Sonatype

sonatype

In this guide, we will use Jenkins as a Continuous Integration server and Nexus as a build repository. The end goal of this guide is to create a flow, where we can build, store, organize and monitor the compiled artifacts by Maven through our CI server. Before we begin, make sure that you already have Jenkins up and running. In case you haven’t set up Jenkins yet, then copy the below command and run it on your Docker enabled host/machine. $ docker run -d --name jenkins-ci -p : jenkins/jenkins:lts 8080 8080 Once, Jenkins container is configured on your local/remote machine. Go to your preferred browser and open the URL . http:///your-ip-addr:8080 On the very first page, Jenkins will ask you for the admin password, which you can find by running below mentioned command in your terminal: $  docker exec -i jenkins-ci cat / /jenkins_home/secrets/initialAdminPassword

b5102c8d9fa245dbb0b8da03f504d3a5 var Follow the guided steps to finish the configuration. Save the username and password securely for future use. Installing Nexus: Nexus is a repository manager that allows you to store and retrieve artifacts. It enables you to host your built artifacts in a private and secure repo. You can always pull the Nexus Docker image using the following command: $ docker pull sonatype/nexus3
 
Using tag: latest
latest: Pulling sonatype/nexus3
cb3c77f9bdd8: Pull complete 
fd8daf2668d1: Pull complete 
fd1ff82b00e8: Pull complete a05f7b573af: Pull complete 
Digest: sha256: dfbc3eb094fe5cbbacec87aa8b91d16394dab627177e1deeebb5ac8ee
Status: Downloaded newer image sonatype/nexus3:latest
docker.io/sonatype/nexus3:latest default from 2 6570855 for Now it’s time to run downloaded sonatype/nexus on the default port 8081. Follow the below-mentioned commands: $ docker run -d --name nexus_repo -p : sonatype/nexus3 8081 8081 Usually it takes 1 to 2 minutes for the Nexus service to launch in your newly created Docker container. If you wish to follow the log to see if Nexus is up and ready, then run the following command: $ docker logs nexus_repo -f In logs you will see a message stating . It means your Nexus Repository Manager is ready to use. Now go to your browser and open . Started Sonatype Nexus OSS 3.20.1-01 http://your-ip-addr:8081 Find the option as shown below: Sign In The default username is admin, whereas to retrieve the password you need to run the following command: $ docker exec -i nexus_repo cat /nexus-data/admin.password ace93 f0d d2 b3b3a88d149 502 -5450 -4 -97 -9 And that’s it. Your Nexus Repository Manager is ready-to-use. The next step is to create a new repository. Create a Repository in Nexus: In this step, you are going to create a Maven Hosted repository in Nexus, where your Jenkins is going to upload “build” artifacts. Follow the below-mentioned steps to create a hosted repository, name it as , which you are going to use throughout this guide. Step 1: maven-nexus-repo Select recipe from the list as shown in the below-mentioned figure: maven2 (hosted) On the page, Step 2: Create Repository Enter the name as maven-nexus-repo In Version Policy, select the type of artifacts. Mixed Under the section, in , select . It will allow you to deploy an application multiple times. Hosted Deployment policy Allow redeploy To create a new user, go to . Select user type which happens to be the default Realm: Step 3: Dashboard > Server Administrator and Configuration > User > Create user Local In the page, Create User : Enter the desired ID; in our case, it is jenkins-user. ID : Enter the desired first name; in our case, it is Jenkins. First Name : Enter the desired second name; in our case, it is User. Last Name : Enter your email address. Email : Select from your drop-down menu. Status Active : Make sure that you grant the role to your user. Roles nx-admin In case you want more details for user creation, then . click here With this, we are through with the setup part of Nexus Repository Manager. Let us move to Jenkins to setup Nexus there. Install and Configure Nexus Plugins in Jenkins Here you are going to install and configure a few plugins for Nexus in Jenkins. For this, go to Jenkins and then and search and install and . Dashboard > Manage Jenkins > Manage Plugins > Available Nexus Artifact Uploader Pipeline Utility Steps Add Nexus Repository Manager’s user credentials in Jenkins. Go to , as shown below: Dashboard > Credentials > System > Global credentials (unrestricted) Next, set up Maven as a managed tool. Go to and find . Under this section, click on the button and add , as shown below: Dashboard > Manage Jenkins > Global Tool Configuration Maven Maven Installations Maven Alternatively, you can also install the Maven binary directly to your container on the directory. /var/jenkins_home Create a Jenkins Pipeline It’s time to create a Jenkins Job. Here you are going to use Pipeline job type, named as , as shown below: JenkinsNexus In the next page, find the Pipeline section and copy the below-mentioned script in the text area: pipeline {
    agent {
        label }
    tools {
        maven }
    environment {
        NEXUS_VERSION = NEXUS_PROTOCOL = NEXUS_URL = NEXUS_REPOSITORY = NEXUS_CREDENTIAL_ID = }
    stages {
        stage( ) {
            steps {
                script {
                    git ;
                }
            }
        }
        stage( ) {
            steps {
                script {
                    sh }
            }
        }
        stage( ) {
            steps {
                script {
                    pom = readMavenPom file: ;
                    filesByGlob = findFiles(glob: );
                    echo artifactPath = filesByGlob[ ].path;
                    artifactExists = fileExists artifactPath; (artifactExists) {
                        echo ;
                        nexusArtifactUploader(
                            nexusVersion: NEXUS_VERSION, : NEXUS_PROTOCOL, : NEXUS_URL, : pom.groupId, : pom.version, : NEXUS_REPOSITORY, : NEXUS_CREDENTIAL_ID, : [
                                [artifactId: pom.artifactId, : , : artifactPath, : pom.packaging],
                                [artifactId: pom.artifactId, : , : , : ]
                            ]
                        );
                    } {
                        error ;
                    }
                }
            }
        }
    }
} "master" "Maven" "nexus3" "http" "you-ip-addr-here:8081" "maven-nexus-repo" "nexus-user-credentials" "Clone code from VCS" 'https://github.com/javaee/cargotracker.git' "Maven Build" "mvn package -DskipTests=true" "Publish to Nexus Repository Manager" "pom.xml" "target/*.${pom.packaging}" "${filesByGlob[0].name} ${filesByGlob[0].path} ${filesByGlob[0].directory} ${filesByGlob[0].length} ${filesByGlob[0].lastModified}" 0 if "*** File: ${artifactPath}, group: ${pom.groupId}, packaging: ${pom.packaging}, version ${pom.version}" protocol nexusUrl groupId version repository credentialsId artifacts classifier '' file type classifier '' file "pom.xml" type "pom" else "*** File: ${artifactPath}, could not be found" Let’s break down the above-mentioned parameters bit by bit: : Here, we have to mention the exact version of Nexus, which can be or . In our case, it is latest version of . NEXUS_VERSION nexus2 nexus3 nexus3 : For this guide we have used HTTP protocol, although, in case of production, you will have to use HTTPS. NEXUS_PROTOCOL : Add your IP address and port number, where you are running Nexus. Make sure that you add Nexus instance details without mentioning protocols, i.e., or . NEXUS_URL https http : Enter the user ID, which you previously created in Jenkins, which in our case is . NEXUS_CREDENTIAL_ID nexus-user-credentials : Under stages, we used Project Git https://github.com/javaee/cargotracker As you are through with the Pipeline set up, it’s time to our project. Go to the project job page and click . As this is your first build, it is going to take some time, so sit tight. Build JenkinsNexus Build Now Once build is a success, in your Jenkins Console Output, you will see something like this: Whereas, in your Nexus Repository Manager, you would see something similar to this: Conclusion: A systematic way to disturb the project’s artifact is critical for any organization. With the help of Jenkins Pipeline and Nexus Repository Manager, you can centralize artifact repo, which ultimately reduces the efforts of reproducing build time as well as switch CI tools without worrying about migrating our artifacts. Nexus can be configured with cloud storage services like AWS S3 and Google Cloud Storage as well, which gives you additional freedom and delivery application without any hassle of storage. Hope you liked the article and took good use of it. You might also want to explore Configuring a CI/CD pipeline through Jenkins through . this article This article was originally published on https://appfleet.com/

Workflow Automation: Publishing Artifacts to Sonatype Nexus using Jenkins Pipelines

