0, wouldn't it be better to also define how this detection should work?

I understand where you're coming from, and in an ideal world, yes it would.  But this is just one of many attributes of a RISC-V system that have to be discoverable.  The Unified Discovery TG is responsible for specifying a standard discovery mechanism for such attributes.  It is unfortunate that this is not already in place, but we cannot hold off ratification of all specs that reference discoverable attributes until after this is done, and nor does it make sense for every spec containing a discoverable attribute to define it's own mechanism.   As a result, this is out of scope for this spec,

I agree that it does not make sense to wait for the Unified Discovery TG. However, there are several counter-examples in the RISC-V environment where alternative discovery methods are defined.
From my point of view, this is understandable, especially as I understand that Unified Discovery will be optional. Furthermore, the addition of another dependency will make the creation of E-Trace solutions that already reference a number of other documents even more complex.
This will especially be the case if some E-Trace specialties, like the context field, require the presence of the unified discovery structure, which would otherwise be optional. I fear that this will confuse a significant number of chip designers.
In addition, the Common Trace Control Interface already reserves a certain amount of memory (0x0E0--0x0FF) for the sole purpose of recognizing trace encoder specifics. Don't you think this should be utilized somehow?
Do you think it makes sense to move this discussion elsewhere, as this is also relevant for E-Trace discoverable parameters?
Best regards, Michael

Yes, this is really a request to update the E-Trace spec to add register map definitions for the discoverable parameters.  The DTPM SIG is the place to raise this.


Add functionality that allow to pre-load data into the storage bucket(s)

It would be really useful, if the Docker container could start with pre-loaded data. This can help the usage of the tool for unit and integration testing. This could be done by either attaching a volume with data to pre-load or provide a hook script that is called before the server starts. Similar functionality is implemented in other GCP Storage Emulators and also in other common Docker images like databases (postgres Docker image has the /docker-entrypoint-initdb.d directory where the user can have SQL scripts for database initialization and data import).

https://github.com/oittaa/gcp-storage-emulator#docker

The directory used for the emulated storage is located under /storage in the container. In the following example the host's directory $(pwd)/cloudstorage will be bound to the emulated storage.

This is a directory controlled by the service and is read/write root by default, as the Docker service also runs as root. Additionally this cannot apply in memory backed storage. What I would like to have is a user directory, with user permissions and mounting on the container so at launch it imports all data in there. Ideally the top level directories of the import directory should be used as bucket names. For example the following directory:
import-dir
|_bucket_a
  |_directory_a
  |_directory_b
    |_file_a
    |_file_b
|_bucket_b
  |_directory_c
  |_directory_d
    |_file_e
    |_file_f

Should be loaded on startup and the server should create or use the buckets bucket_a, bucket_b (in memory or disk) and upload the corresponding files into the proper bucket.

Yeah, that sounds like a good idea. I don't have much time at the moment, but pull requests are welcome.

I have come up with a solution to the problem. Here it goes.
First I use Docker Compose to launch the container with these directives:
google_storage:
        image: oittaa/gcp-storage-emulator
        restart: unless-stopped
        ports:
            # Exposed in port 9023 of localhost
            - "<IP_ADDRESS>:9023:9023/tcp"
        environment:
            ####################################################################
            # Application environment variables
            PROJECT_ID: ${PROJECT_ID:-localtesting}
        entrypoint: /entrypoint.sh
        command: ["gcp-storage-emulator", "start",
            "--host=google_storage", "--port=9023", "--in-memory",
            "--default-bucket=${BUCKET_NAME:-localtesting_bucket}" ]
        volumes:
            - ./tests/storage/entrypoint.sh:/entrypoint.sh:ro
            - ./tests/storage/docker_entrypoint_init.py:/docker_entrypoint_init.py:ro
            - ./tests/storage/buckets:/docker-entrypoint-init-storage:ro

As you can see I pass the desired project name and bucket name via Env Vars, PROJECT_ID and BUCKET_NAME.
I override the entrypoint of the container with my own Bash script/Python script combination, entrypoint.sh and docker_entrypoint_init.py. Here are their contents:
entrypoint.sh
#!/usr/bin/env bash

# Exit in any error
set -e

[ "${PROJECT_ID}" = "" ] && { echo "PROJECT_ID Environment Variable is not Set!"; exit 1; }

# Install Python requirements
pip install google-cloud-storage==1.31.2

# Execute command line arguments in background and save process ID
"${@}" & PROCESSID=$!

# Wait process to start
while ! kill -0 "${PROCESSID}" >/dev/null 2>&1
do
    echo "Waiting for process to start..."
    sleep 1
done
echo "Process started, ID = ${PROCESSID}"
sleep 2

# Cloud Emulators
export STORAGE_EMULATOR_HOST=http://google_storage:9023

# Import data to bucket
echo "Importing data..."
python3 /docker_entrypoint_init.py
echo "DONE"

# Wait process to exit
wait "${PROCESSID}"

docker_entrypoint_init.py
"""Initialize Google Storage data
"""

import logging
from os import scandir, environ
import sys
from google.auth.credentials import AnonymousCredentials
from google.cloud import storage

logger = logging.getLogger(__name__)
logger.setLevel(logging.DEBUG)

def upload_contents(client, directory, bucket_name=None):
    """Upload recursively contents of specified directory.

    Args:
        client (google.cloud.storage.Client): Google Storage Client.
        directory (str): upload directory path.
        bucket_name (str, optional): Bucket name to use for upload. Defaults to
        None.
    """
    for entry in scandir(directory):
        print(entry.path)
        if entry.is_dir():
            if bucket_name is not None:
                # This is a normal directory inside a bucket
                upload_contents(client, directory + '/' +
                                entry.name, bucket_name)
            else:
                # This is a bucket directory
                upload_contents(client, directory + '/' +
                                entry.name, entry.name)
        elif entry.is_file():
            if bucket_name is not None:
                tokens = entry.path.split(bucket_name + '/')
                bucket_obj = client.bucket(bucket_name)
                if len(tokens) > 1:
                    gs_path = tokens[1]
                    blob_obj = bucket_obj.blob(gs_path)
                    blob_obj.upload_from_filename(entry.path)

PROJECT_ID = environ.get('PROJECT_ID')
if PROJECT_ID is None:
    logger.error('Missing required Environment Variables! Please set \
PROJECT_ID')
    sys.exit(1)

storage_client = storage.Client(credentials=AnonymousCredentials(),
                                project=PROJECT_ID)

# Scan import data directory
upload_contents(storage_client, '/docker-entrypoint-init-storage')

logger.info('Successfully imported bucket data!')
logger.info('List:')
for bucket in storage_client.list_buckets():
    print(f'Bucket: {bucket}')
    for blob in bucket.list_blobs():
        print(f'|_Blob: {blob}')

# All OK
sys.exit(0)

I hope this is helpful.


Integration tests for SQLite and MySQL

Issues
https://github.com/prisma/prisma2/issues/1603
https://github.com/prisma/prisma2/issues/1602
SQLite: ready but each test is slow and takes 3s
MySQL: WIP

🙌 🙌 🙌 🙌 🙌 🙌

@matthewmueller We really need to name these tests one day, do you think you could help with that?

For my understanding, do these tests line up exactly? I'm wondering if we should stick all the database in the same file, so they don't drift.

@matthewmueller We may want to reorganize the architecture at some point, right now they are copies so they follow the same order.


Cannot override Listitem Header component styles

Cannot override ListItem HeaderItem component styles. Trying the following code but it doesn't work. The border-bottom is still there.

Node : v10.9.0
Npm : 6.2.0
native-base: 2.4.2
react: 16.3.1
Expected behaviour
Able to override styles (trying to remove the border bottom).
Actual behaviour
Does not override styles.
Steps to reproduce
Try this code
Is the bug present in both iOS and Android or in any one of them?
Both

Closing this since this fixed the issue I had <ListItem itemHeader noBorder style={localStyles.sectionHeaderStyle}>


Fix passing nil for nonce and add example

This PR fixes an issue introduced by #402 related to AppAuth's use of a nonce, fixes an issue in GSI's -[GIDSignIn maybeFetchToken:], and provides an example in the DaysUntilBirthday app.
Issue in #402
https://github.com/google/GoogleSignIn-iOS/pull/402 provides the ability to pass a manual nonce via GSI to AppAuth (e.g., via this OIDAuthorizationRequest initializer that takes a nonce parameter).
Unfortunately, this addition to GSI breaks AppAuth's automatic use of its own nonce if one is not supplied since #402 will always pass through -[GIDSignInOptions nonce]. So, if the nonce in GIDSignInOptions is nil, then nil will be passed to AppAuth for the nonce, and therefore AppAuth will not produce its own nonce via this initializer.
Fixing -[GIDSignIn maybeFetchToken:]
-maybeFetchToken previously used a method on AppAuth (+[OIDAuthorizationService performTokenRequest:callback:])
that would pass nil for the last authorization response. The consequence of this is that the last authorization response's nonce will not be available for comparison within AppAuth since the last auth response and its nonce would be nil in the comparison.
This PR fixes the issue by always passing along the last authorization response in -[GIDSignIn maybeFetchToken:].
DaysUntilBirthdayExample
This PR also provides an example of the client passing in a manual nonce, and then comparing the received nonce in the authorization response to the manual nonce. It provides a simple example that clients may use to develop their own solution for comparing their manual nonce to the authorization's returned nonce

Cc @vonovak (author of #402) for your thoughts and review.

