►
From YouTube: GitHub ¡Presente! en Español
Description
Acompaña a Alexandra Bourne, Gerente de Proyectos, y a Jaime Sanchez, Ingeniero de Soporte de GitHub, a aprender acerca de nuevas tendencias en tecnología.
Tendremos a varios invitados especiales que compartirán mini charlas de 15-20 minutos en temas de tecnología, el uso de Git y GitHub y civismo tecnológico.
5:05 - Comenzar
14:28 - Alejandra Trejo es de Monterrey, México y actualmente trabaja en Google como ingeniera de software y previamente fue practicante en GitHub. Le apasiona todo lo relacionado al open source y a apoyar a que más mujeres aprendan a programar.
Alejandra nos dará una breve introducción a lo que es GitHub Learning Lab y cómo funciona. Hablará un poco de porqué es importante crear más contenido en español sobre programación y cómo fue la experiencia de trabajar en este proyecto en GitHub. Finalmente, les enseñará como aportar traducciones a los cursos de GitHub Learning Lab.
30:53 - Alvaro Muñoz trabaja como investigador de seguridad en GitHub Security Labs, donde ayuda a proteger el software de código abierto y a educar a los desarrolladores en programación defensiva. Muñoz ha presentado en las mas importantes conferencias de seguridad como BlackHat, DEFCON, RSA, OWASP, etc. y cuenta con varias certificaciones de seguridad de la información, incluidas OSCP, GWAPT y CISSP.
En seguridad, el "análisis de variantes" es el proceso de búsqueda de vulnerabilidades similares a una conocida. Este proceso solía hacerse con herramientas como grep y minuciosas auditorías de código manual, pero se puede automatizar con un potente lenguaje de consulta semántica como CodeQL. En esta charla mostrará cómo un análisis de variantes en Nexus Repository Manager terminó encontrando muchas otras vulnerabilidades críticas, incluida una ejecución remota de código (RCE) en la aplicación Corona-Warn-App de Alemania (la aplicación de seguimiento de contactos de Alemania).
57:20 - Adrián Bolonio es Engineering Team Lead, Senior Frontend Developer, y gran defensor de la Accesibilidad Web. Adrián es de Madrid, pero desde 2012 vivo y trabajo en Viena (Austria). Cuando no está en la oficina pueden encontrarlo disfrutando de una buena lectura, trabajando en alguna receta o practicando su hobby favorito, viajar.
Cuando desarrollamos una nueva web, a menudo ponemos mucho trabajo en el diseño, para que sea bonita y utilizable. Pero muchas veces no pensamos en la experiencia del usuario para las personas con discapacidades. Adrián nos hablará acerca de la accesibilidad (a11y) y su importancia y nos enseñará a hacer tests automatizados de accesibilidad web, bibliotecas y técnicas para aumentar la cobertura de tests de tu código con un simple ejemplo con una aplicación React.
https://github.co/Presente-Español
B
With
little
friends,
hello,
everyone
welcome
to
the
new
year's
present
in
spanish.
My
name
is
jaime
sánchez.
Yours
truly,
my
colleague
alejandra
on
a
donkey
going
up.
The
hill
super
fast
to
be
here
with
us,
but
in
the
meantime
it
is
very
good
to
translate
a
little
for
those
who
are
coming
for
the
first
time
to
our
do
to
our
little
space
to
our
little
house.
Like
I
said
my
name,
jaime
sánchez,
I
am
a
support
engineer
for
companies.
They
were
out
for
12-13
years,
the
seven
digits
something
more
than
me.
B
I
am
a
bookstore
owner
and
a
mexican
bakery
here
in
north
cabin
in
the
united
states,
just
originally
from
tijuana
mexico.
So
this
Spanish
comes
from
my
roots
and
burns
and
I
am
part
of
the
leaders
of
the
auto
cats.
If
you
don't
know
who
the
autocrats
look
for
us
on
twitter,
our
our
agent
of
soto,
auto
cats,
we
are
the
group
of
lati
us
in
latin
ex
on
github,
and
we
are
here
to
support
you
and
support
each
other
within
the
company.