[On February 9, 2021] news broke that a security researcher managed to breach systems of in what has been described as a novel software supply chain attack. over 35 tech companies By taking advantage of a concept known as or namespace confusion security researcher and ethical hacker Alex Birsan pushed his Proof-of-Concept (PoC) counterfeit packages downstream in an automated fashion to the development environments of Microsoft, Uber, Tesla, Yelp and Shopify, among other tech firms. dependency confusion , This attack is of particular significance as unlike traditional typosquatting or brandjacking supply-chain attacks that Sonatype before, the targeted companies automatically received Birsan’s malicious packages without them making any spelling mistakes, or any social engineering involved. has talked about For demonstrating the seriousness of this type of software supply chain attacks, Birsan has been awarded upwards of $130,000 in bug bounties. To date, Birsan has published over , each with 100-1000 versions, to multiple open-source ecosystems including , , , which is how the researcher had an astonishingly high success rate in ethically hacking big organizations. 200 packages npm PyPI RubyGems When Birsan’s research efforts began last year, our automated malware detection systems, part of Nexus Intelligence, had simultaneously started flagging these packages as malware. At the time, the researcher told Sonatype that this was all part of an ongoing research work and that a coordinated disclosure was set to take place in early 2021. Consequently, since then Sonatype Security Research team has been repeatedly adding these packages to our data under multiple vulnerability identifiers (sonatype-2020-XXXX IDs), keeping our customers protected from the get go. Sonatype also observed these 200+ brandjacking packages were published under the researcher’s real name, who appeared to have a , and contained explicit disclaimers in multiple places that these were created for purposes (both within the code comments, and on the package homepages on the repositories), when we had contacted Birsan back in 2020. credible profile security research Image: Birsan’s packages contained explicit disclaimers that these were for research only in the source code and on npm pages for each package Today, Birsan has released his findings on his , with Sonatype releasing our analysis simultaneously. blog Microsoft has also released a and a vulnerability identifier ( ) for its Azure Artifacts product, related to this issue. whitepaper CVE-2021-24105 What is Dependency Confusion? The dependency confusion problem is an inherent design flaw in the native installation tools and DevOps workflows that pull dependencies into your software supply chain. In this context, dependency confusion refers to the inability of your development environment to distinguish between a private, internally-created present package in your software build, and a package by the same name available in a public software repository. Sonatype CTO Brian Fox has previously that the lack of a proper namespacing requirement in open-source ecosystems has the potential to cause dependency hijacking attacks. expressed “The fact that so much of the npm ecosystem is effectively not namespaced has actually created potential build time malware injection possibilities.” “If I know of a package in use by a company through log analysis, bug report analysis, etc. I could potentially go register the same name in the default repo with a very high semver and know that it’s very likely that this would be picked up over the intended, internally developed module because there’s no namespace," said Fox in 2017. For example, let’s assume your application uses an internal, privately-created PyPI component called (version 1) as a dependency. foobar Later, should an unrelated component by the but higher version number (version 9999) be published to the public repository, the default configuration of PyPI development environments dictates that the with the higher version be downloaded as a dependency. same name foobar PyPI downloads foobar In this case, that would mean, the attacker’s counterfeit package with a higher version number would make its way into your software build. foobar silently and automatically Whereas, traditional typosquatting and brandjacking attacks require some social engineering of the developer, such as them misspelling a package name, or mistaking a brandjacking package for a legitimate one, this attack is more sophisticated because no interaction is required on the developer’s part. Birsan began experimenting with the idea last year when he noticed some of PayPal’s code exposed in GitHub and other places had manifest files which indicated the company used both public and private (internally created) npm packages. He wondered what would happen if he squatted the private package names listed in the manifest on the npm open-source registry, open to everyone. He further expanded his research efforts to emulate similar attacks in PyPI and RubyGems repositories. An example gem published by Birsan to RubyGems is analyzed below. The gem version is a counterfeit component, which makes a DNS request to the researcher’s DNS server and exfiltrates the infected system’s username, current directory and IP address. shopify-cloud 2300.4.2 This data is sent through DNS to maximize its chances of it bypassing corporate firewalls which tend to block all suspicious traffic over different protocols, but DNS. All other 200+ packages published by Birsan in npm, RubyGems, and PyPI ecosystems contain identical code and perform the same actions. In this way, as soon as a target company received Birsan’s counterfeit components in this automated supply chain attack, his code would execute and “phone home,” notifying the researcher of a successful outcome. The researcher would then report his findings to the company whose IP address was making the contact, and managed to earn multiple bug bounties in the range of $30,000-40,000 each, totalling well over $130,000. “At this point, I feel that it is important to make it clear that every single organization targeted during this research has provided permission to have its security tested, either through public bug bounty programs or through private agreements. Please do not attempt this kind of test without authorization,” Birsan has warned in his blog post. Why Did This Software Supply Chain Attack Have a High Success Rate? The dependency confusion problem is an inherent design flaw in the default configuration of DevOps tools and what packages or dependencies are prioritized, should multiple ones exist by the same name. While over 75% of the logged callbacks received by the researcher were from companies using npm packages, the problem isn’t unique to any particular ecosystem. “This does not necessarily mean that Python and Ruby are less susceptible to the attack. In fact, despite only being able to identify internal Ruby gem names belonging to organizations during my searches, of these companies turned out to be vulnerable to dependency confusion through RubyGems,” says Birsan. eight four And the biggest leverage the researcher had in this attack, it triggered automatically without requiring human error as we have seen with typosquatting and brandjacking attacks. A good tip here is to review the installation workflows of your development tools carefully, and even typosquat the names of your internally-created packages in public repositories to prevent misuse by adversaries. Better namespacing strategies for components that clearly distinguish between different components is also a way to prevent the dependency confusion problem. “The reverse fully-qualified domain name (FQDN) introduced into the Java package was a great choice to ensure classes don’t conflict.” “Popular build tools such as Maven and nearly all those that followed built upon this key concept, with the introduction of GroupId also using the FQDN as part of the name to ensure the coordinates were properly namespaced,” continues Fox. Very Hard to Spot Such an Attack Without Nexus Intelligence In cases of counterfeit components seen thus far by Sonatype, the component names differ in their , or are published under a , making them slightly easy to spot. spellings different namespace Dependency confusion supply attacks of this calibre would be virtually impossible to spot manually or using loose manifest-based matching  to generate a Software Bill of Materials (SBOM) because the counterfeit components published to the public repos had the as the private ones. exact same names The companies targeted here would have never suspected that the same manifest files that had been living in their software builds all this time, would now suddenly start pulling entirely different components, despite the manifests being untouched by anyone. This is where having an SBOM and a list of vulnerabilities in your builds generated through deep binary analysis, code similarity matching, combined with the power of Sonatype’s automated malware detection systems, would come in as an indispensable solution, and save the day. The 200+ packages that were gradually published as a part of this research were spotted by Sonatype’s malware detection systems starting in mid-2020, and were incorporated in our security research data in a timely manner. Additionally, Sonatype has released a on GitHub that users of Nexus Repository Manager can use to check if any of their private dependencies have the same names as existing squatted packages on the public npm, RubyGems, and PyPI repos. script Had next-generation Nexus products been integrated properly in software builds of the target companies, the counterfeit components would have been immediately flagged or blocked altogether as soon as they were pulled downstream within software supply chains. Birsan believes there remains more to discover here, and expects future attacks leveraging dependency confusion across different ecosystems to grow. According to Sonatype’s report, next-generation upstream software supply chain attacks are far more sinister because bad actors are no longer waiting for public vulnerability disclosures. 2020 State of the Software Supply Chain Instead, they are taking the initiative to contribute code to open source projects and then - unbeknownst to the other OSS project maintainers - injecting malicious code.  Those code changes then make their way into open source projects that feed the software supply chains of developers around the world. By shifting their focus upstream (i.e., publishing malicious components in open source repositories), bad actors can infect a single component, which will then be distributed downstream using trusted software workflows and transitive dependencies. Our 2020 report also shows that this is happening at a rapidly increased rate. In fact, there was a 430% increase in upstream software supply chain attacks over the past year. Keeping this in mind, it is virtually impossible to manually chase and keep track of such components. Sonatype’s world-class security research data, combined with our technology safeguards your developers, customers, and software supply chain from infections. automated malware detection If you're not a Sonatype customer and want to find out if your code is vulnerable, you can use Sonatype's free to find out quickly. Nexus Vulnerability Scanner Visit the page for a deep dive into other vulnerabilities like this one or subscribe to automatically receive Nexus Intelligence Insights hot off the press. Nexus Intelligence Insights Tags: , , , , vulnerabilities featured News and Views Nexus Intelligence Insights DevZone