I'm going to merge since integration tests are passing locally. Seems like something is awry in the workflow/GitHub runner...

@mdmathias do we know in what version it will be available?

@mdmathias I would also love to see this released. When can we expect it out?
It's been one year since my nonce PR in AppAuth https://github.com/openid/AppAuth-iOS/pull/788 was merged. Would really appreciate it out.
Thanks so much!

Hi everyone! Inserting myself in here, and thanks for bringing it to our attention.
We're planning to include this in the next minor release, which we expect to roll out in the next month or two. Additionally we have a minor issue in the workflow/GitHub runner that we're addressing, but this should not a blocker.
Hope this brings some clarity!


Feature request: hysteresis

Provide support in the BPX standard for electrode OCPs to be defined as general functions of more parameters, in order to define a hysteresis model. The simplest such example could be the sigmoid hysteresis model (distinct charge/discharge OCP profiles) in PyBaMM.
[request from industrial contributor]

For the next version release, this can be satisfied through #26

@ejfdickinson - I know I said I'd stop disagreeing with you, but I think based on recent experience we need to include decay. Also, I think it's a bit cleaner/clearer to include a single OCP with a hysteresis term. This amounts to the same thing, but is easier to convey.

@tommaull Noted and agreed (with the benefit of 6 months' thinking time!) for any possible standard extension. A decay rate can always be short-circuited to be instantaneous if desired.
We recognised this uncertainty / absence of consensus, so we have not yet committed (BPX v0.4) for any explicit standardisation of hysteresis parameters.
In the immediate term, the open-ended user-defined parameter section (#26, PR #44), scheduled for BPX v0.4, satisfies sharing of parameters using either OCP approach (two OCPs / one OCP + hysteresis term). Also this would support the inclusion of a decay rate if desired. As this would fall outside the BPX equation standard, compatibility with BPX readers to convert to e.g. a compatible pybamm.ParameterValues object would need to be extended manually to satisfy any chosen user-defined format. I'd see this as very little work, however.

I suggest to revisit this now that there is a standard implementation of the Wycisk/Plett model] in PyBaMM (scheduled for 24.5 release).


Clean Up branches to establish new working format

This was done a while ago, though we might need to do it again


feat: support auto-naming for each chat

Fix: #963

The PR author himself said he will not continue this PR. So closed here


unable to view user

This occurs on a call to @user.department.name. Is department required?

fixed by #272


Eliminate redundancy of literate programming material here and into Intro lesson

From first Duke workshop: In the literate programming section, much of the content in the slides feels redundant after the morning, or perhaps just needs trimming / reorganization (remember the things - Rmd, knitr, HTML generation - we saw this morning? here is some more detail…).
Likely that this issue will get solved when we split this repo into two (issue #24) and remove the literate programming from the Intro lesson (https://github.com/Reproducible-Science-Curriculum/rr-intro/issues/10 ).

Moved this issue to literate-programming repo https://github.com/Reproducible-Science-Curriculum/rr-literate-programming/issues/2


made the cross function return an empty array when there are no match…

made the cross function return an empty array when there are no matching rows just as the documentation stated
Fixes #{5531}
Changes proposed in this pull request:

made the cross function return an empty array if there is  no matching rows

Thank you!
Your pull request includes the addition of many unrelated files. You can inspect that here:
https://github.com/OpenRefine/OpenRefine/pull/5712/files
For instance, the file benchmark/IDEs/eclipse/README.txt is unrelated to the issue you are trying to solve, so it should not be added by this pull request.

okay, so i should make another pull request and remove those files

It's interesting that you had to copy all those files, it really should not be needed. Yes, in any case they should not be part of the pull request you are sending. Just the Cross and CrossTests classes should be enough.


Implement method ones

implement numpys ones method following https://docs.scipy.org/doc/numpy-1.15.0/reference/generated/numpy.ones.html?highlight=ones#numpy.ones

Ok - will do.

Already done and merged. Will close this issue.

Moved to creation folder, and make it as NumPy extension, because numpy.ones is belong to NumPy, not NDArray.


Windows python tests fix

:tada: This PR is included in version 0.12.0 :tada:
The release is available on GitHub release
Your semantic-release bot :package::rocket:


[Fix #13556] Fix false positives for Style/FileNull

Fixes #13556.
This PR fixes false positives for Style/FileNull when using 'nul' string.
This PR ensures only files that use the string '/dev/null' are targeted for detection. This is because the string 'nul' is not limited to the null device. This behavior results in false negatives when the '/dev/null' string is not used, but it is a trade-off to avoid false positives.

Before submitting the PR make sure the following are checked:

[x] The PR relates to only one subject with a clear title and description in grammatically correct, complete sentences.
[x] Wrote good commit messages.
[x] Commit message starts with [Fix #issue-number] (if the related issue exists).
[x] Feature branch is up-to-date with master (if not - rebase it).
[x] Squashed related commits together.
[x] Added tests.
[x] Ran bundle exec rake default. It executes all tests and runs RuboCop on its own code.
[x] Added an entry (file) to the changelog folder named {change_type}_{change_description}.md if the new code introduces user-observable changes. See changelog entry format for details.

I'm wondering how likely it is in practice that someone would be using a string like nul or NUL, so we'd need to guard like this about the false positives. I was under the impression it's a good idea to detect references to NUL at least.
An alternative would be to make the cop configurable, so people could add/remove the mappings they want the cop to check for.

Let's also wait for @dvandersluis to weigh in on this before deciding on a solution.

I should have detailed explained properly before. I've chosen this approach for the following reasons:

Providing an option is one solution, but it is better to have a default that works without needing to configure anything.
It seems unlikely that the string nul would be used without /dev/null.
Since using only 'nul' without '/dev/null' might depend specifically on the Windows platform, portability is probably not a significant concern.
While '/dev/null' has a unique meaning, 'nul' does not.
For these reasons, I am considering how to provide this functionality effectively by default, rather than as an option.

On a side note, I often hear from users who are confused by many options. Also, providing options means taking responsibility for the option names and behaviors, and improving the default behavior offers the most freedom for future extensibility :-)

The string 'nul' isn't a null string so I'm curious what's going on in the original issue, and if it would make sense to just disable in that case. It's not perfect of course, but looking at GitHub code search the vast majority of 'nul' appears to be the windows null device.
To me, having a configuration option with an array of values would be simplest to handle this situation. I'd expect that very few users would actually need to change from the default.
That being said, if we want to go ahead with this change, I think 'NUL:' (with the colon) should be retained because that is only a representation of the windows null device (the colon is optional but aligns with C: etc for physical devices), and I do not see a case where there would be ambiguity there.

Ruby is widely used, and proprietary code is likely far more prevalent than open source software code. Moreover, the meaning of 'NUL' depends on the industry being served, so it is not within a predictable range. Considering usability, it would be advisable to provide a better default that minimizes false detections without options.
I agree that 'NUL:' can be considered similar to 'C:'. While NUL: is not as unique as '/dev/null', I have updated it for now to reduce only the false detections of 'NUL' that have been reported in the issue report.


Unable to Instantiate after Instant Run

This library is so helpful for debugging code! Thanks for making something great and sharing it with us developers :)
I have been running into a problem that I hope you can shed some light on. Currently, I have DebugKit running in a fragment. When I run new code via Android Studio's Instant Run, the debugger stops working and the window cannot be instantiated.
java.lang.IllegalStateException: Can not perform this action after onSaveInstanceState
    at android.app.FragmentManagerImpl.checkStateLoss(FragmentManager.java:1445)
    at android.app.FragmentManagerImpl.enqueueAction(FragmentManager.java:1463)
    at android.app.BackStackRecord.commitInternal(BackStackRecord.java:708)
    at android.app.BackStackRecord.commit(BackStackRecord.java:672)
    at com.hulab.debugkit.DevTool$Builder.build(DevTool.java:97)
    at stream.secretintro.IntroImportFragment$6.onClick(IntroImportFragment.java:230)
    at android.view.View.performClick(View.java:5685)
    at android.view.View$PerformClick.run(View.java:22481)
    at android.os.Handler.handleCallback(Handler.java:751)
    at android.os.Handler.dispatchMessage(Handler.java:95)
    at android.os.Looper.loop(Looper.java:241)
    at android.app.ActivityThread.main(ActivityThread.java:6274)
    at java.lang.reflect.Method.invoke(Native Method)
    at com.android.internal.os.ZygoteInit$MethodAndArgsCaller.run(ZygoteInit.java:886)
    at com.android.internal.os.ZygoteInit.main(ZygoteInit.java:776)

The DebugKit code is placed in the fragment's onCreateView.
Here is the code for the onSaveInstanceState:
    @Override
    public void onCreate(Bundle savedInstanceState) {

        super.onCreate(savedInstanceState);
        setRetainInstance(true);
        mContext = getContext();
    }

This problem makes it very difficult to use DebugKit effectively. Instant Run is much faster than a new build!

