Uncommon question with "Ethical hacking" challenge - java

I have a rather unusual question, but I still don't understand much in programming to understand if it is possible to do what I want. So I feel like I need a little story. My name is Nick, I live in Ukraine and am currently studying as a student in one of the IT firms. Now is the middle of my studies and, if everything goes good, they will give me a chance to get a job in 2 months. But not only me, but 300 more students from all over the country, since the training is online, and the company in which we will get one of the largest in the CIS.
This is where I come closer to the task. To complete the course, we have to complete 8 practical sessions with 5-6 tasks in each. Upon their implementation, we upload the code to the git lab. For this, the company has opened an account for each of us. Then the electronic program for checking assignments - E-Mentor compiles our code, provides input data to fill each class and checks the task. In case of an error, it creates log, which often does not provide complete information. Since some of the test data is always hidden. At the end, the program sets progress points for us. And we all want to get 100%)
**Task: Get input data from the E-Mentor server in the form of a file and automatically push it from the server side to my Git Lab account.**
I am not asking for the complete code, but I am asking you to help me write pseudo code so that I can implement it in full.
I represent it like this:
The server clones my code
Compiles it
Runs tests
At this time, a file is created that copies all incoming information from tests
Somehow the created file is being pushed to my gitlab
For example:
GitBash is started on the server and logs into the gitlab under my login. In this case, it is restricted to rewrite the password and login used by the server itself, as it will be immediately noticed.
This is the coolest challenge that I want to try to do and share it with all students)

Related

program that simulates queuing and service by requests at a fast food restaurant

I was asked to code a program without using any data structure libraries.
Inputs are:
The number of primary servers in the system.
The number of secondary servers in the system.
A set of service requests each consisting of an arrival time and two service times.
This set is terminated by a dummy record with arrival time and service times all equal to 0. (Note: the arrival times are sorted in ascending order).
I'm quite new to java so I would like to get advice what's the best way of doing this or resources which would help me understand the concept better.
I know we do need to create 2 Queues, one for the primary and secondary server to store the data while they are waiting to be served.
I probably have to create counters to increment and decrement for the time. Hopefully my thought process is right.
But I'm unsure how do we go about creating multiple Queues and what data structure i would use for the servers.
The way to approach this problem is to draw a diagram of the real-world situation. Customers come in and line up. There are X servers, each of which can handle one customer at a time. Also model the role of the secondary servers, whatever it is.
Then start handling transactions: server engages customer, passes order to secondary server queue and waits. Gets response from secondary server, finishes with customer, etc. Describe every place where information is exchanged between customers, servers, and secondary servers.
If you do that, you have a very good understanding of the problem you're trying to solve, and a real-world solution. Then you just have to model that in code. Your best bet is to first write a basic outline in pseudocode that describes the data structures and algorithms you're going to use. Once you have that, you can simulate its operation by (again) resorting to pencil and paper.
When you're convinced that you have the algorithm right, then you sit down to write code. And writing the code is pretty much a straightforward translation of your pseudocode.

Java update panel for all users upon database change

So I have a program that runs on multiple computers. The program connects to a server where it gets all of its data from. There's a JPanel which lists names from a table in my postgresql database. As of now, the only way to refresh the panel is with a button press. I want the panel to update on its own when there is a change in the database so if one user adds a name, the other users will be able to see the change right away. Is there a way to broadcast a message to all users that are connected to the server so that their panel can refresh?
As soon as you want to do something like this you enter the world of multiple threads and all kinds of havock. Your question does not really have anything to do with databases, you merely want to send a message to all others using the application to update a component when they need to, keep your concerns separate. Now then you need to ask some questions like are the users all on the same network? Then you can get away with a simple chat client for java, there are heaps of them out there. But think about it, do you really need this requirement? Can't you just update the table say every 10 seconds? Or every 5 seconds? The difference in the difficulty of the implementation is substantial but the result I would say would be very similiar, unnoticable to the user even. But maybe you just want to learn stuff, then maybe you think you should add another table in sql with one entry which records the time the user table was updated which you can check and will be more optimal than the other. But this is considered bad practice, do you care? Same with sql statements to check when a table was edited last from what I have seen on the net, but should we always apply best practices, the application will still get across the line.
Maybe your update button is not looking so bad after all.
But users complain about that sort of crap and you can't explain this stuff to every user. My suggestion would be to have a configurable update that runs every how ever many seconds you tell it to. You will have to look up stuff about multi-threading though but shouldn't be too horrible.