Over 35 Tech Companies Compromised in Novel Software Supply Chain Attack

In this article I am explaining the risks of third-party dependencies and how to mitigate them with appropriate tools. Damned if you don’t Whether you’re a developer, a CTO or a tech lead, I bet you have at some point faced a dilemma of adding a third-party dependency to your software. With all the benefits, they sure do come with some obvious trade-offs along the following lines: : there are so many people using this code, there are bound to be some smart people who have already found a way to breach it Well known vulnerabilities : a lot of libraries and components cannot be used in some circumstances and unless you’re well versed in different types of licences, you can get into legal trouble License restrictions : since you are not the one who owns that code — you’re not the one who calls the shots on what features have to be included and how are they supposed to work Lack of flexibility Detecting a problem of the third category is trivial, however how do you detect issues belonging to the first two? If your company is small and there are only a couple of dependencies here and there — you can do a manual check, however when you are starting to scale your business and the number of engineers starts going into tens and hundreds you have to scale your approaches, processes and tools too. Enter Sonatype Nexus IQ You might have heard of repository — it’s a place where you can upload your binary and share it with other people either within your organization or outside of it. With tools like Gradle or Maven anyone with the access will be able to depend on your code with little effort. Here’s a if you’d like to know more about it and it’s differences from and . Nexus great article jcenter Maven Central When you publish anything on , you can inspect your code for known vulnerabilities or license breaches just by flipping a switch in the settings. However should you decide against publishing, you can still use their — a powerful engine that allows you to create your own company policies on third-party dependencies usage and a scanner tool that will generate reports about your code’s compliance to them. After being generated these can be found on a dashboard with very detailed descriptions of all the vulnerabilities found, the respective common workarounds and best practices of usage. Nexus Nexus IQ server Refresher course After briefly skimming through the , you will find out that you will need the following official tutorial Deployed instance of Nexus IQ server Accessible URL of the deployed instance User Credentials and Application ID under which the report will be stored Nexus IQ CLI tool and Java8 to run it The binary you want to analyze, I’ll call it the artifact java -jar <NEXUS_DIR>/nexus-iq.jar -i <APPLICATION_ID> -s <NEXUS_IQ_SERVER_URL> -a <USERNAME>:<PASSWORD> <ARTIFACT> Presto! Now if you go to your dashboard you will see the entry under your there with the results of it’s scan. Of course instead of a single file you can supply the whole folder to Nexus IQ CLI and have it analyze everything inside. artifact’s name Everything that Nexus IQ analyze that is. CAN It’s supported formats include and even The official help says that there are many more supported ones, like C-style files and yet there is one glaring omission there. jar, war, ear, tar, tar.gz, zip Docker images. .o Oh well. It’s a powerful tool and something that any tech lead or a CTO would appreciate, however there is a catch. It was not built for Mobile Apps. It will likely give you a headache to figure out how to add your Android and iOS dependencies to this dashboard. The outcome is well worth it — a single source of truth for your company’s code safety, and in I will teach you some tricks that will help you integrate it with Android. the next article Do you use another tool for vulnerability scan? Have you heard of any downsides of Nexus IQ? Comment below — any feedback is welcome.

Keeping third-party dependencies in check

In this guide, we are going to deploy a continuous integration process between Jenkins, GitLab, and SonarQube. The end goal will be to review the code quality through SonarQube for GitLab repository using Jenkins. Following is the process flow we need to manage: Push code to GitLab from the local machine. Next, checkout code and run tests in Jenkins, here it is acting as a Continuous Integrator. Generate quality report via SonarQube as a code analyser. Setup Jenkins, SonarQube & GitLabs In case, if you haven't set up the required software yet, go through the below-mentioned steps: Step 1: Make sure that your host machine has enough power to run these components, as GitLab alone requires 4 GB of RAM to perform its operations smoothly. To run all three together, you need at least 8 GB of RAM and 20 GB of hard disk space. Step 2: For SonarQube, you need to set the recommended values as a root user on the host machine: $ sysctl -w vm.max_map_count= $ sysctl -w fs.file-max= $ ulimit -n $ ulimit -u 262144 65536 65536 4096 Step 3: For this guide, we are going to use a simple docker-compose.yml file. However, you are free to edit the file as per your requirement. Before launching the containers, please make sure that you change the value of , , , and . Although, along with this, you can also modify the define ports in the file. GITLAB_SECRETS_DB_KEY_BASE GITLAB_HOST SONARQUBE_JDBC_PASSWORD POSTGRES_PASSWORD version: services:
   jenkins:
       image: jenkinsci/jenkins:lts
       container_name: jenkins-container
       restart: always
       ports:
           - - volumes:
       - - environment:
       - gitlab:
       image: gitlab/gitlab-ce:latest
       container_name: gitlab-container
       restart: always
       environment:
           - GITLAB_SECRETS_DB_KEY_BASE=long-and-random-alphanumeric-string
           - GITLAB_HOST=your-host-ip-here
           - GITLAB_PORT= - GITLAB_SSH_PORT= ports:
           - - volumes:
       - - - sonarqube:
       image: sonarqube: -community
       container_name: sonar-container
       restart: always
       networks:
           - sonarnet
       environment:
           - SONARQUBE_JDBC_USERNAME=sonar
           - SONARQUBE_JDBC_PASSWORD=your-strong-password-here
           - SONARQUBE_JDBC_URL=jdbc:postgresql: ports:
       - - volumes:
       - - - - postgressdb:
       image: postgres: container_name: postgres-container
       restart: always
       networks:
           - sonarnet
       environment:
           - POSTGRES_USER=sonar
           - POSTGRES_PASSWORD=your-strong-password-here
           - POSTGRES_DB=sonarqube
       volumes:
       - - networks:
   sonarnet:
    driver: bridge "3.2" "8080:8080" '50000:50000' '/var/run/docker.sock:/var/run/docker.sock' '/data/jenkins/jenkins_home:/var/jenkins_home' "JENKINS_OPTS=--prefix=/jenkins" 10080 10022 "10080:80" "10022:22" '/data/gitlab/config:/etc/gitlab' '/data/gitlab/logs:/var/log/gitlab' '/data/gitlab/data:/var/opt/gitlab' 7.9 .2 //postgressdb:5432/sonarqube "9000:9000" "9092:9092" '/data/sonar/sonarqube_conf:/opt/sonarqube/conf' '/data/sonar/sonarqube_data:/opt/sonarqube/data' '/data/sonar/sonarqube_extensions:/opt/sonarqube/extensions' '/data/sonar/sonarqube_bundled-plugins:/opt/sonarqube/lib/bundled-plugins' 12.1 '/data/postgresql/sonarqube_db:/var/lib/postgresql' '/data/postgresql/postgresql_data:/var/lib/postgresql/data' Now, run the following command to launch the stack: $ docker-compose up -d Note that the installation process is going to take some time, so sit back and have some coffee. You deserve it! Step 4: Now, to verify if all systems are up and running, run this command: $ docker ps