Hi @searchy2,
Thank you very much for your feedback and for reporting this issue.
I can't manage to reproduce this crash, could you show me exactly how you build the debug tool in your fragment's and activity's lifecycle?
Just looking at the stack trace, I think this is due to the fact that the tool is linked to the activity that initially created it.

Sorry for not replying sooner. I'll create a demo app to show this issue.

Closing this issue for now.


Errno::EBADF (Bad file descriptor)

hi, i created a new Rails 6 project, add byebug in a controller, and always get this error (even in the simplest WelcomController#index). Using byebug gem 11.1.3
Completed 500 Internal Server Error in 13ms (ActiveRecord: 0.0ms | Allocations: 108973)
Errno::EBADF (Bad file descriptor):
Can you help me get this going?

fyi i also tried $ byebug triangle.rb and get a similar error. Using ruby 2.6.6p146 (2020-03-31 revision 67876) [x64-mingw32] on Windows 10

I was using gitbash and geting the same error but as I use windows command prompt I did not get this error


[SUPPORT] Hudi logs error but does not fail job

Tips before filing an issue

Have you gone through our FAQs?
Yes

Join the mailing list to engage in conversations and get faster support at<EMAIL_ADDRESS>

If you have triaged this as a bug, then file an issue directly.

Describe the problem you faced
We are running a workload on AWS Glue. It reads some csv files from raw s3 bucket and writes data in parquet format in processed s3 bucket as a hudi table. Our Glue job completes successfully without any error and on looking at logs, we see this error message. No other stack trace or error details. We see .rollback file in the .hoodie directory.
2021-11-23 12:57:14,135 ERROR [Thread-5] hudi.HoodieSparkSqlWriter$ (HoodieSparkSqlWriter.scala:commitAndPerformPostOperations(655)): UPSERT failed with errors
Traced the block of code that is logging the error
HoodieSparkSqlWriter.scala:commitAndPerformPostOperations

Is there an option to enable tracing to get those error keys printed?
Expected behavior
If there is failure, glue job should fail providing some details on what caused the error.
Environment Description

Hudi version : 0.9.0

Spark version : 2.4.3

Hadoop version :2.8.5-amzn-1

Storage (HDFS/S3/GCS..) : S3

Running on Docker? (yes/no) : no

Hudi Config

SmallFileSize = 104857600
MaxFileSize = 125829120
RecordSize = 35
CompressionRatio = 0.1
InsertSplitSize = 3500000
IndexBloomNumEntries = 35000
BloomIndexFilterType = DYNAMIC_V0
BloomIndexFilterDynamicMaxEntries = 1400000
KeyGenClass = org.apache.hudi.keygen.ComplexKeyGenerator
RecordKeyFields = sourceid,sourceassetid,sourcetag,timestamp
TableType = COPY_ON_WRITE
PartitionPathFields = date,sourceid
HiveStylePartitioning = true
WriteOperation = upsert
CompressionCodec = snappy
CommitsRetained = 1
CombineBeforeInsert = true
PrecombineField = timestamp
InsertDropDuplicates = false
InsertShuffleParallelism = 100
WriteMarkerType = timeline_server_based
MarkerTSBBatchNumThreads = 20
MarkerTSBBatchIntervalms = 50
Any pointers on getting more information on errors would be immensely helpful.
Thanks.

Have been running into the same issue with hudi 0.8 and 0.9 with pyspark.
This seems relatively critical as it's causing batches of data to get silently thrown out.
To see the actual error message (at least with EMR), you have to edit /etc/spark/conf/log4j.properties file.
EMR automatically adds "log4j.logger.org.apache.hudi=WARN" in there, which causes the errors to not get printed

surprising that job succeeds despite the errors. I have not encountered this issue w/ spark-shell or deltastreamer locally as well as in EMR. but don't have exp with glue job.
@umehrot2 : Can you loop in someone to assist here please.

@jdattani : Do you know if this happens w/ datasource or deltastreamer directly? I could not reproduce this issue unless its very use-case specific. But general errors, my console or driver logs does print the errors. (spark-shell and spark-submit)

@jdattani : Do you know if this happens w/ datasource or deltastreamer directly? I could not reproduce this issue unless its very use-case specific. But general errors, my console or driver logs does print the errors. (spark-shell and spark-submit)

This happened for us w/ datasource. Haven't checked through deltastreamer. Was able to build hudi after enabling additional logging in the snippet originally shared (ws.getErrors) and found the exception to be "ArrayIndexOutOfBounds". It seems to be a specific use-case we have where we were getting an array field input as a string value that we were trying to cast to another datatype. This array could have variable number of elements for each row. And that somehow was causing an error at the time of writing to the hudi table.
However, the issue here seems to be in error propagation. Unless I'm missing something, I was expecting the job to fail instead of silently logging "UPSERT failed with errors" and continuing to finish Glue job execution successfully.

@jdattani to print the exact key that cause the error, the logging level needs to be changed to TRACE. Atleast on EMR, you can do it via /etc/spark/conf/log4j.properties and changing log4j.logger.org.apache.hudi=TRACE. I am not sure about Glue though, how the logging level can be changed for Hudi. As far as Hudi job not failing, it seems like a critical issue. I would recommend you to open a ticket with AWS Support and they should re-direct it to the team. This is not the right forum to further debug this issue.

@nsivabalan  this is a critical issue and will stop using deltastreamer use in production. Multitable deltastreamer job does not fail when processing multiple tables , if any table load fails,  multitable deltastreamer  continues to process remaining tables and ends with success status.


quick fix

Boolean errors

This final patch fixes some problems from the last one I pushed.

Is it possible to cut and paste the contents of stdbool.h into that area. I find that defining the value of true and false allows me to have pre-processor branches that check for the existence of bool. enumerating them prevents the pre-processors from checking if it exists.


Update tarbz2.go to account for recent API changes

The github.com/dsnet/compress packages now require a ReaderConfig
or WriterConfig to be passed in to NewReader or NewWriter.
A nil Config is guaranteed to always pass.

LGTM.

Woo hoo! Thanks, this was generous of you. 😃


Use a web worker to generate preview

Is it possible to spawn a webworker to generate the image previews, as currently the image previews block the main thread and make the ui unresponsive especially when uploading many large files.
Maybe BlobBuilder object can be used for this?

I did actually spend a lot of time trying to make use of web workers to improve the preview image generation.
Unfortunately, my final conclusion is that this is not feasible.
There are several problems:

Communication between the worker thread and the main thread works via copy operations.
There is a new API underway that will allow something similar to "copy by reference": Transferable Objects.
So far, no stable browsers version supports this interface yet.
Since we need to copy the data (at least until the new API is available), we have to load the entire file into memory on the main thread. Which means the web worker could only help in the scale transformation.
Neither any DOM methods (to load image files) nor the canvas API is available for web worker threads. Unfortunately, this removes the easiest way to retrieve and manipulate the image data of an image file.
Even if the new API would be available now, and we can get the binary data into the web worker thread without the copy overhead, there is the problem of different image formats (GIF, JPG, PNG, etc.) that we need to support to transform the image.

In the end I found a different solution that keeps the main thread responsive, even while doing resize operations on 20MB big image files. The solution that worked for me (in my tests) is simply doing the operations in sequential order, with the help of jQuery.Deferred.
You can test it on the demo page, which is set to resize images bigger than Full HD resolution and will also create preview images.


bug([mat-tab]): unable to use space in an input within mat-tab-label

Reproduction
Steps to reproduce:

Open this URL : https://angular-akfnab.stackblitz.io
Try to write something into input box with space character.

Expected Behavior
Expected to be able to use space character in the input box
Actual Behavior
I can type anything but space character.
Environment

Angular: 9.0.0
CDK/Material: 9.0.0
Browser(s): Chrome
Operating System (e.g. Windows, macOS, Ubuntu): Windows & Mac

It looks like your example is throwing errors.

Please check it again.
Thanks
https://www.avast.com/sig-email?utm_medium=email&utm_source=link&utm_campaign=sig-email&utm_content=webmail&utm_term=icon
Virus-free.
www.avast.com
https://www.avast.com/sig-email?utm_medium=email&utm_source=link&utm_campaign=sig-email&utm_content=webmail&utm_term=link
<#DAB4FAD8-2DD7-40BB-A1B8-4E2AA1F9FDF2>
On Wed, Apr 29, 2020 at 12:15 PM Kristiyan Kostadinov <
<EMAIL_ADDRESS>wrote:

It looks like your example is throwing errors.
—
You are receiving this because you authored the thread.
Reply to this email directly, view it on GitHub
https://github.com/angular/components/issues/19190#issuecomment-621314017,
or unsubscribe
https://github.com/notifications/unsubscribe-auth/AF7MAS3JX46BLXDWFE3HS7DRPBHC5ANCNFSM4MSKMCAA
.


Fixed exception checking in metadata watcher.