apps, remote sripts and security/obfuscation

I will construct a fictional app in order to construct my question.
I write a kind of treasure hunt app where the user gets a prize if they visit several locations around town. In effect the app would get their current lat/lon and check its proximity to the list of "treasure locations", if they are within 10 meters of any treasure location they get a notification.
The app will then do a http post to a remote script which basically inserts into a database. The post parameters will be uuid of device and the location they visited.
An attacker could easily watch wireshark and get the name of the script along with the parameters. They could go further, decompile the apk and get other things such as any hashing/obfuscation. They could then just use curl to post willynilly as they pleased and the game would be ruined for non-cheaters. This is a problem have never had to really address since in all the apps I have written there is always data which isnt sensitive and I dont mind it being exposed to the public.
What do I do?
The best think you could do is to send the data in a secure manner. Using HTTPS would be a much better choice, regardless of method. This effectively prevents eavesdroppers, it is the fundamental technology behind any secure communication on the internet.
Aside from the protocol to communicate with the server, there are still insecurities. Essentially, there are three methods that could work to overcome these.
The location of the player could be sent to the server at some periodic interval. The server responds back if they are close enough to one of the areas. Perhaps the server could include enough smarts to know that it takes time to get from point A to point B.
A single location could be sent at a time to the app. The track of the user could also be uploaded, to verify that the location is correct.
The locations could be sent through a one way function to the program. The real answer could be then sent to the server. The problem with this is that the exact location would need to be discovered in order for the same hash to result back. However, as GPS coordinates tend to only be accurate to a few meters, and don't tend to give insignificant digits, then multiple values could be tested near the current location. The one-way function would have to require some time to calculate in an effective manner, as otherwise it would be trivial for a bad guy to simply test every square meter in the city to figure out what would work.
The best method from a security standpoint would be the first, as at no time does the application know where it is supposed to go, until it reaches that location. Of course, this pings the server a large number of times needlessly.

Is it possible to modify the time OSCeleton sends a lost_user event/message?

I'm playing around with OSCeleton and Processing and succesfully got to track skeletons and do stuff.
What I'm wondering is if there's any way to change the delay time a "lost_user" message is sent to Processing.
This is taking so long for what I'm trying to achive, since i need to stop tracking a user as soon as he goes away from the screen, so I can accept another user's interaction. (imagine an installation where a lot of people wants to play with).
any help/tips would be really appreciated.
Jon
As far as I can tell from the OSCeleton's source and with my minimal experience with the kinect(I never used OSCeleton), there is no way to modify that code to do that. It seems to be a thing handled even lower, by the driver or by the kinect its self(?).
Yet you need not bind yourself with that, and I would suggest a couple of ways to bypass the problem if I understand properly.
First, the latest drivers and examples should have multi-user support, meaning you can just arrange who is your main user. From what I can tell from the source you do get an osc message in Processing when a new user is detected as well as an ID number. You can put each new user that arrives, into an arrayList and figure out a way to do things without depending on the latest user.
If you are still going for the user-after-user thing though, or I was mistaken about the multi-user support(which is mentioned nowhere in the README), you can check yourself whether a user has left the area. Although you can not get a definitive answer like that you can check for example, whether a specific joint or all joints of a user have moved in the last 10-20 osc messages received. That probably means storing the position of this joint in an 10-20 item array and continuously updating while also doing a check on whether the items are different. If all items in the array are the same, your user has not moved a bit and thus probably should not be taken to account.
Last but not least you can switch to other solutions. The one I used about a year ago was "Synapse for Kinect" which also seems stale now. The latest you can use is a Processing library called SimpleOpenNI which definitively have multi-user tracking and you won't need any intermediary programs running to give you the joints.
I hope this helps

Does it make sense to write logical tests using JBehave?