CONTAINER ID    IMAGE                     COMMAND             CREATED         STATUS                  PORTS                                                   NAMES
f54e223417fa    gitlab/gitlab-ce:latest minute ago minute ago (healthy) /tcp, : -> /tcp, : -> /tcp   gitlab-container f03f69b8    sonarqube minute ago minute ago : -> /tcp                                  sonar-container f554da39fc    jenkinsci/jenkins:lts minute ago minute ago : -> /tcp, : -> /tcp        jenkins-container "/assets/wrapper" 1 1 443 0.0 .0 .0 10022 22 0.0 .0 .0 10080 80 9102 "./bin/run.sh" 1 1 0.0 .0 .0 9000 9000 05 "/bin/tini --..." 1 1 0.0 .0 .0 8080 8080 0.0 .0 .0 50000 50000 If all went well, then you can access all three of them by following mentioned URLs: Jenkins - http://your-ip-address:8080 SonarQube - http://your-ip-address:9000 GitLab - http://your-ip-address:10080 As you are visiting your Jenkins environment for the first time, it is going to prompt you to enter the administrator password, which was generated during the installation process. To access the password from the container, you can run the following command: $ docker exec -it <your-jinkins-container-id> cat / /jenkins_home/secrets/initialAdminPassword
$ gSzHTGfbtXSpcBXMyJ6gzmNfNH7BjhK23 var Once you enter the password, you can select the option . Wait until the download finishes. Install suggested plugin For SonarQube, the default username and password are admin and admin, respectively. Whereas, for GitLab, you will be prompted to enter the new password for the default username root. Configuring Jenkins Pipeline with SonarQube and GitLab integration We will begin with SonarQube. To connect it with Jenkins, you need to generate the token to access the SonarQube instance. SonarQube Configuration: Login into the SonarQube dashboard and go to the Administrator tab. In the Security drop-down menu, select User tab as shown in the below image: Here you will find Administrator user, for which you are going to generate the access token: In the pop-up that displays on your screen, enter the desired name and click on the button. Copy the newly generated token and save it somewhere safe, as you won’t be able to view/copy the generated token again. Generate To establish a connection between GitLab and Jenkins, again, we need to generate an access token, which can be done as mentioned below: GitLab Configuration: To generate an access token, go to your GitLab dashboard and follow . Once you have the token with you, copy it for further use. Dashboard > Setting > Access Tokens This guide assumes that you have already done the basic setup for Jenkins. Now, let’s move to configure GitLab and SonarQube in the Jenkins server. Integrating SonarQube and GitLabs in Jenkins: First, we are going to integrate SonarQube. Go and search for SonarQube. Dashboard > Manage Jenkins > Manage Plugins Make sure you restart Jenkins once the plugin is successfully installed. Once the restart is completed, you have to set up Sonar Scanner, which is a standalone tool used for scanning the source code and send the result to SonarQube Server. Here you are going to install it in the Jenkins container itself, although you are free to launch a separate container for the same purpose. $ docker exec -it <your-jinkins-container-id> bash

$ cd / /jenkins_home

$ wget https: $ unzip sonar-scanner-cli -linux.zip var //binaries.sonarsource.com/Distribution/sonar-scanner-cli/sonar-scanner-cli-4.2.0.1873-linux.zip -4.2 .0 .1873 Go back to the Manage Jenkins page and select Global Tool Configuration. In this page, find SonarQube Scanner and add complete the installation: Don’t forget to uncheck as you have to define the installation path of Sonar Scanner explicitly. Install automatically As Jenkins and SonarQube are running in separate docker containers, we need to create a Webhook at SonarQube Server so that both can communicate with each other. To do so, follow : Dashboard > Administrator > Configuration > Webhook Lastly, you have to add the access token you generated on your SonarQube server in Jenkins. Follow the URL or go to , as shown below: http://your-ip-addr-here:8080/credentials/store/system/ Dashboard > Credentials > System Click on link and select “Secret Text” field under : Add Credentials Kind In the Secret field, paste the generated token from SonarQube that you previously created. Now, add the SonarQube server to your Jenkins environment. Go to . Find on the page and add the required details as mentioned below: Dashboard > Manage Jenkins > Configure System SonarQube server Now, you have to add Gitlab in Jenkins, visit . Here, you are going to add the access token you previously created to your Jenkins server. Although, you can also use with username and password. Dashboard > Credentials > System Kind As you are through with the SonarQube and GitLab integration in Jenkins, it’s time to manage other dependencies. In this guide, we are going to use a simple NodeJs application; hence it’s time to install NodeJS on your Jenkins Server. NodeJS Environment in Jenkins: To install NodeJS plugin, go to and search and select NodeJS. Click on the button, as shown in the figure below. Dashboard > Manage Jenkins > Manage Plugins > Available Install without restart Upon successful installation of NodeJS plugin in Jenkins, make sure that you restart Jenkins. To configure NodeJS plugin, go to and find "NodeJS". Click on NodeJS installation button and add the necessary details, as shown in the figure: Dashboard > Manage Jenkins > Global Tool Configuration Give a name and select the NodeJS version as per your requirement; you can also install Global NPM packages and set the refresh rate depending upon the project requirements. Once done, you need to save the configuration. As we are through with the gruesome part of installing and configuring the environment, it’s time to create the project pipeline. Creating Jenkins Pipeline Here you are going to create a pipeline using Declarative Scripted Pipeline. Follow the below steps to get started: Go to Jenkins’ Dashboard and click on the “New Item” link. Now, enter the item name and select option as shown in the figure: Step 1 - Create a New Job Pipeline The below-mentioned simple pipeline script helps you to pull the code from GitLab, quality check via SonarQube, and use NodeJS. Step 2 - Pipeline pipeline {
agent any
tools {nodejs }
stages {
 stage( ) {
  steps {
   git branch: , : , : }
 }
   stage( ) {
   steps {
       script {
       def scannerHome = tool ;
           withSonarQubeEnv( ) {
           sh sonarqube }
           }
       }
   }
   stage( ) {
   steps {
       nodejs(nodeJSInstallationName: ){
           sh }
       }
   }
}
} "nodenv" "Code Checkout from GitLab" 'master' credentialsId 'gitlab_access_token' url 'http://your-ip-here:10080/root/test-project.git' 'Code Quality Check via SonarQube' 'sonarqube' "sonarqube-container" "${tool(" ")}/bin/sonar-scanner \
           -Dsonar.projectKey=test-node-js \
           -Dsonar.sources=. \
           -Dsonar.css.node=. \
           -Dsonar.host.url=http://your-ip-here:9000 \
           -Dsonar.login=your-generated-token-from-sonarqube-container" "Install Project Dependencies" 'nodenv' "npm install" Make sure that you change the values of GitLab repo URL, SonarQube host URL, and its access token. Add the above-mentioned pipeline script and save it, as shown in the below figure: Now, as you have saved the pipeline script, it’s time to build your application in Jenkins. Go to . Step 3 - Run Pipeline Dashboard > YOUR PROJECT > Build Now As soon as you click the link, Jenkins will start building project as per pipeline script. In Build History, you will see the progress bar for the current build along with the Stage View: Build Now If your build runs successfully, you will be able to see the time taken by each stage, in : Stage View Also, you can visit the SonarQube dashboard to see the project code report, by visiting the link named as "SonarQube" on project pipeline page. That’s it! You have successfully created a Jenkins Pipeline while using SonarQube and GitLab. Now, every time you push the code to the repo, you can build the project, which will show the code quality.

Workflow Automation: Jenkins Pipeline with Sonarqube and Gitlab

5 New Malware Techniques to Steal Your Crypto (2024)

আপনার ক্রিপ্টো চুরি করার জন্য 5টি নতুন ম্যালওয়্যার কৌশল (2024)

5 neue Malware-Techniken zum Stehlen Ihrer Kryptowährungen (2024)

5 nuevas técnicas de malware para robar tus criptomonedas (2024)

5 nouvelles techniques de malware pour voler vos crypto-monnaies (2024)

आपकी क्रिप्टो चोरी करने की 5 नई मैलवेयर तकनीकें (2024)

暗号資産を盗む 5 つの新しいマルウェア手法 (2024)

암호화폐를 훔치는 5가지 새로운 맬웨어 기술(2024)

5 novas técnicas de malware para roubar suas criptomoedas (2024)

5 новых вредоносных методов кражи вашей криптовалюты (2024)

Kripto Paranızı Çalmak İçin 5 Yeni Kötü Amaçlı Yazılım Tekniği (2024)

5 Kỹ thuật phần mềm độc hại mới để đánh cắp tiền điện tử của bạn (2024)

5 种窃取加密货币的新型恶意软件技术 (2024)