[Current coverage][cc-pull] is 98.40%

Merging [#294][cc-pull] into [development][cc-base-branch] will decrease coverage by <.01%

@@           development       #294   diff @@
=============================================
  Files               34         34
  Lines             2634       2632     -2
  Methods              0          0
  Messages             0          0
  Branches           131        131
=============================================
- Hits              2592       2590     -2
  Misses              37         37
  Partials             5          5

Powered by Codecov. Last updated by [e0064e2...f5a3c95][cc-compare]
[cc-base-branch]: https://codecov.io/gh/GoogleCloudPlatform/compute-image-packages/branch/development?src=pr
[cc-compare]: https://codecov.io/gh/GoogleCloudPlatform/compute-image-packages/compare/e0064e2a4e1fbde7466d9a886cb0cf27865563ad...f5a3c95fc81ad51aa83f8914e0e4a42d495e0fdd?src=pr
[cc-pull]: https://codecov.io/gh/GoogleCloudPlatform/compute-image-packages/pull/294?src=pr


ModuleNotFoundError

First of all, thank you for your excellent work. I run eval__ hpatches after installing the environment, there is a ModuleNotFound Error:
ModuleNotFoundError: No module named 'third_party.caps.CAPS'
I think it may be the problem of submodules. Some submodules can be imported normally, such as d2net, r2d2

Hi @FlyFish-space,
Did you manage to solve the issue? If not can you show me the tree of you third_party/ directory?


Building cargo 1.19.0 fails with assertion `!dep.m_optional'

With 1af51991c707e59979a244320b9264e8c1230925, building cargo fails:
minicargo: manifest.cpp:595: void PackageManifest::load_dependencies(Repository&, bool): Assertion `!dep.m_optional' failed.

Can you provide more context? E.g. the debug output from before this assertion failure, and what platform you are running on.

Eh, I wouldn't think that matters, but:
Debug output: https://gist.github.com/b9bc920b0ed7e31cea3811af6ef2409d
To build, I am doing:
mkdir script-overrides
echo -e 'cargo:rustc-cfg=stdbuild\ncargo:rerun-if-changed=build.rs' >script-overrides/build_libc.txt

local libname
for libname in libstd libpanic_unwind libtest; do
	einfo "mrustc: Building $libname"
	minicargo src/$libname --script-overrides script-overrides
done

einfo "mrustc: Building rustc"
CFG_COMPILER_HOST_TRIPLE="x86_64-unknown-linux-gnu" \
LLVM_CONFIG=/usr/bin/llvm-config \
CFG_RELEASE="1.19.0" \
CFG_RELEASE_CHANNEL=stable \
CFG_VERSION="1.19.0" \
CFG_PREFIX=mrustc \
CFG_LIBDIR_RELATIVE=lib \
minicargo src/rustc --vendor-dir src/vendor

einfo "mrustc: Building cargo"
minicargo src/tools/cargo --vendor-dir src/vendor

mrustc and minicargo are compiled with CXXFLAGS: -march=haswell   -mabm -mrtm  --param l1-cache-line-size=64 --param l1-cache-size=32 --param l2-cache-size=8192  -O2   -fno-reorder-blocks  -pipe  -ggdb3 -std=c++14
To adapt minicargo to a system install, I had to modify it with: sed -i 's/"\.\.\/\.\.\/bin\//"/' tools/minicargo/build.cpp

Confirmed. Looks like the backtrace crate has an optional build dependency, which was thought to not be allowed.

Fixed in 69e7babc3bf5e7cfa86295bfa4cb139b79627a8b


how to train SegmenationFree-Inception.caffemodel?

HorizonalFinemapping.caffemodel
HorizonalFinemapping.prototxt
SegmenationFree-Inception.caffemodel
SegmenationFree-Inception.prototxt

HorizonalFinemapping.caffemodel is a basic regression network, you can reference mtcnn-onet structure.
SegmenationFree-Inception.caffemodel you can reference the training code provided by ReadMe.

HorizonalFinemapping.caffemodel is a basic regression network, you can reference mtcnn-onet structure.
SegmenationFree-Inception.caffemodel you can reference the training code provided by ReadMe.


Workaround for PCVR depth submission

This is a partial fix for the issue discussed in #420
The issue was coming from RenderWrapper.cs, where an offscreen render texture is created so it can be reused and rescaled for performance when using the video recording tools. I'm not entirely sure why this is breaking our XR pipeline, as it appears the render texture is created properly.
As a stopgap, we keep using the normal camera, but switch to the offscreen render during recording.
This may be magically resolved when we upgrade Unity versions.

Confirmed working by @mbucchia, thanks!


compound ingest rules

to discuss when we start to work on compound workflow
image + image -> universalviewer
image + pdf -> universalviewer
pdf + pdf -> universalviewer
image1 + transcript1 -> universalviewer
image1 + transcript2 -> universalviewer
image + audio -> universalviewer
image + audio1 + transcript1.vtt -> universalviewer
pdf + audio1 + transcript1.vtt -> universalviewer
all other kinds of compounds
kaltura compobunds check if you have ONLY audio, video, corresponding vtt files. can't contain anything else.
audio1 + transcript1.vtt -> kaltura
audio1 + transcript1.vtt + audio2 + transcript2.vtt -> kaltura OR universalviewer?
audio1 + audio2 -> kaltura OR universalviewer?
video1 + transcript1.vtt -> kaltura

this ticket is more relevant to @jrynhart


feat: add Typing context manager

At the request of Astrea
What type of pull request is this?

[x] Non-breaking code change
[ ] Breaking code change
[ ] Documentation change/addition
[ ] Tests change

Description

Adds the afforementioned typing context manager
Syntax:
channel = await self.fetch_channel(948781911948558388)

async with Typing(channel):
    await asyncio.sleep(30)
    await channel.("test")

Alternate syntax:
channel = await self.fetch_channel(948781911948558388)

async with channel.typing:
    await asyncio.sleep(3)
    await channel.send("test")

Changes

Adds models/misc/context_manager.py
Adds Typing model
Adds Typing model to root namespace
Add typing property to MessagableMixin

Checklist

[x] I've formatted my code with Black
[x] I've ensured my code works on Python 3.10.x
[x] I've tested my code

/ok-to-test


Allow specifying custom type mappings

Here is a diff between the generated models.rs and after I manually adapted it to how I need it:
6c6,12
< use chrono::NaiveDateTime;
---
> // <manually-inserted>
> use chrono::{DateTime, NaiveDate, Utc};
> use diesel::Queryable;
> use uuid::Uuid;
>
> use crate::models::org::UserEventResourceType;
> // </manually-inserted>
119c125
<     pub due_date: NaiveDateTime,
---
>     pub due_date: DateTime<Utc>,
153,154c159,160
<     pub name: /* TODO: unknown type Citext */,
<     pub description: Option</* TODO: unknown type Nullable<Citext> */>,
---
>     pub name: String,
>     pub description: Option<String>,
156c162
<     pub created: Option<NaiveDateTime>,
---
>     pub created: Option<DateTime<Utc>>,
932c938
<     pub resource_type: /* TODO: unknown type User_event_resource_type */,
---
>     pub resource_type: UserEventResourceType,
946,947c952,953
<     pub old_value: Option<Jsonb>,
<     pub new_value: Option<Jsonb>,
---
>     pub old_value: Option<serde_json::Value>,
>     pub new_value: Option<serde_json::Value>,

As you can see, in order to fully generate this, I'd need to

Be able to specify custom imports
Be able to specify custom type mappings. E.g. I want to map Citext to String (and Nullable<Citext> to Option<String>), Timestamptz to DateTime<Utc> (instead of NaiveDateTime), and User_event_resource_type to my custom enum type UserEventResourceType (generated by diesel-derive-enum), and Jsonb to serde_json::Value.

I suggest a similar format for specifying these, as with diesel_cli: Via cmd flags of the same name (e.g. --import-types="crate::models::org::UserEventResourceType"):
http://diesel.rs/guides/configuring-diesel-cli/
Or with a config file. But please also have the cmd line flags. And option to specify the config file path with --config-file.

this could be useful!

@abbychau I suggest the following format for the cmd line flags:
E.g. --map "Citext: String, Timestamptz: DateTime<Utc>, User_event_resource_type: UserEventResourceType, Jsonb serde_json::Value"
but ALSO accepting multiple --map args like:
--map "Citext: String" --map "Timestamptz: DateTime<Utc>" --map "User_event_resource_type: UserEventResourceType" --map "Jsonb serde_json::Value"
Because: In our project we have multiple postgres schemas and thus multiple schema.rs files, and we have shell scripts to generate the schema using diesel cli, passing some of the same args to the diesel print-schema calls. But our schemas use some common types. So with the --map "A:B, C:D" way, we could store that string in a bash variable for mappings that are the same for all diesel_cli_ext calls (diesel_cli_ext model --map $COMMON_MAPPINGS), and we could still add individual mappings to individual calls with more --map "A:B" args.
I suggest a similar format for specifying imports:
Allowing both --import-types="foo, bar" and --import-types="foo" --import-types="bar" (and combinations of those).

i will work for a version of named params with config file first

map is done in version 0.2.2 / 0.2.3
usage: diesel_cli_ext --map "Citext String" --map "Intk i64"
feel free to raise another issue for more usages


ChatSdkMainActivity hangs when number of threads are too high

We are using ChatSDK in our android application to add "Tutor-Student" chat feature. Work flow is as follows,

When ever user logs into our app, a rest API is called which creates the firebase data which is required for following use case,

This newly logged in user should have a friend added by default which is tutor
This user should receive a message from tutor "Hi, This is your tutor. How may I help you ?"

