In an environment where artificial intelligence generates code at breakneck speed, the difference between success and chaos no longer lies in how fast we type, but in the precision of what we decide to build. AI tools are extremely powerful, but they still suffer from blank page syndrome or development without a compass if they are not fed structured context.

When we delegate or develop a project (whether alone, with a human team, or collaborating with AI agents), the lack of clear specifications generates redundant code, fragile architectures, and endless refactoring loops.

The Audacious Experiment and its Foundations

In the heart of Silicon Valley, a cybersecurity startup is about to revolutionize the industry. Its secret weapon is not a more robust firewall or a more advanced intrusion detection system, but something unexpected: the DO-178C standard, the cornerstone of security in aeronautical software, now applied to the digital domain.

This bold decision raises a provocative question: Can the approach that keeps our skies safe transform our security in cyberspace?

Retriever-And-Generator (RAG) models and large language models (LLM) are advanced components of artificial intelligence in the field of natural language processing (NLP).

A RAG, in the context of artificial intelligence, refers to “Retriever-And-Generator”. It is a type of artificial intelligence model that combines two main components to improve text generation: an information retrieval system (the “Retriever”) and a generative language model (the “Generator”).

The information retrieval component is responsible for searching and retrieving relevant pieces of text from a large database or document corpus. This database can consist of internet texts, books, academic articles, among others. The goal is to find information that is relevant to the question or prompt provided.

In an increasingly digital world, the need to develop secure software has never been more pressing. While rapid innovation is essential to staying competitive, we can’t let security fall behind. This is where threat modeling comes into play, a proactive security technique that integrates seamlessly with modern software development approaches like OWASP’s Software Assurance Maturity Model (SAMM).

What is Threat Modeling and why is it Crucial?

Threat modeling is a systematic approach to identifying and evaluating potential risks in an application or system. It not only helps prevent security issues from the design stage, but also establishes a common understanding among developers, product managers, and security experts about which risks are most critical and how to address them. This activity becomes the cornerstone for other security practices, from architecture to incident response.

The art of fuzzing testing is an essential practice in any cybersecurity professional’s toolbox. Although the basis of this technique—supplying random inputs or “fuzz” to a system to identify errors—is simple, advanced applications of fuzzing can be complex and nuanced. In this article, we will explore advanced fuzzing techniques applied to JavaScript code and URLs, using the jsfuzz and wfuzz tools, respectively.

Fuzzing in JavaScript with jsfuzz

Step 1: jsfuzz configuration

In the realm of software development project management, the terms KPIs (Key Performance Indicators) and delivery dates are frequently mentioned, sometimes to the point of confusion. Both concepts are fundamental, but they serve different purposes and must be used together for the success of the project. In addition to these, there are other relevant metrics that can help measure specific aspects of a project or team’s performance. This article will break down each one and their importance in the field of software development.

In today’s digital age, authenticity and provenance of content are crucial. In a world where fake news and misinformation spread rapidly, we need a reliable solution to ensure the authenticity of content. That’s where the Authentication and Traceability of Non-AI Generated Content (ATCNIA) project comes in.

What is ATCNIA?

ATCNIA is an initiative that seeks to implement a distributed authentication and traceability network to guarantee the validity and origin of content that is not generated by Artificial Intelligence. This project focuses on the development of advanced encryption techniques and content verification mechanisms that, to date, have proven to be effective and secure.

The use of containers in application development has experienced rapid growth in recent years, thanks to the scalability, portability and efficiency they offer. However, as container adoption increases, so does the need to address potential security issues and ensure applications are secure and stable. In this article, we will explore how integrating container analytics into the continuous integration and continuous delivery (CI/CD) process can improve both security and efficiency in application development.

Fuzzing, also known as fuzz testing, is a security testing technique that involves sending random or malformed input to an application to identify possible vulnerabilities and flaws in it. In web applications, fuzzing is especially useful for uncovering security issues related to input validation and error handling. In this article, we will explore advanced fuzzing techniques applied to web applications and how they can improve the security of your application.

For decades, Gantt charts have been a widely used project management tool in various industries. However, in today’s world of rapid, agile development, these charts can become outdated and inefficient. In this article, we will analyze why Gantt charts are losing ground in the field of Agile methodologies and explore the best alternatives to apply in Agile projects.

The obsolescence of Gantt charts

Gantt charts were developed in the 1910s to manage mass production projects. Its linear and structured approach is ideal for projects with sequential stages and predictable timelines. However, Agile methodologies focus on adaptability, flexibility, and continuous iteration, making Gantt charts less suitable for these types of projects.

Dynamic Application Security Analysis (DAST) is a crucial methodology in the field of application security. DAST identifies runtime vulnerabilities through penetration testing of web and mobile applications. In this article, we will delve into advanced techniques and custom approaches in the context of DAST, including data flow analysis, integration with threat intelligence tools, and incorporating machine learning.

Among the advantages is the early detection of vulnerabilities, which allows security problems to be identified and corrected before they are deployed in the production environment. This reduces the risk of exposure and exploitation of security weaknesses. Additionally, incorporating DAST into the CI/CD workflow encourages collaboration between development and security teams, leading to more secure applications and greater security awareness across the team. Remediation costs and time are also reduced by addressing vulnerabilities early in development. Finally, implementing DAST helps organizations meet regulatory and auditing requirements by demonstrating that proactive measures have been taken to ensure application security and protect user data.