How to Build-in Security as a SaaS Feature: A Guide

কিভাবে একটি SaaS বৈশিষ্ট্য হিসাবে বিল্ড-ইন নিরাপত্তা: একটি গাইড

So integrieren Sie Sicherheit als SaaS-Funktion: Eine Anleitung

Cómo incorporar la seguridad como una característica SaaS: una guía

Comment intégrer la sécurité en tant que fonctionnalité SaaS : un guide

SaaS फीचर के रूप में सुरक्षा को कैसे शामिल करें: एक गाइड

SaaS 機能としてセキュリティを組み込む方法: ガイド

SaaS 기능으로 보안을 구축하는 방법: 가이드

Como incorporar segurança como um recurso SaaS: um guia

Как встроить безопасность в качестве функции SaaS: руководство

Bir SaaS Özelliği Olarak Güvenlik Nasıl Yerleştirilir: Bir Kılavuz

Cách tích hợp bảo mật dưới dạng tính năng SaaS: Hướng dẫn

如何将安全性作为 SaaS 功能内置：指南

Welcome, As a Spammer of the registry (pun intended), I want to explain to you what's going on with the NPM registry and its management. At first, I felt the title `It's Party Time For NPM Spammers🥳` was offensive, unlawful, or disrespectful, and I also asked for help from an AI chatbot. I got the following results, but I purposefully stayed with the same to get attention from both NPM and the dev community. AI Chatbot: Certainly! Here are some alternative titles for your blog post on spammers in the NPM registry: “Navigating the Murky Waters: A Deep Dive into NPM Registry Spam”
“Guarding the NPM Gates: Strategies to Combat Registry Spam”
“Unmasking the Shadows: Inside the World of NPM Registry Spammers” Let's start with some basics. I request that you take a close look at the forthcoming screenshots. What is NPM? It is the world's largest software registry and a Node Package Manager for the JavaScript programming language maintained by Microsoft's npm, Inc. Types of Spam Let's list out some with my experience and a few real examples currently living in the registry. Keyword Stuffing:
Packages using irrelevant keywords to appear in more search results.



Malicious Code:
Packages containing harmful code or backdoors.


Rewarding decentralized protocol (New Type):
These packages were created to get some incentives from the OSS blockchain technology. You can learn more from here.




Fake Packages:
Impersonating popular packages to deceive users.


Low-Quality Packages:
Flooded with typos, irrelevant content, or empty functionality.



Bot-Generated Packages:
Automated spam submissions.



Phishing Attempts:
Packages designed to steal sensitive information.


Dependency Spam:
Malicious packages as dependencies of legitimate ones.


Hello World Packages (Low priority issue):
The students & learners try their first-time packages.



Weird Packages:
There are many packages with index.js file containing a comment which says something like the below and I try to understand with the google translator, no luck, if you got it, please let me know in the comments. Fancy Packages Control:
These kinds of users acquire short package names. NOTE: This list excludes security related malicious packages as they are often reported by the experts. Some notable past incidents: https://www.sonatype.com/resources/blog/npm-flooded-with-748-packages-that-store-movies
https://thehackernews.com/2023/09/fresh-wave-of-malicious-npm-packages.html
https://thehackernews.com/2023/08/malicious-npm-packages-found.html Some Spammers List Here, I am going to list some of them because it is simply not possible to list all of them here, also, with the number of packages published by each one. https://www.npmjs.com/\~onedionysc - 6931


https://www.npmjs.com/\~shivamkalsi2024 - 997


https://www.npmjs.com/\~79w - 551


https://www.npmjs.com/\~ellentea - 599


https://www.npmjs.com/\~uirewikilabs - 323


https://www.npmjs.com/\~quinterochris100 - 361


https://www.npmjs.com/\~vanthuanbt26 - 250


https://www.npmjs.com/\~tiengiangb47 - 230


https://www.npmjs.com/\~swenkertreanpm - 227


https://www.npmjs.com/\~loandinhb931 - 224 These are my random picks, and who knows how many of them are. The Team's Response The Problem The problem is not the spammers, as they always will be, but the real problem is within the management. Take, for example: If someone reports this via one of your support forums, the reply they get is simply redirection; they are redirecting you to fill out their respective forms for spam submissions. What if the reporter did not want to do extra work here? The important thing to note here is that the spammers and their packages live happily, even after we provide the absolute spam users and their package links. Conclusion I am writing this blog because I waited too long for them to fix it. Justice delayed is justice denied
- William Blackstone Please don't forget to check out our important Articles: Introducing Our New JavaScript Standard Library
You Don’t Need JavaScript Native Methods! Happy coding! 🚀 🙏 Thanks for reading. Welcome, As a Spammer of the registry (pun intended) , I want to explain to you what's going on with the NPM registry and its management. Spammer ( pun intended ) pun intended At first, I felt the title ` It's Party Time For NPM Spammers🥳 ` was offensive, unlawful, or disrespectful, and I also asked for help from an AI chatbot. I got the following results, but I purposefully stayed with the same to get attention from both NPM and the dev community. It's Party Time For NPM Spammers🥳 AI Chatbot : Certainly! Here are some alternative titles for your blog post on spammers in the NPM registry: AI Chatbot “Navigating the Murky Waters: A Deep Dive into NPM Registry Spam” “Guarding the NPM Gates: Strategies to Combat Registry Spam” “Unmasking the Shadows: Inside the World of NPM Registry Spammers” “Navigating the Murky Waters: A Deep Dive into NPM Registry Spam” “Navigating the Murky Waters: A Deep Dive into NPM Registry Spam” “Guarding the NPM Gates: Strategies to Combat Registry Spam” “Guarding the NPM Gates: Strategies to Combat Registry Spam” “Unmasking the Shadows: Inside the World of NPM Registry Spammers” “Unmasking the Shadows: Inside the World of NPM Registry Spammers” Let's start with some basics. I request that you take a close look at the forthcoming screenshots. What is NPM? It is the world's largest software registry and a Node Package Manager for the JavaScript programming language maintained by Microsoft's npm, Inc. Types of Spam Types of Spam Let's list out some with my experience and a few real examples currently living in the registry. Keyword Stuffing:
Packages using irrelevant keywords to appear in more search results. Malicious Code:
Packages containing harmful code or backdoors. Rewarding decentralized protocol (New Type):
These packages were created to get some incentives from the OSS blockchain technology. You can learn more from here. Fake Packages:
Impersonating popular packages to deceive users. Low-Quality Packages:
Flooded with typos, irrelevant content, or empty functionality. Bot-Generated Packages:
Automated spam submissions. Phishing Attempts:
Packages designed to steal sensitive information. Dependency Spam:
Malicious packages as dependencies of legitimate ones. Hello World Packages (Low priority issue):
The students & learners try their first-time packages. Weird Packages:
There are many packages with index.js file containing a comment which says something like the below and I try to understand with the google translator, no luck, if you got it, please let me know in the comments. Keyword Stuffing: Packages using irrelevant keywords to appear in more search results. Keyword Stuffing : Keyword Stuffing Packages using irrelevant keywords to appear in more search results. Malicious Code: Packages containing harmful code or backdoors. Malicious Code : Malicious Code Packages containing harmful code or backdoors. Rewarding decentralized protocol (New Type): These packages were created to get some incentives from the OSS blockchain technology. You can learn more from here. Rewarding decentralized protocol (New Type) : Rewarding decentralized protocol (New Type) These packages were created to get some incentives from the OSS blockchain technology. You can learn more from here . learn more from here Fake Packages: Impersonating popular packages to deceive users. Fake Packages : Fake Packages Impersonating popular packages to deceive users. Low-Quality Packages: Flooded with typos, irrelevant content, or empty functionality. Low-Quality Packages : Low-Quality Packages Flooded with typos, irrelevant content, or empty functionality. Bot-Generated Packages: Automated spam submissions. Bot-Generated Packages : Bot-Generated Packages Automated spam submissions. Phishing Attempts: Packages designed to steal sensitive information. Phishing Attempts : Phishing Attempts Packages designed to steal sensitive information. Dependency Spam: Malicious packages as dependencies of legitimate ones. Dependency Spam : Dependency Spam Malicious packages as dependencies of legitimate ones. Hello World Packages (Low priority issue): The students & learners try their first-time packages. Hello World Packages (Low priority issue) : Hello World Packages (Low priority issue) The students & learners try their first-time packages. Weird Packages: There are many packages with index.js file containing a comment which says something like the below and I try to understand with the google translator, no luck, if you got it, please let me know in the comments. Weird Packages: Weird Packages: There are many packages with index.js file containing a comment which says something like the below and I try to understand with the google translator, no luck, if you got it, please let me know in the comments. Fancy Packages Control:
These kinds of users acquire short package names. Fancy Packages Control: These kinds of users acquire short package names. Fancy Packages Control : Fancy Packages Control These kinds of users acquire short package names. NOTE : This list excludes security related malicious packages as they are often reported by the experts. NOTE Some notable past incidents: https://www.sonatype.com/resources/blog/npm-flooded-with-748-packages-that-store-movies https://thehackernews.com/2023/09/fresh-wave-of-malicious-npm-packages.html https://thehackernews.com/2023/08/malicious-npm-packages-found.html https://www.sonatype.com/resources/blog/npm-flooded-with-748-packages-that-store-movies https://www.sonatype.com/resources/blog/npm-flooded-with-748-packages-that-store-movies https://thehackernews.com/2023/09/fresh-wave-of-malicious-npm-packages.html https://thehackernews.com/2023/09/fresh-wave-of-malicious-npm-packages.html https://thehackernews.com/2023/08/malicious-npm-packages-found.html https://thehackernews.com/2023/08/malicious-npm-packages-found.html Some Spammers List Here, I am going to list some of them because it is simply not possible to list all of them here, also, with the number of packages published by each one. https://www.npmjs.com/\~onedionysc - 6931 https://www.npmjs.com/\~shivamkalsi2024 - 997 https://www.npmjs.com/\~79w - 551 https://www.npmjs.com/\~ellentea - 599 https://www.npmjs.com/\~uirewikilabs - 323 https://www.npmjs.com/\~quinterochris100 - 361 https://www.npmjs.com/\~vanthuanbt26 - 250 https://www.npmjs.com/\~tiengiangb47 - 230 https://www.npmjs.com/\~swenkertreanpm - 227 https://www.npmjs.com/\~loandinhb931 - 224 https://www.npmjs.com/\~onedionysc - 6931 https://www.npmjs.com/\~onedionysc - 6931 https://www.npmjs.com/\~onedionysc 6931 https://www.npmjs.com/\~shivamkalsi2024 - 997 https://www.npmjs.com/\~shivamkalsi2024 - 997 https://www.npmjs.com/\~shivamkalsi2024 https://www.npmjs.com/\~79w - 551 https://www.npmjs.com/\~79w - 551 https://www.npmjs.com/\~79w https://www.npmjs.com/\~ellentea - 599 https://www.npmjs.com/\~ellentea - 599 https://www.npmjs.com/\~ellentea https://www.npmjs.com/\~uirewikilabs - 323 https://www.npmjs.com/\~uirewikilabs - 323 https://www.npmjs.com/\~uirewikilabs https://www.npmjs.com/\~quinterochris100 - 361 https://www.npmjs.com/\~quinterochris100 - 361 https://www.npmjs.com/\~quinterochris100 https://www.npmjs.com/\~vanthuanbt26 - 250 https://www.npmjs.com/\~vanthuanbt26 - 250 https://www.npmjs.com/\~vanthuanbt26 https://www.npmjs.com/\~tiengiangb47 - 230 https://www.npmjs.com/\~tiengiangb47 - 230 https://www.npmjs.com/\~tiengiangb47 https://www.npmjs.com/\~swenkertreanpm - 227 https://www.npmjs.com/\~swenkertreanpm - 227 https://www.npmjs.com/\~swenkertreanpm https://www.npmjs.com/\~loandinhb931 - 224 https://www.npmjs.com/\~loandinhb931 - 224 https://www.npmjs.com/\~loandinhb931 These are my random picks, and who knows how many of them are. The Team's Response The Problem The problem is not the spammers, as they always will be, but the real problem is within the management. Take, for example: If someone reports this via one of your support forums, the reply they get is simply redirection; they are redirecting you to fill out their respective forms for spam submissions. What if the reporter did not want to do extra work here? extra The important thing to note here is that the spammers and their packages live happily, even after we provide the absolute spam users and their package links. Conclusion I am writing this blog because I waited too long for them to fix it. Justice delayed is justice denied - William Blackstone Justice delayed is justice denied Justice delayed is justice denied - William Blackstone Please don't forget to check out our important Articles: important Introducing Our New JavaScript Standard Library You Don’t Need JavaScript Native Methods! Introducing Our New JavaScript Standard Library Introducing Our New JavaScript Standard Library Introducing Our New JavaScript Standard Library You Don’t Need JavaScript Native Methods! You Don’t Need JavaScript Native Methods! You Don’t Need JavaScript Native Methods! Happy coding! 🚀 🙏 Thanks for reading.