When ever user enters ChatSDKMainActivity, he/she should be able to see Tutor thread with default message.

Our implementation is working fine.
Issue :-
We are facing an issue with this implementation. When ever we login from tutor's account we see that there are more than hundreds of threads created. But Tutor account is not able to load those threads efficiently. We have seen following issues,

when number of chats exceed a certain number N, chats stops refreshing the new messages
If a new message is arrived in tutor's account neither push notification is shown nor new message in seen in respected thread.
Sometimes Mobile screen becomes black on ChatSDKMainActivivy
Contacts list does not show any contact on Tutor Account
Application crashes with following exception,
ANR in com.study.copter.ibps
PID: 8180
Reason: Broadcast of Intent { act=com.google.android.c2dm.intent.RECEIVE flg=0x10 pkg=com.study.copter.ibps cmp=com.study.copter.ibps/com.braunster.androidchatsdk.firebaseplugin.firebase.backendless.ChatSDKReceiver (has extras) }
Load: 8.26 / 8.02 / 7.65
CPU usage from 0ms to 5199ms later

Can you please provide some help what could possibly have been the reason for all these issues ?

Fixed in v4.0.


spoken or written?

The readme does not state whether this uses the spoken or written Japanese variant of Unidic, but it would be ideal to be able to choose which one is downloaded.

This is UniDic for Contemporary Written Japanese, I have added a note to the README.
I have never needed the one for spoken Japanese, and I think I've had a request for it maybe once before this, so I'm not inclined to package it. But if someone else wants to I'd be happy to link to it from the README, for example.

I sort of assumed that it would be the much better choice for most internet or popular media (tweets, blogs, manga, movie subtitles, etc.). My issue is that I can't find any quick way to test it out, and I haven't seen any demos or anything, so I don't actually know if I'm missing out on improved accuracy in my domain.
If my project budget allows, I'll try to open a new branch that uses the spoken Unidic and then do some comparisons. After that, I'd be happy to send a PR, or else just leave the branch up publicly.

That makes sense. If you just want to test spoken UniDic you don't need to package it like I have CWJ UniDic here - you can just download it, unzip it, and specify the path directly using MeCab (-d dicdir).

Took me down a rabbit hole a bit, but I've found that for colloquial expressions the older Unidic versions seem to give slightly better segmentations than the newest ones. So I'll just use your unidic-lite package for now.

OK, got it.
Since there is nothing for me to do here I'm going to close this, but if anyone packages other UniDics feel free to let me know.


PyVista._vtk doesn't have a vtkPNGReader attribute

🔍 Before submitting the issue

[X] I have searched among the existing issues
[X] I am using a Python virtual environment

🐞 Description of the bug
I'm trying to run the basic elbow examples but I keep getting this error:
File "D:\OneDrive_ANSYS\OneDrive - ANSYS, Inc\examples\PyPrimeMesh.venv\lib\site-packages\ansys\meshing\prime\graphics\graphics.py", line 609, in __update_bt_icons
r = _vtk.vtkPNGReader()
AttributeError: module 'pyvista._vtk' has no attribute 'vtkPNGReader'. Did you mean: 'vtkPLYReader'?
I have the latest pyvista installed.
📝 Steps to reproduce
Try to run :
python elbow.py
in a venv with the latest ansys-meshing-prime[all]
installed with pip.
💻 Which operating system are you using?
Windows
📀 Which ANSYS version are you using?
23R1
🐍 Which Python version are you using?
3.10
📦 Installed packages
ansys-api-meshing-prime==0.1.1
ansys-meshing-prime==0.3.1
appdirs==1.4.4
certifi==2023.5.7
charset-normalizer==3.1.0
contourpy==1.0.7
cycler==0.11.0
fonttools==4.39.4
grpcio==1.54.2
idna==3.4
kiwisolver==1.4.4
matplotlib==3.7.1
numpy==1.24.3
packaging==23.1
Pillow==9.5.0
platformdirs==3.5.1
pooch==1.7.0
protobuf==3.20.3
pyparsing==3.0.9
python-dateutil==2.8.2
pyvista==0.39.1
requests==2.31.0
scooby==0.7.2
six==1.16.0
urllib3==2.0.2
vtk==9.2.6

Closed by #487


org settings: Add column for "role" under org settings->active-users.

This is a followup of https://github.com/zulip/zulip/pull/10141#issuecomment-414794589 which adds a column for "role" under "Organization Settings" tab  -> "Users" section

Here we have temporarily added a bolt sign against admins so can remove that too.
@zulipbot label "area: settings (admin/org)" "help wanted"

@zulipbot claim

We might want to move the "Deactivate" buttons to the edit modal widget to make space for the new column.


Error on loading mod

Describe the bug
Extended Cogwheels (extendedgears) has failed to load correctly
To Reproduce
Steps to reproduce the behaviour:
1: launch minecraft with mod
2. (that's it)
Expected behavior
When Minecraft finishes loading to the main menu after launch, the error with appear
Loader & Other Mods:

Forge - 43.2.21
Create - 1.19.2-0.5.1.c.jar

Additional context
crash-2023-07-20_11.10.31-fml.txt

Your seem to be using the version for before 0.5.1, Beta releases for the patch have just been uploaded on the discord server and will be moved to curseforge & modrinth later today

sorry


k8s deployment restart causes brief outage with cilium and kubeProxy disabled

Bug report

General Information

Cilium version : 1.9.8
Kernel version : 5.8.0-1035-aws #37~20.04.1-Ubuntu
Orchestration system version in use: k8s v1.20.7 (running on AWS setup with kops 1.20.1)

How to reproduce the issue

Install k8s 1.20.7 with kops (1.20.1) on AWS
Disable kubeProxy and enable Cilium nodeport : kops cluster spec:

 kubeProxy:
   enabled: false
[..]
 networking:
   cilium:
     enableNodePort: true

Create a deployment with spec:

  type: LoadBalancer
  externalTrafficPolicy: Local

When I rollout restart the deployment, there is a brief outage because it seems like with cilium enabled with KubeProxy disabled, traffic continues going to the pod that has been set in Terminating sate by k8s.

When I rollout restart the deployment, there is a brief outage because it seems like with cilium enabled with KubeProxy disabled, traffic continues going to the pod that has been set in Terminating sate by k8s.

It looks like that service endpoint deletion events are lagging behind. Was your system under a load? Is it reproducible?

When I rollout restart the deployment, there is a brief outage because it seems like with cilium enabled with KubeProxy disabled, traffic continues going to the pod that has been set in Terminating sate by k8s.

It looks like that service endpoint deletion events are lagging behind. Was your system under a load? Is it reproducible?

Yes it is reproducible. And no; system was not under load. It is an empty new cluster.

Could you provide a sysdump? Also, how long is the outage? Do you send requests from outside the cluster? TCP or UDP?

Could you provide a sysdump? Also, how long is the outage? Do you send requests from outside the cluster? TCP or UDP?

The service is a LoadBalancer (AWS Classic ELB). The HTTP requests are coming from outside the cluster.
The sysdump is very large and has a lot of information from the cluster. Is there something specific in there that I can easily sanitize and upload? Thanks

Maybe you could enable debug mode (--set debug.enabled=true or just debug: true in the ConfigMap), restart cilium-agent, do the deployment, take a timestamp and then provide cilium-agent logs around that time?

Closing the issue due to becoming stale. Please reopen if the issue persists.


Custom cookie name on firewall

This issue reopens #89 because here is solution: pass 3d $options parameter (e.g. ['name' => 'CUSTOMNAME']) to SessionProvider's constructor. Take a look at protected function setOptions(array $options)

Here is example:
# services.yml
 gos_web_socket.ws.server:
        class: Gos\Bundle\WebSocketBundle\Server\Type\WebSocketServer
        public: false
        lazy: true
        arguments:
            - ...
            -<EMAIL_ADDRESS>
# WebSocketServer.php
...
new SessionProvider(
    $wsServer,
    $this->sessionHandler,
    ['name' => $this->sessionStorage->getName()]
),
...


Poll about build System

I'd like to know your opinion about the build system that should be used for this. Would you like to change it to Gradle (Kotlin DSL) or stick with Maven?
Please leave your thoughts (rationale for your preferred option is appreciated)

IMO It's all based on preference. I use maven for my work, and thus I don't know much about Gradle.

Thanks for commenting. Gradle is less verbose than maven and can speed up build times (mainly due to an ever runnig daemon). However, my background comes also from maven. Although gradle is much more concise, I've found in the past difficult to achive cretain thins that are trivial and maven.

I've just uploaded gradle scripts. By now I will keep both maven and gradle.


added a comment to let beginners know about the assert function in python

@tejas-kr ,
Is this really necessary?

yes the beginners don't know about this assert statement

Well, I think it is unnecessary, because it is not about logic but just python grammar.

I believe it is safe to assume that users know what assert is :)

ok as you wish


When adding preheat, the incoming scheduler-cluster of the request and the scheduler-cluster of the response data are different

Bug report:
API:

requset:

response:

API:

response:

API:

response:

Expected behavior:

How to reproduce it:

@Liam-Zhao Your cluster has no active scheduler.


