Gajendra Deshpande

Django being one of the most popular Python-based web frameworks, applications developed using Django are always on the radar of hackers who try to find the vulnerabilities in the Django application and exploit the same for their benefit. This talk will discuss how to secure Django Web applications.

Security is of utmost importance to most applications in general and web applications in particular. Django being one of the most popular Python-based web frameworks, applications developed using Django are always on the radar of hackers who try to find the vulnerabilities in the Django application and exploit the same for their benefit. Many times security is ignored or not well done due to a lack of awareness and the cost associated with it. But Security is too costly to be ignored. Although Django has many built-in security features, they are not sufficient to safeguard the application. The talk begins with highlighting the importance of security and identifying security issues in Django applications using the Mozilla Observatory tool, then using the recommendations of the tool to secure them. Next, I will compare and contrast Mozilla’s Web Security recommendations and Open Web Application Security Project(OWASP) Top 10 recommendations. Next, I will discuss built-in security features in Django. Finally, I will discuss the configuration settings and issues that may affect the secure deployment of Django applications. Outline 1. Importance of Security with respect to Web applications (02 Minutes) 2. Identifying security issues using Mozilla Observatory (05 Minutes) 3. OWASP Top 10 issues and how to address them in Django (08 Minutes) 4. Built-in Security features in Django (08 Minutes) 5. Secure Deployment of Django applications (04 Minutes) 6. Summary and Questions (03 Minutes)

Live stream: https://youtu.be/tHlMw9zFgQE Popular programming language index websites (TIOBE index) and developer surveys (Stack Overflow) place Python as one of the fastest-growing programming languages. However, this popularity also puts in the target range of attackers. The attackers perform malicious dependency attacks and use misconfiguration tools to reveal confidential information. In this talk, we will discuss identifying common security issues in Python code and handling malicious dependency attacks using safety.

Popular programming language index websites (TIOBE index) and developer surveys (Stack Overflow) place Python as one of the fastest-growing programming languages. However, this popularity also puts in the target range of attackers. The attackers perform malicious dependency attacks and use misconfiguration tools to reveal confidential information. Jukka Ruohonen, Kalle Hjerppe, and Kalle Rindell in their research paper "A Large-Scale Security-Oriented Static Analysis of Python Packages in PyPI" claimed that they scanned PyPI for security issues in Python packages and found the presence of at least one security issue in about 46% of the Python packages. In addition, security vulnerabilities can be present in the source code of the package. In this talk, we will address the security issues related to python packaging and possible solutions to make python packages secure. The talk begins with the importance of a secure package and vulnerabilities in the Python package index. Then, I will discuss Python packages such as Bandit for identifying common security issues in Python code and “safety” for dependency check. Next, I will discuss verifying and signing Python packages using GPG. Finally, I will discuss general guidelines for secure coding practices in Python. Outline 1. Importance of a secure package and vulnerabilities in python package index. (05 Minutes) 2. Bandit for identifying common security issues in Python code (03 Minutes) 3. safety for dependency check (04 Minutes) 4. Verifying and signing PyPI and conda packages using GPG and Twine(05 Minutes) 5. General guidelines for secure coding practices in Python (05 Minutes) 6. Summary and Questions (03 Minute )

Are you an educator who wants to design teach an industry-aligned curriculum? Then you have come to the right place. In this talk, we will show how to design a better curriculum using natural language processing libraries in python, i.e., spaCy and Textacy.

The curriculum in the general and undergraduate curriculum, in particular, is one of the most important pillars of an education system. The undergraduate curriculum has two main objectives i.e. employability and higher education. The greatest challenge in designing an undergraduate curriculum is achieving a balance between employability skills and laying the foundation for higher education. Generally, the curriculum is a combination of core technical subjects, professional electives, humanities, and skill-oriented subjects. We used natural language processing and machine learning packages in Python to build a curriculum design system.

The steps to build a curriculum design system are described below: 1. The dataset was built from the job profiles from different job listing websites like stackoverflow.com, indeed.com, linkedin.com, and monster.com. Also from the syllabus of competitive exams and qualifying exams for higher education. 2. On the dataset, we applied natural language processing techniques to identify the subjects and subject content. For natural language processing, we used spaCy an industrial-strength Natural Language Processing package in Python. 3. To generate syllabus content for a particular subject, a pointer-generator network was used. The pointer generator network is a text summarization technique that combines extractive and abstractive summarization techniques. The extractive summarization technique extracts keywords from the dataset, whereas the abstractive summarization technique generates new text from the existing text. The pointer-generator network was implemented using the scikit-learn machine learning package in Python. 4. The generated curriculum was then compared with the existing curriculum to get insights like, how much percent of the curriculum is industry oriented, how much percent of the curriculum is aimed at higher education and job-oriented skills. At this step, we used the ROGUE (Recall-Oriented Understudy Gisting Evaluation) metric to compare the generated curriculum against the reference/proposed curriculum 5. The above steps can be repeated with modified parameters to get better insights and curriculum.

This also gives us an idea of how we can have an evolving curriculum that can help us bridge the gap between industry and academia.

Other people: Matteo Bertucci