It's Party Time For NPM Spammers🥳

Let's learn about via these 64 free stories. They are ordered by most time reading created on HackerNoon. Visit the to find the most read stories about any technology. Noonies Nominees /Learn Repo 1. Noonies Nominee Bader is Obsessed with Web3 and Blockchain I’m a web3 developer, and content creator, and generally love creating ideas from nothing - even if they don’t make too much sense. 2. Noonies Interview: Meet Juni Nguyen, a Self-taught Web Developer 2021 Noonies Nominee General Interview with Juni Nguyen. 3. Noonie Nominee Luiz Rosa Can't Live Without PyCharm and Git Luiz Guilherme Fonseca Rosa from Brazil has been nominated for a 2020 Noonie as Hacker Noon Contributor of the Year - ALGORITHMS. The Noonies are Hacker Noon’s way of getting to know — from a community perspective —  what matters in tech today. So, we asked our Noonie Nominees to tell us. Here’s what Luiz had to share. 4. Noonies Nominee Mike Shine on Career Pivot, Technical Writing, and the Influence of Big Tech Mike Shine, a technical writer based in Seattle, WA, was nominated for a Noonies award for his writing contributions in 2021. Please vote for Mike! 5. On Memes, Bots, Humor, Tech Writing, and Life - Noonies Nominee Tomás Sirio Noonies Interview with Tomas Sirio, nominee for the HackerNoon Contributor of the Year - BOTS Award. 6. Internet Heroes Nominee Lisa Shares Why Climate-Focused Technology is Exciting Lisa Gibbons nominated for a noonies hackernoon award as contributor to Climate Change. 7. From Sustainable Agriculture to Programming - with Noonies Nominee Akis Loumpourdis I am Akis Loumpourdis, a 2021 Noonies Nominee. This is a  small interview to get to know me a bit better. 8. Our Most Significant Enhancements are Non-Technical: Interview with Noonies Nominee German Tebiev An Interview with 2022 HackerNoon Noonies nominee - German Tebiev. 9. In Love with Coding Puzzles: Interview with Noonies Nominee Abbey As a writer in the tech industry, I believe in documenting my growth. Learn more about me and my journey so far. 10. Hacking Synthetic Biology with Noonies Nominee Kahlil Corazo 2021 Noonies Nominee General Interview with Kahlil Corazo. Read for more on synthetic biology and genomics. 11. 2022 Noonies Programming Nominee Roy Derks on GraphQL, React, and More I’m Roy Derks! A tech speaker, writer and software developer from the Netherlands! I’ve been nominated for the categories below and if you've enjoyed anything 12. UX and Product Design Notes with Noonies Nominee,  Jordan Bowman An interview with  Jordan Bowman, Product Designer and Co-Creator of UX Tools; and 6x 2021 Noonies Nominee for Design Thinking, Product Design, UI; UX and more. 13. "Complaining only helps if you're prepared to do something about it" -Dawood Khan Masood Dawood Khan Masood from Pakistan has been nominated for a 2020 Noonie in the Back to the Internet category. The Noonies are Hacker Noon’s way of getting to know — from a community perspective —  what matters in tech today. So, we asked our Noonie Nominees to tell us. Here’s what Dawood had to share. 14. 2022 Noonies Nominee Veronika Vasileva on Programming, Python, and More Learn more about my views on my journey in the tech industry via the interview below. 15. 'I am Passionate About Implantable Brain-machine Interfaces': Noonies Nominee Altynbek Altynbek is nominated for Noonies award HackerNoon Contributor of the Year - Swift. 16. "Investors Expect a Company to Own Its IP," Josh Ephraim, Attorney (AMA) Josh Ephraim is startup attorney and associate at Gunderson Dettmer, where he specializes in the representation of emerging growth companies throughout the corporate lifecycle. In Ask Me Anything session with Hacker Noon community, Josh shared his expertise on startups scene, startups legal issues and more! 17. How To Review A Game Bryan Applegate, a nominee for several Noonies awards explains how he reviewed Darksiders III for HackerNoon and his thoughts on THQ Nordic's game in general. 18. Being 'Chief Geek' and Running 15 Websites with Noonies Nominee Mathias Hellquist So who TF is Mathias Hellquist and what is a "Chief Geek"? Read this interview to find out. 19. On the Love of Problem Solving & Programming: Noonies Nominee Sukhpinder Singh Noonies interview with Sukhpinder Singh, Senior Engineer at SourceFuse. 20. On Food Waste and Relevance of Privacy: Noonies Nominee Paran Sonthalia Noonies 2021 nominee, Paran Sonthalia, is still a Berkley student. But that didn't stop him on the mission of reducing food waste. Hear more from him here. 21. Think Big and Keep Growing: Interview with Noonies Nominee Vlad Gukasov First of all, a huge thanks to the HackerNoon community and staff for considering me worthy of this opportunity. 22. AMA with Lina Survila, Women in Tech awards nominee Lina Survila is Founder and Editor in Chief of an online magazine "Abstract Stylist" and Noonies nominee in Women in Tech award. 23. Breaking the Stigma of Mental Health with Amy Pravin Shah, Noonies Nominee 2021 Amy Pravin Shah has been nominated for Noonies 2021: HackerNoon Contributor of the Year - Mental Health. Here is her story. 24. Noonie Nominee Lane Wagner Wants to Gamify Education In these unprecedented times, people build unprecedented products, and contribute to the internet in unprecedented ways. One such impressive Hacker Noon contributor is Lane Wagner from the United States. 25. Meet Mark Helfman: #Noonie2021 Nominee, Crypto Writer, Owner of "Crypto is Easy" Newsletter From a career in politics to book publishing and crypto writing, Noonie nominee Mark Helfman shares his insights on crypto, finance, business, & more. 26. Noonies Interview: Khamisi Hamisi on Decentralization of Social Media Khamisi Hamisi is the Founder of Khamisi Digital and nominee of 3 HackerNoon Noonies awards. 27. Ax Sharma's Top 5 AMA Answers: from Black Mirror to Governmental Attacks Ax Sharma is Senior Security Researcher at Sonatype and engineer, who is passionate about perpetual learning. He is an expert in vulnerability research, software development, and web app security. 28. Hackernoon Editors Gave A Voice To My Writing - Noonies Interview with Samiran Mondal Hackernoon editors gave importance to my writing skills and today, I am doing this Interview 29. “I’m Tigerchops and I’m the CEO of me.” Contributor of the Year - GAME DEVELOPMENT. An Interview with Tigerchops 30. Carlo Occhiena, 2020 Noonie Nominee, is Interested in No-Code Solutions Carlo Occhiena from Italy has been nominated for a 2020 Noonie in the Future Heroes and Technology categories. The Noonies are Hacker Noon’s way of getting to know — from a community perspective —  what matters in tech today. So, we asked our Noonie Nominees to tell us. Here’s what Carlo had to share. 31. Noonies Nominee Vivek Tank on the Need of Creativity for Effective SEO 2021 Noonies Nominee General Interview with Vivek Tank. 32. Full Stack and True Black: Interview with 2022 Noonies Nominee Alexey Shepelev An interview with 2022 HackerNoon noonies nominee Alexey Shepelev 33. Teamwork, Humor and Fintech: Interview with 2022 Noonies Nominee Valerie Ejegi An interview with 2022 HackerNoon Noonies nominee, Valerie Ejegi. 