Auth support

Add SAML auth support.

Changing this to be more generic. Will likely have a few auth options with the first being LDAP support.

LDAP support is now live in dev branch, closing this out.


Is the output shape calculation correct for 2d convolutions?

I was recently looking at the code for Conv2d convolutions to check the output shapes for a model I'm building
https://github.com/awslabs/djl/blob/97fce77e51e61e649906d37a1722f2c9e0678c08/api/src/main/java/ai/djl/nn/convolutional/Conv2d.java#L41-L49
However, in the code this calculation isn't quite correct according to the documentation
https://github.com/awslabs/djl/blob/97fce77e51e61e649906d37a1722f2c9e0678c08/api/src/main/java/ai/djl/nn/convolutional/Convolution.java#L162-L168
The dilation and stride only ever use the 0-index rather than the i-index as used for the kernel and padding values. Whilst this is OK for square shapes, this could be an issue for other shapes.
The same also applies to the new deconvolution code but for stride and padding this time
https://github.com/awslabs/djl/blob/97fce77e51e61e649906d37a1722f2c9e0678c08/api/src/main/java/ai/djl/nn/convolutional/Deconvolution.java#L142-L146
I wanted to check that this was a real issue before looking at contributing a fix

Yes you are right. Stride & Dilation should also change along with i variant. Would you like to submit a PR to fix it.
You can check reference calculation here.

sure - just checking out the contributing guidelines now

The code for the Deconvolution also appears to be missing the dilation component too and not handling the kernel size correctly
See here for the Conv2dTranspose, i.e
outHeight = (inHeight − 1) × stride[0] − 2 × padding[0] + dilation[0] × (kernel_size[0] − 1) + output_padding[0] + 1
outWidth  = (inWidth  − 1) × stride[1] − 2 × padding[1] + dilation[1] × (kernel_size[1] − 1) + output_padding[1] + 1
What's the projects preference on this - fix it in this issue's PR or raise a separate one for just the Deconvolution logic?

@docrozza You can fix it all in one PR


Basic Auth Implementation

@GGGuenni, can you review this?

@oynqr also

@GGGuenni @oynqr, I have done a lot of tests on it and found no problems.
Will merge it when @GGGuenni fixes unintentional Gzip on the PUT /auth request body.
Do tell me if you notice any errors in the meantime!!
Also @oynqr I am using argon2id for this pr.

I think with https://github.com/touhidurrr/UncivServer.xyz/pull/5/commits/dd4a2443d3f104cda0acff056141e8d55e70ecbc, we can merge this.


feat(Popover): accept function as a children

Now Popover can accept function as children.
Fixed bug in the Popover (when focused on Popover button, unable to open tooltip with Enter)

@Kyzyl-ool Resolve the conflicts please


[Security] JsonWebToken Lifecycle Concerns; Set HttpOnly = true in JWT cookie

Currently the JsonWebToken ("JWT") is returned without the HttpOnly flag. Consequently, client side script can access the JWT. This introduces a theoretical XSS vulnerability.
Consider the security implication of allowing client side access to the JWT in this scenario:

A bad actor somehow injects a script a client-side script into your app (how it got in could be a wide range of possibilities, given the flexible nature of feathers framework. e.g., somehow some bad client JS code ends up being inserted in a database, and is now served in all client requests). In the script, the hacker inspects localStorage, read the feathers-jwt cookie (if httpOnly is false), and send a POST request to www.badactor.com/xss, and now have a copy of the end user's JWT. The hacker can then issue requests to the application server, authenticated as the end user.

This example illustrates the broader concern of authentication architecture within Feathers, specifically the lifecycle of the JSON Web Token. It's critical to be highly specific in the implementation to mitigate certain attack vectors. JWT's are permitted to be transported and stored through a number of options in feathers, e.g., headers, cookies, query parameters, localStorage, etc. A unique set of security concerns are introduced to each application. The documentation does address the tradeoffs of the transports.
If you set HttpOnly to true, and enforce an architectural pattern of limiting the JWT to cookies, you can effectively mitigate XSS. If the JWT is placed in localStorage, the XSS vector isn't mitigated because localStorage can be read by client side script (which is kind of the point of localStorage, making it a less than ideal place for JWT's to live).

Doesn't putting the token in a cookie actually make JWT less secure?  Cookies are automatically sent with every request, so now we're back to being vulnerable to the attacker not needing to even get access to the JWT token in order to make API calls.

The cookie value will only be set once when loading the app after a login and I'm not sure it can be HTTP only because the JS app needs to access it in order to make requests using the JWT. We decided that sending it in the cookie is still safer than the current general practice of putting it in the callback query string.  I am also not sure if there is any place other than LocalStorage where the JWT could be stored.
An alternative would be as you suggested to create an HTTP only cookie value for the JWT with the same expiry as the JWT (sounds almost like a session to me ;). This should work in pretty much any browser environment and for non-browser environment we are not doing the redirect anymore so I think this is the best way to go now.

(sounds almost like a session to me ;)
Exactly my thoughts.

@marshallswain Well basically we are trading sending the token in the Authorization header for putting it in the Cookie header. So there really isn't that much of a difference except for that the browser manages HTTP only cookies (and sending them in the header) more securely.

It seems I remember reading that Auth0's solution, when this kind of problem is a concern, is to keep the token life/expiry short and use refresh tokens.

A bad actor somehow injects a script a client-side script into your app

It seems like this would be a more important focus.  If you get a script on your page, especially if it's targeted, you no longer own your JWT (unless you're not using it on the client, which kinda defeats the purpose).

I'm hoping I'm not coming across as mean, here.  You can never review security policy enough, so this is super important discussion.

@marshallswain Not at all! I think everyone in here is valuing the necessity of the conversation.
CSRF tokens are the solution to the concern in your first comment in this thread, and you'd need to use them in conjunction with the HttpOnly cookie.
Regarding inject scripts: With feathers, the vector for injecting script is quite large since feathers isn't all that opinionated about your stack. Feathers supports many ORM's, and any front end framework. In a more concrete case, suppose I'm using MySQL with a Sequelize ORM and React for my presentation layer. I suppose we'd have to assume that my ORM is sanitizing input and removing scripts (I don't believe it does), and we're assuming React won't inject scripts into the DOM (it won't). I will admit, the possibility for injecting scripts is low. But you're essentially saying, we're leaving it to our ORM's and to our client side frameworks to secure our JWT. What I'm suggesting is, let's assume someone can inject malicious client side code and your JWT is still safe in that exception circumstance.

Hmm. Okay. I'm going to have to think about this a bit. As @daffl mentioned we do actually use a script to pick up the JWT from the cookie and set it in localStorage (especially in the case of OAuth). I only have one possible solution involving websockets, other than the query string method which is even less secure, that might work.
Short of supporting shorter lived tokens and/or the ability to revoke tokens this might be something that we just need to document as making sure that you are not allowing XSS.
@daffl I don't think I followed what you were proposing for a solution.

Upon doing some research, HttpOnly cookies should be fine for websockets.
From http://tools.ietf.org/html/draft-hixie-thewebsocketprotocol-74:
   9.   If the client has any cookies that would be relevant to a
        resource accessed over HTTP, if /secure/ is false, or HTTPS, if
        it is true, on host /host/, port /port/, with /resource name/ as
        the path (and possibly query parameters), then HTTP headers that
        would be appropriate for that information should be sent at this
        point.

If this is the case, is it necessary to place the JWT in localStorage?

@petermikitsh we store the JWT in localStorage so that you don't have to get the user to authenticate every time you load the page if you already have a valid auth token. Sort of like a "remember me" cookie. If you are concerned about that and are using sockets then you can just set a short TTL on your auth token. The socket will stay authenticated until it is disconnected or unauthenticated on either the server side or the client side.
The cookie really only gets used in the case of OAuth, because with OAuth you have a series of redirects before you know whether you are authenticated and your only option of getting the token back to the client is to send it in the query string to the final redirect, or send it in the cookie. This is where I have one other idea using sockets to send back the token securely. Using HTTPS, sending it in the cookie is much more secure, since URLs can be logged by any intermediate agent regardless of whether you are using HTTPS. The cookie does also get used with local auth if you are just doing form posts but really I recommend using Ajax or sockets to authenticate and then the cookie is never sent.
Frankly, now that I've had time to think about this I would argue that even if you don't use the cookie and are running JS in your page then you are susceptible to XSS attacks. If using sockets, even though the token is passed securely via messages using HTTPS you could have a malicious script listening for the authenticated method and then log the JWT somewhere for use later.
The only way I see this really being prevented it twofold:

Make sure you can't have a malicious script on your page (that's sort of up to the developer imho and what you should get paid the big bucks for)
Use shorter lived tokens with the ability to revoke them (https://github.com/feathersjs/feathers-authentication/issues/73), as well as when a user logs out their token is revoked (#133).

To follow this up, the fine people at Auth0 have addressed the XSS concern quite well imho and I entirely agree. If you are susceptible to a XSS attack then it's pretty much open season in any app. You could log passwords, credentials, etc. None of that is really all that specific to Feathers and is something that you need to be aware of and protect against in any app. See:

https://ask.auth0.com/t/stealing-jwt-from-authenticated-user/352/3
https://auth0.com/blog/2014/01/27/ten-things-you-should-know-about-tokens-and-cookies/

One thing we may want to do though, is have a built in hook that runs on every POST, PATCH, PUT request and escapes script code rather than relying on making sure the ORM or the developer handle it.