I've encountered JBehave recently and I think we should use it. So I have called in the tester of our team and he also thinks that this should be used.
With that as starting point I have asked the tester to write stories for a test application (the Bowling Game Kata of Uncle Bob). At the end of the day we would try to map his tests against the bowling game.
I was expecting a test like this:
Given a bowling game
When player rolls 5
And player rolls 4
Then total pins knocked down is 9
Instead, the tester came with 'logical tests', in other words he was not being that specific. But, in his terms this was a valid test.
Given a bowling game
When player does a regular throw
Then score should be calculated appropriately
My problem with this is ambiguity, what is a 'regular throw'? What is 'appropriately'? What will it mean when one of those steps fail?
However, the tester says that a human does understand and that what I was looking for where 'physical tests', which where more cumbersome to write.
I could probably map 'regular' with rolling two times 4 (still no spare, nor strike), but it feels like I am again doing a translation I don't want to make.
So I wonder, how do you approach this? How do you write your JBehave tests? And do you have any experience when it is not you who writes these tests, and you have to map them to your code?
His test is valid, but requires a certain knowledge of the domain, which no framework will have. Automated tests should be explicit, think of them as examples. Writing them costs more than writing "logical tests", but this pays in the long run since they can be replayed at will, very quickly, and give an immediate feedback.
You should have paired with him writing the first tests, to put it in the right direction. Perhaps you could give him your test, and ask him to increase the coverage by adding new tests.
The amount of explicitness needed in acceptance criteria depends on level of trust between the development team and the business stakeholders.
In your example, the business is assuming that the developers/testers understand enough about bowling to determine the correct outcome.
But imagine a more complex domain, like finance. For that, it would probably be better to have more explicit examples to ensure a good understanding of the requirement.
Alternatively, let's say you have a scenario:
Given I try to sign up with an invalid email address
Then I should not be registered
For this, a developer/tester probably has better knowledge of what constitutes a valid or invalid email address than the business stakeholder does. You would still want to test against a variety of addresses, but that can be specified within the step definitions, rather than exposing it at the scenario level.
I hate such vague words as "appropriately" in the "expected values". The "appropriately" is just an example of "toxic word" for the testing, and if not eliminated, this "approach" can get widespread, effectively killing the testing in general. It might "be enough" for human tester, but such "test cases" are acceptable only at first attempts to exploratory "smoke test".
Whatever reproducible, systematical and automatable, every test case must be specific. (not just "should".. to assume the softness of "would" could be allowed? Instead I use the present tense "shall be" or even better strict "is", as a claim to confirm/refuse.) And this rule is absolute once it comes to automation.
What your tester made, was rather a "test-area", a "scenario template", instead of a real test-case: Because so many possible test-results can be produced...
You were specific, in your scenario: That was a very specific real "test case". It is possible to automate your test case, nice: You can delegate it on a machine and evaluate it as often as you need, automatically. (with the bonus of automated report, from an Continuous Integration server)
But the "empty test scenario template"? It has some value too: It is a "scenario template", an empty skeleton prepared to be filled by data: So I love to name these situations "DDT": "Data Driven Testing".
Imagine a web-form to be tested, with validations on its 10 inputs, with cross-validations... And the submit button. There can be 10 test-cases for every single input:
empty;
with a char, but still too short anyway;
too long for the server, but allowed within the form for copy-paste and further edits;
with invalid chars...
The approach I recommend is to prepare a set of to-pass data: even to generate them (from DB or even randomly), whatever you can predict shall pass the test, the "happy scenario". Keep the data aside, as a data-template, and use it to initialize the form, to fill it up, and then to brake-down some single value: Create test cases "to fail". Do it i.e. 10 times for every single input, for each of the 10 inputs (100 tests-cases even before cross-rules attempted) ... and then, after the 100 times of the refusing of the form by the server, fill up the form by the to-pass data, without distorting them, so the form can be accepted finally. (accepted submit changes status on the server-app, so needs to go as the last one, to test all the 101 cases on the same app-state)
To do your test this way, you need two things:
the empty scenario template,
and a table of 100 rows of data:
10 columns of input data: with only one value manipulated, as passing row by row down the table (i.e. ever heard about grey-code?),
possibly keeping the inheritance history in a row-description, where from is the row derived and how, via which manipulated value.
Also the 11th column, the "expected result" column(s) filled: to pass/fail expected status, expected err/validation message, reference to the requirements, for the test-coveradge tracking. (i.e. ever seen FitNesse?)
And possibly also the column for the real detected result, when test performed, to track history of the single row-test-case. (so the CI server mentioned already)
To combine the "empty scenario skeleton" on one side and the "data-table to drive the test" on the other side, some mechanism is needed, indeed. And your data need to be imported. So you can prepare the rows in excel, which could be theoretically imported too, but for the easier life I recommend either CSV, properties, XML, or just any machine&human readable format, textual format.
His 'logical test' has the same information content as the phrase 'test regular bowling score' in a test plan or TODO list. But it is considerably longer, therefor worse.
Using jbehave at all only makes sense in the case the test team are responsible for generating tests with more information in them than that. Otherwise, it would be more efficient to take the TODO list and code it up in JUnit.
And I love words like "appropriately" in the "expected values". You need to use cucumber or other wrappers as the generic documentation. If you're using it to cover and specify all possible scenarios you're probably wasting a lot of your time scrolling through hundred of feature files.

Categories