34. "It's not necessary to be No. 1 in everything" - Nibu P Rajoo, 2020 Noonie Nominee You know that feeling when you work really hard on something for really long and it feels like nobody really notices? Hacker Noon’s Annual Tech Industry Awards, the 2020 Noonies, are here to help with that. 35. "Coffee is overrated" - William Kwan, 2020 Youtuber Noonie Nominee William Kwan from Canada has been nominated for a 2020 Noonie in the Technology category. The Noonies are Hacker Noon’s way of getting to know — from a community perspective —  what matters in tech today. So, we asked our Noonie Nominees to tell us. Here’s what William had to share. 36. "We will mostly live in virtual worlds in the future." - Timmu Tõke, 2020 Noonie Nominee Timmu Tõke from the United States has been nominated for a 2020 Noonie in the Future Heroes and Technology categories. The Noonies are Hacker Noon’s way of getting to know — from a community perspective —  what matters in tech today. So, we asked our Noonie Nominees to tell us. 37. HackerNoon Contributor Celine “Oibiee” Aju on Tech, HackerNoon, and the Arts As a tech writer, I believe that the most exciting technology of the present is ED-TECH because it gives us the opportunity to move from the assembly line appro 38. Eko Simanjuntak, 2020 Noonie Nominee, Loves to Explore Cloud Native Technologies Go on, make a fellow human’s day and nominate the best YOUR best of 2020’s tech industry for a 2020 #Noonie, the tech industry’s most independent and community-driven awards: NOONIES.TECH. 39. "We are repeating history faster and at a greater scale" - Stacey Schneider, 2020 Noonie Nominee Stacey Schneider from the United States has been nominated for a 2020 Noonie in the Future Heroes and Technology categories. The Noonies are Hacker Noon’s way of getting to know — from a community perspective —  what matters in tech today. So, we asked our Noonie Nominees to tell us. Here’s what Stacey had to share. 40. 2021 Noonies Nominee Interview with Sarrah Pitaliya Who is she and what's behind her passion for technical writing? 41. Matt Hartley, 2020 Noonie Nominee, is Learning About React Hooks The 2020 Noonies are here and they are both much greener and much bigger than last year. Among the 2,000+ deserving humans nominated across 5 categories for over 200 award titles, we discovered Matt Hartley from the United Kingdom, who’s has been nominated for a Noonie in the Future Heroes and Technology categories. Without further ado, we present to you, our big techy world, from the perspective of Matt. 42. Brian Wallace AMA on Infographics, Startups and LinkedIn Optimization Brian Wallace is the Founder and President of NowSourcing , an industry leading infographic design agency based in Louisville, KY and Cincinnati, OH which works with companies that range from startups to Fortune 500s. Brian has been named a Google Small Business Advisor for 2016-present and joined the SXSW Advisory Board in 2019. 43. Liyas Thomas, 2020 Noonie Nominee, is the Creator of Postwoman.io Liyas Thomas from India has been nominated for a 2020 Noonie Award in the Software Development and Technology categories. The Noonies are Hacker Noon’s way of getting to know — from a community perspective —  what matters in tech today. So, we asked our Noonie Nominees to tell us. Here’s what Liyas had to share. 44. Being Told I Could Not Write Inspired Me to Publish on HackerNoon - Noonies Nominee no-name-c3po I want to thank the HackerNoon community and staff for their nomination in the Web 3 category. 45. DevPool, #Noonies2021 Nominee: “I would invest in the next generation of new developers.” Learn more about Artem- the developer behind DevPool via this Noonies interview 46. "There is no Failure, only Feedback"  - 5x Noonies Winner Christian Kameir Interview with Noonies Nominee Christian Kameir 47. "I aggressively applied to hundreds of different startups" #2021Noonies Nominee Lomit Patel has been nominated in the 2021 Noonies Awards: The most #democra-tech awards system! The first step to choosing the right career is self-awareness. 48. Meet Derek Lim - #Noonie2021 Nominee, Founder of Crypto Research Community Fincade "Blockchain, Blockchain, Blockchain" - CEO of Verse. 49. Aremu Adebisi on Tech Writing, the Future of Finance, and 2022 Noonies Nomination 2022 Noonies Nominee Interview with Aremu Adams Adebisi on Tech Writing & the Future of Finance 50. Racial Discrimination in Facial Recognition is a Challenge - With Noonies Nominee Alesia Traichuk 2021 Noonies Nominee General Interview with Alesia Traichuk 51. Our Ancestors Could Have Solved Food Scarcity With AI - Noonies Nominee TRex 52. Koushik Pal: 'Knowledge Should Be Free' An interview of a great cybersecurity leader. 53. CodeBucks, #Noonies2021 Nominee: I would not invest in cryptocurrency Self taught developer CodeBucks is most excited about Jam Stack anc Web3.0 54. Noonie Nominee Jimmy Song is Excited About The Prospect of Bitcoin Changing Civilization Jimmy Song  from the United States has been nominated for a 2020 Noonie in the Decentralization and Back to the Internet categories. The Noonies are Hacker Noon’s way of getting to know — from a community perspective —  what matters in tech today. So, we asked our Noonie Nominees to tell us. Here’s what Joseph had to share. 55. Web3, Blockchain, and DAO: An Interview With 2022 Noonies Nominee Olayimika Oyebanji A web3 tech writer who loves keeping it S & S. 56. "Buy Bitcoin" is the Best Advice #Noonies2021 Nominee Sergei Khitrov Has Ever Received Hey Hackers! I’ve been nominated in these two following categories :  HackerNoon's DeFi Degen of 2021 and HackerNoon's NFT Wizard of 2021. 57. Adadot Founder Alex on Building a Analytics Tool and being Nominated For #Noonies 2022 I’m Alex and I’m the Founder at Adadot. 58. Maritime Service and Full Stack JS: Interview with 2022 Noonies Nominee, Serhii Rubets This short story is about me, and how I become a software engineer. Why I'm sharing my knowledge and why I create educational content. 59. Blue is Happiness: Interview with 2022 Noonies Nominee Anastasios 60. Technology Keeps Changing with Noonies Nominee Aswin Barath 61. Vasily Sumanov, 2020 Noonie Nominee, is a Crypto Enthusiast and Material Sciences Academic Vasily Sumanov from Russia has been nominated for a 2020 Noonie in the Future Heroes category. The Noonies are Hacker Noon’s way of getting to know — from a community perspective —  what matters in tech today. So, we asked our Noonie Nominees to tell us. 62. "I would rather feel machine judging me, than people judging me" - Jeremy Morgan during AMA Jeremy Morgan is 5x Noonies nominee and an author for Pluralsight focused on Software Development and Integration. 63. Vasily Sumanov, 2020 Noonie Nominee, is a Crypto Enthusiast and Material Sciences Academic Vasily Sumanov from Russia has been nominated for a 2020 Noonie in the Future Heroes and Technology categories. The Noonies are Hacker Noon’s way of getting to know — from a community perspective —  what matters in tech today. So, we asked our Noonie Nominees to tell us. Here’s what Vasily had to share. 64. Hacker Noon Awards: #Noonies 2019—Full Nominees List The world’s most independent tech publication, Hacker Noon—where hackers start their afternoons, just partnered with Stream.io to present the inaugural Noonies 2019: The Tech Industry's Greenest Awards. Thank you for checking out the 64 most read stories about Noonies Nominees on HackerNoon. to find the most read stories about any technology. Visit the /Learn Repo