@petermikitsh  Regarding this comment:

What I'm suggesting is, let's assume someone can inject malicious client side code and your JWT is still safe in that exceptional circumstance.

Since the token needs to be passed with every request (with the exception of sockets, maybe), and since it's possible for a script to intercept and analyze the contents of every request, there's not really a way to prevent the JWT from getting stolen once there is a rogue script on your page, unless you're not using a client-side framework at all.  Unless there's a way to completely prevent native objects from being overwritten.  Is there?

One thing we may want to do though, is have a built in hook that runs on every POST, PATCH, PUT request and escapes script code rather than relying on making sure the ORM or the developer handle it.

Good idea.  I made an issue in the main repo.

@ekryski Thanks for the links to auth0, good discussion there. Implementing short-lived tokens with token revocation functionality, while allowing the token to remain in localStorage, may be the best balance of concerns. Kept in localStorage, you also don't need implement CSRF protection either, which is a nice plus.
@marshallswain I believe the JWT cookie (once authenticated) would be passed with every HTTP request, and based off reading the spec, that would hold for websockets as well. Client side scripts (malicious or otherwise) wouldn't be able to intercept or analyze HTTP-Only cookies, as they can only be issued and read by the server. Since it sounds like we're sticking with localStorage, that's a moot point.

I believe the JWT cookie (once authenticated) would be passed with every HTTP request, and based off reading the spec, that would hold for websockets as well.

@petermikitsh we could set the cookie's TTL to instant expiration so then it won't get passed. For websockets it would only happen if the cookie is alive and whenever a new socket connection is made. I think we've come up with a good plan here. I'll see what I can do...

I'm still thinking that one actionable item here would be to change the JWT cookie value to HTTP only and the server also reading that value additionally to the Authorization header. Even though it sounds a little bit like a session we're just trading one header for another (that is securely managed by the browser instead of the application). This should work in any browser environment and also be backwards compatible.

While I do agree that it's making the token more secure to use a cookie, it would make our apps less secure in general.  I really don't like the cookie idea.
If you have a cookie set in your browser, now a malicious script on any other website can make calls without a token and the browser will send that cookie along and the request gets treated as though you put your stamp of approval on it since your token's in there.  With cookies, the attacker doesn't even have to go through the effort of stealing your JWT token.  We've made it even easier for them to do the thing we're trying to prevent.  If we keep it out of a cookie, they have to explicitly steal your token.

If we're using cookies with the new auth plugin, we probably need to figure out a way to guard against that.

Would it be possible to add CSRF protection in feathers? It would completely mitigate that concern of using a cookie, where a rogue site you visit creates requests on your behalf that you didn't intend to.

In order to implement CSRF protection, we would need a way of associating the app that actually does the authenticating with the JWT token.  I can think of a couple of possible options for increasing security.  One of them is just a potential improvement in general security, the other is viable as a CSRF-esque protection mechanism:

IP Address - When a token is created, we include the IP address in the payload.  This will work great with IPV6, since every device gets its own IP address, but with IPV4 and NAT overloading, it's not going to protect from attacks in the same building or cell tower.  Also, since your IP address can potentially change during handoff from one cell tower to another, you'd no longer be authenticated after switching towers.  That's only an IPV4 problem, still, but most of the world is still using IPV4.  Either way, won't protect against attacks from other websites on your same computer, so not really a CSRF solution, even with IPV6.  It does address the scenario you mentioned where they try to send the token to a remote server that harvests tokens.

Client-generated passphrase The client could generate a hash and pass it to the server upon authentication.  That passphrase would need to be included in the token payload, as well.  The client would have to hold on to it, at least in memory, and include it with every request.  So now both the token and passphrase have to travel together.  The server would decode the token, check its validity, then compare the two passphrases.  This would effectively associate the token with the app itself, not just the device.  At this point, the token can't be stolen, since it's in an HttpOnly cookie.  The passphrase could still be stolen, but without the token it's useless.  It's not quite a session, since the server doesn't have to store any user data, so we still have that benefit in place.  For scaling, the servers would all have to be configured to pass this passphrase and token around together in order to authenticate with each other on behalf of the current user, which isn't much different than what we're doing already.  This actually seems like a pretty cool solution, to me, but what am I not thinking of?  The passphrase would only be valid while the token is valid.  We can store the passphrase in localStorage for the remember-me feature, which still keeps it so that other sites on the same computer can't use the cookie/token.  The only problem (that I can think of) left unsolved is the scenario where you get a rogue script on your page, but I think that's the equivalent of a hacker having physical access to a machine.  If you can get physical access to a machine, you own the machine.  If you can get a script onto the page, you own the page.

Anyway, everybody please find the loopholes.

HTTP only cookies removes two of the main benefits of JWTs:

The ability to use the same token across several domains, including the idea that you can offer tokens from a centralized server or tenant and use them across a plethora of non-host services.
You can decode a JWT client side and use it as an indicator for scopes, for example: You can read it using JavaScript web app, see the "permission roles" or whatever, and render the page accordingly, i.e. only shoing the admin options to those with admin role.

*#2 there isn't about security on the client side, they may be able to hack the client to "see" the admin interface, but the token would then be invalid when the server verified them for any admin action.
The trade off of losing these 2 extremely useful benefits (especially #1 in a micro-service world) is JWTs vulnerability to XSS (which really screws you over regardless if you are using sessions or not, ie key-loggers on password fields), but comes with the added benefit of being immune to CSFR, and therefore don't nee the awareness or machinery of CSFR-tokens.
This is all of course, inherent with JWT and is certainly not feathers specific.
In light of these trade-offs, I prefer the JWT tokens to be available to the client (specifically JavaScript) and not stored in a cookie with the HTTP-only option.
If any action is taken, it should be optional, or at least reversable.

@marshallswain I think your IP based solution limits JWTs way more than they should, restricting valid login to a machine rather than just a domain, it seems like a mistake, unless I misunderstand
You Client-generated passphrase is interesting, but let me see if I understand it.

token is stored in http-only cookie
passphrase is stored in localstorage (for a web-based example)
every request sends both
you need you passphrase in the request and token on the cookie to validate

Therefore:

CSFR is an incomplete attack vector because you need a passphrase still
XSS is an incomplete attack vector because you need a token still (can't get from JS in a browser)
The passphrase needs to be stored somewhere (database?) and available to all services, requiring a DB read for validation (just like cookie based sessions)
You are still limiting the ability to use the token across different domains
You still limit the client from reading the token for rendering/client side user knowledge

Though this may be a strategy for removing the need for CSFR-tokens, it doesn't seem to have much benefit over traditional sessions other than that.
You may be able to actually remove my last point, client side token read, but storing the token client side, with a hashed version of the passphrase, and store the passphrase in the http-only cookie. Which may tip it closer to a good solution for me.
...but I still prefer the domain flexibility offered by JWTs, at the expense of being slightly more vulnerable to XSS (meaning the XSS could happen at any time to be effective, not just before login, which kills all the aforementioned strategies anyway).

...also I forgot to mention, the "standard" JWT strategy removes the need for a DB call on every request, just to check user-creds, which is another benefit undone by the proposed solution

Yeah, @BigAB, that's exactly the kind of loophole in my thinking that I was looking for.  There are no client-side advantages over cookies/sessions to the cookie idea.  You still get the advantages on the server, though, since you can just decode the token, right?  The passphrase is in the token, so you don't need to make the call to the db.

Point number 1 that you make is a bad deal for the huge majority of apps.  Point number 2 sounds scary.  You'd have to have the token secret on the client to decode it there.  But I suppose it has its applicable scenarios.

If the passphrase is not user specific, then it is the same as the "secret" already used by JWTs, and becomes redundant.
(unless I misunderstand, which is quite possible,because I am totally sick right now)

You don't need the secret to decode a JWT on the client, just to verify it's signature (meaning verify it wasn't tampered with)

But how would you be able to analyze the permissions roles without completely decoding it?

Uhmm... You don't need the secret to decode a JWT on the client, it's a non-changing specific encoding. The signature is all that is created with the secret, it's only 1 of three parts of a JWT and all the user info is in the second part, the scope or payload as Auth0 calls it

Here's a library that does client side decoding, it's very small and easy to read what it is doing.
https://github.com/auth0/jwt-decode

Well, how did I miss that!  That's awesome.  I honestly had no idea all this time.

That's the whole reason I was sending both the payload and the token in the successful auth response.  I didn't realize I could just send the token and read its payload.

Not to overload this discussion with ideas, but maybe we should mention somewhere in the docs to not store sensitive user information in a JWT payload, just in case more users don't know it's totally readable client side.

Absolutely.  Please create an issue in the feathers-docs repo, if you don't mind.