We have heard a lot about GPT-3, OpenAI and their trained models to implement your own AI in a fast and pre-trained way. The results of your demos are fascinating, but… are they really like that? or are they “ready”?

Well, raising that same question, I have decided to make an implementation to integrate your Telegram user with said AI and dockerize it, so that by configuring your keys from docker-compose.yml you can easily start the bot, and have it start answering this intelligence for you.

As I promised you in this week’s talk, here I leave you the presentation so that you can review what you learned in the session to start trading. I hope you find it helpful, and that you can grow in this very interesting line of FinTech.

If you are interested in the management script for Binary Operations alerts, it is published on github, you can download it and run it.

This week we have been able to enjoy the fourth edition of the Congreso Navaja Negra, in which Pancake has introduced us to the use of Radare2, an exceptional reversing Framework, with power, speed and functionalities that has nothing to envy of other commercials on the market.

We must recognize its complexity, but it is true that we are not exactly talking about a big button tool, but rather a very specific Framework aimed at professionals in this field.

Reverse engineering in Android applications is a harsh reality, and although there are several techniques to obfuscate code, it is possible to decompile and analyze a large part of the code in most applications.

An interesting distribution is Android Reverse Engineering (A.R.E.), which brings together many of the tools necessary to practice these techniques in a single virtual machine.

First of all, it must be made clear that ripping an app does not imply bad intentions, since it is very useful in the case of searching for malware inside something that seems harmless, and thus learning the techniques with which it is intended to deceive us.

When you work as an Android developer, you should try to get as many shortcuts as possible in order to improve your productivity. Here I leave you some simple tricks that every “code-picker” should have as a rule.

To connect a device, the cable is a problem in the long run, I personally recommend always doing it from the wireless network, either activating it by hand or more simply with applications like adbWireless.

Yocaina is a Mifare card reader for training in the development of applications and NFC cards, using XML code it is possible to define several types of cards, thus ensuring the differences between each of them.

You can download it from the Play Store from the link Yocaina or using the QR code

The application has been released under the LGPL license, and is prepared for the implementation of more types of cards, such as ISO 15693. You can contribute your code from the github repository:

Whenever you start developing on C++, the first thing you think is that it is an ugly, boring and archaic environment. After a while you realize the power and wonders that you can achieve with this programming language, and why it is still so widespread.

Today we are going to see how to generate some simple macros, which we can include in our most typical libraries, to be able to show the colored debug output, and thus differentiate between each output of our program in a more simple way.

Aztrino

Aztrino is one of the firmwares for the Azbox Me and MiniMe decoders based on the Neutrino platform. In order to develop on this environment, we first have to install some packages and start the configuration.

To begin, we prepare the environment, for example, from Ubuntu 12.04, at least you will have to run:

apt-get install cmake gperf

git clone git://gitorious.org/neutrino-hd/aztrino-buildsystem-cs.git

cd buildsystem-cs/

mkdir download

We edit the configuration file, executing

One of the advantages of Python code is the large number of libraries that are available, in this case we are going to use QtWebKit, with which we can easily create a browser or embed it within our application. We edit a file, for example pybrowser.py with the following content

#!/usr/bin/env python

import sys
from PyQt4.QtCore import *
from PyQt4.QtGui import *
from PyQt4.QtWebKit import *

app = QApplication(sys.argv)

web = QWebView()
web.load(QUrl("http://www.thempra.net"))
web.show()

sys.exit(app.exec_())

Y ya solo nos queda lanzar nuestro mini-navegador:

python pybrowser.py

A partir de aquí se ha de trabajar con los botones, barra de navegación , ......

Next Saturday, August 18, I will be at MUNCYT in La Coruña, with a talk on how to take brain wave readings with low-cost Electroencephalograms (EEG).  I will present the Theeg project and then Jose Angel Mateo will give a presentation on the DotNetClub.

Agenda

10:00-10:15 Presentation of the event and speakers. 10:15-11:00 ‘Theeg: Reading other people’s minds’ Theoretical session. 11:00-11:45 ‘Theeg: Reading other people’s minds’ Practical session. 11:45-12:00 Coffee break

12:00-12:45 ‘IEEE-UNED Microsoft DotNet Club’. 12:45-13:00 Farewell and closing.

I have been developing applications for mobile devices and AJAX developments for several years, and I thought the idea of ​​merging both was great. After studying many frameworks, I came to the conclusion that the one that best suited my needs was Phonegap, which with the purchase by Adobe after a while I realized that it was not exactly a mistake.

PhoneGap is an HTML5 application platform that allows you to author native applications with web technologies and gain access to APIs and app stores. Leverage web technologies to developers who already know best… HTML and JavaScript

Given the complexity and library dependencies that we are going to discuss, I recommend that the installation be carried out on a virtual machine, in this case we will use Ubuntu Server 12.04 LTS .

1. Preparing in environment

Once we have created the virtual machine (allocate about 100 GB of space, not all of them will be used, but it is better to have plenty of space), we proceed to install the libraries we need:

It is usual that after several years the space forecasts in a virtual machine are exceeded, in many cases because the project for which it has been destined is being a success and requires a larger storage size. What in principle may be a joy, also involves extra effort, since if the machine is in production, and we have more users, it means that we cannot turn off the machine for an hour to perform maintenance tasks. Thanks to XEN we can change the virtual hard disk without having excessive problems