64 Stories To Learn About Noonies Nominees

311 Stories To Learn About Noonies

Over the past few years, open source has become increasingly polarised. On one side, there are those committed to the Open Source Initiative (OSI) definition of open source. On the other side, there have been multiple commercial open source vendors that have moved to licenses that are not OSI-approved. What does this mean for open source in 2024? How can the open source community protect its position and ensure that open source software continues to be the first option for new software projects? Companies release their software under an open source license to get critical mass, grow their communities and develop a potential customer base more efficiently. However, they then see competitors using that same software to build their own products or services that compete with them. Many big names in open source have shifted to a non-open source license to protect their perceived market share and prevent competitors. However they also damaged the reputation of open source in general. These vendors want the benefits that open source offers around community, market reach and developer access, but they don’t want to give up their control and they want to lock out competitors. Resolution #1: There’s been a loss of trust in open source. We have to fix that For those of us that believe in open source, this is painful. Open source software is valuable because of the community approach that it supports and because it keeps control in the hands of developers that choose software. Without trust in open source as a basis for community development and access to software, everyone loses out. The answer is that we need more approaches to open source that reflect the needs of the community, not a single company. We have to steer away from the venture capital funding model that demands growth at all costs followed by an IPO or acquisition. Open source foundations represent the needs of the community and all the members involved. They can act as stewards for projects once they have achieved that critical mass, and represent the community more effectively. Individual companies can also improve how they manage and contribute to the open source community alongside their own business needs. Companies like Confluent and DataStax are successful examples of how to separate the open source project, managed by and for the community, and the products that are aimed at customers. In 2024, more open source companies will have to follow their lead and build both business models and community support together, rather than treating them as separate goals. Over the last few years, there have been many calls to evolve the open source definition (OSD), which was put together before the advent of cloud computing and ‘as a Service’ providers. Resolution #2: We have to talk about our approach to defining open source Companies using licenses like the Server Side Public License (SSPL) or Elastic License argue that they are protecting their projects and keeping them viable, rather than letting them be exploited by competitors that don’t pay back to the community. Others argue that open source lets malware creators and other bad actors benefit from software developed by the community, so we should restrict who could potentially use those projects. These arguments have some good points but they go against the primary ethos of open source that everyone should be able to use software for projects as they see fit. However, open source can’t stand still indefinitely. What started decades ago based on the work of a small but united group of Free and Open Source Software enthusiasts has grown and evolved into multiple groups with different needs and different visions. Proponents of Source Available Licenses with Ethical or Non-Compete restrictions do not see themselves in the same group as Proprietary software, where you do not have access to the source code and can be prevented from doing other things too. The OSD provides clarity on what can be considered open source and what is not. However, it is easy to see this as two camps that are pitted against each other, when the truth is that there are lots more options available. There is a huge difference in what you can actually do with software that is licensed under the BSD License compared to AGPL 3.0. Each of these licenses exists for a reason. The difference is that open source is about more than free access to software, though that is a major plus point for many that use it. Instead, it is about control. Open source should be about much more than just the license used for a given piece of software; it is about the community, the governance model for the future of the project, and the value that the project can create over time. However, the license is what provides control over how that software can be used. Without this open and frank discussion around the future of open source, we risk losing what is so important about open source in the first place. Without a strong open source community, we risk handing control back to vendors over what can and can’t be done with software. In the technology industry, change takes place all the time, but predicting where the next big leap will take place is hard. For example, AI had been here for decades before ChatGPT launched and generative AI got so much interest. For an outside observer, it might have looked like nothing was happening, but then everything changed. Like a chicken growing inside an egg, there was a lot going on before the breakout moment, and there were many developments and false starts. Resolution #3 - We have to think harder about the future for projects, good and bad What does this mean for open source? It means responding to huge changes in the market as they take place, with new projects reaching a bigger audience than they ever thought possible based on what else is taking place in the market. It means that developers and project leaders have to understand what might happen to them and the projects that they are working on. At the same time, many open source projects don’t make the impact that they should or fall out of favour. According to research from Sonatype, only of open source projects are ‘actively maintained’ by their creators or communities, and this represented an increase of 18 percent over the previous year. Should developers think about handing on control to the source code, letting another person take over leadership on a project? How can a federation or foundation take over when a business or individual can’t generate enough revenue to cover their costs? And what happens to those older projects that are still used, but are not actively maintained? 11 percent Talking about sustainability for open source involves thinking about projects that might not have a commercial market opportunity but that need to be supported over time. They may be embedded into other software tools or operating systems, and they need to be looked after where they are viable, and replaced where they are not. The last resolution should be to think about where you can get involved and support contributors and maintainers in these efforts during 2024.

Resolutions for Open Source in 2024 - What Has to Change?

2024 সালে ওপেন সোর্সের জন্য রেজোলিউশন - কি পরিবর্তন করতে হবে?

Vorsätze für Open Source im Jahr 2024 – Was muss sich ändern?

Resoluciones para el código abierto en 2024: ¿qué tiene que cambiar?

Résolutions pour l'Open Source en 2024 - Qu'est-ce qui doit changer ?

2024 में ओपन सोर्स के लिए संकल्प - क्या बदलना होगा?

2024 年のオープンソースに対する決意 - 何を変える必要があるか?

2024년 오픈소스에 대한 결의안 - 무엇이 바뀌어야 할까요?

Resoluções para código aberto em 2024 – O que precisa mudar?

Решения для открытого исходного кода в 2024 году – что должно измениться?

2024'te Açık Kaynak Kararları - Neler Değişmeli?

Các nghị quyết về Nguồn mở vào năm 2024 - Điều gì phải thay đổi?

2024 年开源决议 - 哪些内容必须改变？

Stories, News & Mentions about SONATYPE

Sonatype’s Stories on HackerNoon