Uhmm... You don't need the secret to decode a JWT on the client, it's a non-changing specific encoding. The signature is all that is created with the secret, it's only 1 of three parts of a JWT and all the user info is in the second part, the scope or payload as Auth0 calls it

@BigAB yes this has actually been on my mind and was why we added the ability in 0.6 to be able to specify payload fields from the user object. I think I need to go back an revisit that because a better solution is for you to set hook.params.payload in any hook, with whatever data you want and it will be added to the payload.
Now there is risk of your token getting too big, which is why we only add the user id by default because that is really all you need, and you get the user object as part of the auth response.

So, I think that leaves the solution back to being very mindful of XSS attacks in your app, right?

It sounds like, by limiting JWT's to Http-Only, which certainly has its security benefits, preventing XSS attacks is the developer's responsibility. I concede, that earlier in the thread, I made the point that some developers might unknowingly have XSS vulnerabilities, but we could still provide protection via the Http-Only option -- but that solution creates pain points in certain use cases.
Having throughly mulled this over, I now feel it's best to consider it the developer's responsibility to secure the JWT. To assist in achieving that end, feathers can provide JWT expiration functionality (#73, #133), and sanitization hooks (feathersjs/feathers-hooks#62). The solution to the CSRF concern still is open. It only applies if you're storing the JWT in a cookie, so ironically enough, might I suggest forbidding the JWT from ever being in a cookie in the first place? Only keep it in localStorage. Then, we don't have to  spend time developing the client-generated passphrase solution. This would mean re-massaging the OAuth implementation to not use cookies. Maybe we could pull that off.

It seems like @ekryski mentioned needing a cookie for some OAuth providers?
For CSRF, If it's an option for your app, you can still whitelist domains in the CORS configuration.

@marshallswain Yes I think so. Possibly being able to optionally set the cookie as httpOnly or disable it altogether. If you're not using OAuth or form posts without Ajax or sockets you don't need it.
@petermikitsh yes you are right. I believe XSS is the developer's responsibility and we'll help however we can to make it easy to protect against.

his would mean re-massaging the OAuth implementation to not use cookies.

I'm not sure if there is a better solution for OAuth really. Totally open to it if someone can cook something up but I trust the Auth0 team has been pretty thorough. I do have an idea around sockets but then you would have to use sockets.
In the interim what we might want to do (which is what I did originally) is just set the cookie to immediately expire so if you make another request, browse to a new page or open a new window it's not available*. I think I want to remove this code as well until we have the actual need for it (if at all). In hindsight this is a premature optimization that is not required and could introduce a security vulnerability currently.
*Although after some quick reading it looks like Firefox doesn't actually delete expired cookies automatically?? (come on!) So in theory an attacker could still inspect the expired cookies manually to access the token.

Maybe we create a middleware for deleting the cookie from the server?
function logout(req, res){
  res.clearCookie('feathers-cookie', { path: '/' });
  res.status(200).send();
}

I assume most developers are immediately calling feathers.configure(authentication(...)); in client side code on page load (let me know if this not a reasonable assumption). In this function call, could you do a hard delete of the expired cookie, to handle use cases such as Firefox?

The only solution I've seen to delete a cookie directly on the client is to set its expiry.  Do you know of another way?

@marshallswain Wow, cookies suck. My research is suggesting you can only 'expire' it, but not outright delete it's existence in client code. On login, you could make a call to clear the cookie in server code, as you have suggested.

Alright, so that this thread doesn't become too lengthy and because I think we've all discussed this pretty thoroughly so far, I'm going to start tackling this today by:

[ ] Making sure the cookie is SSL only in production and it errors if not using HTTPS
[ ] Making sure you can disable the cookie being sent altogether
[ ] Enabling the ability to set httpOnly if you need to
[ ] Setting the cookie to expire immediately
[ ] Removing the ability to use the cookie for authentication. If we need this in the future it should be a separate cookie.

If anyone has any gripes or concerns then please create a sample app and prove that you can successfully attack it and post a gist or a link to the code. With something tangible we can adequately mitigate vulnerabilities and write tests against the code. Thanks for all the input and feedback! This was really good. :smile:

That all sounds good to me. thanks @ekryski

Side note:

I trust the Auth0 team has been pretty thorough

...I am not so sure, ask me about it some time. :smile:

Solid plan @ekryski. I feel much better about adopting feathers now that we had this discussion. Thanks everyone!
Oh -- one more comment -- I am updating my SAML implementation to include the JWT token in the response body (as opposed to setting a cookie). In my implementation, the single-sign on flow is done in an iframe. The response HTML includes a script tag that calls a global function on the parent window, passing the JWT as a parameter. This allows me to completely avoid cookies. I'll update the gist later today. It might be possible to adapt this concept for the OAuth flow, allowing feathers to move to a fully cookie-less authentication architecture.

@petermikitsh I had a thought about offering a popup or iframe approach so I'm very keen to see that. Ping me when you have it up.

@ekryski Will do.
Also, probably valuable to know:
In private browsing mode, Safari, iOS Safari and the Android browsers do not support setting sessionStorage or localStorage.

(Known issue number 5: http://caniuse.com/#feat=namevalue-storage)
So totally removing cookies might not be a good idea either, which case, this express module for CSRF protection can be applied.

Oh. That's good to know.  At that point you could also fall back to storing it in a global variable, couldn't you?

Hmm... so this might surprise you:
OS X, Safari, Private Browsing

checking for localStorage is not enough. You need to attempt calling setItem and catching the exception.
Recall that most people are init'ing their storage like so:
import authentication from 'feathers-authentication/client'
import feathers from 'feathers/client'

var client = feathers()
        .configure(authentication({storage: window.localStorage}));

I'll create a new issue for ensuring the shim gets returned in private browsers.


During handling of the above exception, another exception occurred:  MemoryError

I'm running out of memory when I'm running the Thunderbird dataset（29.8gb） with Logpai's brain, is there a way to solve it?
Traceback (most recent call last):
File "..\logparser\Brain.py", line 189, in tuple_generate
result = number.most_common()
File "C:\Users\3730.conda\envs\logbert\lib\collections_init_.py", line 610, in most_common

I'm getting a valuerror when running the thunderbird dataset in the brain
ValueError: Length of values (2000000) does not match length of index (2000)

Hello! Thanks for your interest in our work. You may split your large dataset into mutilple small chunks to solve memory issue. Since I have used Brain as a preprocessing tool in large log file compression, I'm sure that Brain can perform well using this method.

This reported issue seems not very clear. Could you please provide more context?

Investigating the relevant code sections carefully, I understand why it went wrong. You are using the code of this repositry. This issue is caused by the design of Brain.parse() → df_example = df_input → df_example['EventTemplate']=template_.  template_ is a parsed result (2000000) and df_input is ground truth (2000). You need to create a new dataframe to store the parsed results (i.e., template_ & EventID) to resolve this error. I designed this to make it easier to obtain accuracy results on the 2K benchmark dataset, and I apologize for any errors this may cause😂😂

Your may refer to Brain in LOGPAI, self.df_log is a dataframe to save parsed results

Thanks, I'll modify the code according to your suggestion


option to use filled icons again

the new outline icons in 5.0.6 are hard for me to visually parse. i preferred the old filled icons much more

It's the type of request that increases maintenance costs.
Will I be forced to prepare multiple icon images every time I add a new feature?

5.0.6 uses https://materialdesignicons.com/ .
But a few years later version maybe use https://fonts.google.com/icons more thin outline.

It's the type of request that increases maintenance costs. Will I be forced to prepare multiple icon images every time adding new feature?

i understand that it is hard to have two icon sets. personally i would only use filled icons. i only said "option" in case anyone actually wants outline icons.
the reason i prefer filled icons is because they are easier on my eyes:

In real world, many apps goes to use outline style for their action icons.
As I understand, it's way to align the weight of texts and icons.
No one wants to fill the alphabet.
On Wed, Jan 11, 2023, 03:19 trwnh @.***> wrote:

It's the type of request that increases maintenance costs. Will I be
forced to prepare multiple icon images every time adding new feature?
i understand that it is hard to have two icon sets. personally i would
only use filled icons. i only said "option" in case anyone actually wants
outline icons.
the reason i prefer filled icons is because they are easier on my eyes:
[image: image]
https://user-images.githubusercontent.com/10606431/211631064-f57705f1-4f88-4321-a9c8-d8ffe6f66df4.png
—
Reply to this email directly, view it on GitHub
https://github.com/tateisu/SubwayTooter/issues/216#issuecomment-1377667377,
or unsubscribe
https://github.com/notifications/unsubscribe-auth/AACRQ6C4ZA64XNBN2IIZTELWRWR3XANCNFSM6AAAAAATV3TKQQ
.
You are receiving this because you commented.Message ID:
@.***>


Remove breakpoint-sass from bower dependencies

When bower uses to install this theme, it remove all sass files. I this case I think that "breakpoint-sass" is absolutely unnecessary.

Well, sass-breakpoint is still a dependency, but for developers. Where’s devDependencies with sass-breakpoint in it? Same applies to the Bright PR.

I would expect something like this in a change log:
-  "dependencies": {
-    "breakpoint-sass": "~2.4.2"
-  }
+  "devDependencies": {
+    "breakpoint-sass": "~2.4.2"
+  }

In your workflow breakpoint-sass is absolutely unnecessary. Nobody can work with shower's sass files if theme was installed via bower.