B
We
are
very
happy
to
have
you
here
and
but
well,
a
quickie
of
what
is
going
to
happen
down
here.
It
remains
that
we
are
going
to
be
making
money
for
your
news
from
giza
five
minutes
in
which
I
am
going
to
talk
about
what
is
happening.
What
are
we
doing
to
make
this?
Give
up
better
for
you,
especially
our
dearest
people
in
Spain
and
in.
B
Three
practices:
three
super
good
talks.
The
truth
I
am
very
proud
of
the
speakers
that
we
have
today,.
They
are
very,
very
cool
people
and
diverse
topics,.
Well,
right
now
we
are
saving
him
from
the
tacos
and
from
there,.
As
for
those
who
have
been
here,,
we
are
going
to
have
a
survey,.
We
are
going
to
have
a
free
talk
in
the
one
who
can
ask
questions
can
make
a
joke,
keep
this
clean
and
we
will
see
what
you
want
and
well
without
further
ado
about
the
action
plan.
B
D
Hello,
well,
greetings
to
all
I
had
some
technical
difficulties,
but
well
I'm.
Here
now
and
well,
it's
a
pleasure
to
greet
you
all
well.
Well,
that's
alejandra!
For
those
who
don't
know
me
well,
I
work
as
basically
doing
sorry
being
a
technical
project
manager
on
github
as
what
they
call
here:
technical
project
manager
and
now
I'm
working
in
areas
of
international
expansion
and
accessibility
and
well
I'm.
Also
part
of
the
management
group
Of,
the
eight
cats
that,
like
you,,
some
of
you
already
know,.
D
B
Well,
of
course,
I
introduced
myself,
and
we
talked
a
bit
about
the
news
on
I'm,
sorry
about
how
things
work
and
well
when
I
wanted
to
enter
the
news
of
llíria
I
saw
what
we
are
doing,
but
I
left.
You
already
know
our
commitment
as
you
have
these
meetings
with
you
every
two
months
and
there
they
just
want
a
little
more
followed
by
let's
say,
and
it
will
continue
and
we
hope
after
all,
this
bad
situation
that
is
happening
with
the
cob
and
this
one,
well,.
B
We
have
a
little
more
face-to-face
to
have
is
with
you
and
throwing
popcorn
to
each
other,
whatever
falls.
But
what
are
you
chatting
and
to
know
what
it
is
that
you
mind?
We
also
have
another
commitment
to
you,
git
hub
stars.
If
you
haven't
seen
what
it's
like
to
go
hamsters,
please
check
the
link
super
beautiful
people.
B
Please
let
us
know
how
much
you
are
there
to
support
those
open
source
projects
that
people
at
hand
and
that
more
documentation
and
mobile
avs
translated
into
Spanish,
for
you
is
our
commitment
to
you
is
to
give
you
the
tools
you
need
to
develop
your
super
projects,
and,
well,.
What
else
can
we
do
but
translate
them
into
the
language
that
all
of
you
speak,?
B
Do
it
more
so
so
that
you
can
develop
wherever
you
want
and
have
the
information
you
need
in
case
you
have
questions
and,
of
course,
collaboration
with
the
auto
cats,
as
I
already
said
before,
huila
that
you,
my
friends,
show,
and
so
then
we
want
to
make
sure
that
they
do
n't.
Follow
us,
follow
you.
If
you
have
something
to
tell
us,
please
send
us
a
message
me.
There
is
between
him
and
me.
We
see
the
car
cats
account,
so
if
they
need
something,
if
they
want,
he
simply
stays
n
like
this,.
Where
is
it,?
B
Absolutely
yes,
and
then
say
this:
there
are
many
speakers
who
are
starting.
It
is
their
first
presentation,
don't
worry,
we
are
here
to
support
them
and
the
audience
you
are
in
the
decision
and
you
are
but
on
this
side
this
and
they
are
even
on
this
side.
We
are
going
to
help
in
whatever
way
and
if
you
are
just
starting
out,.
This
is
your
opportunity
to
present
something
that
you
are
passionate
about
and
you
can
polish
the
presentation
a
bit.
If
you
need
it,,
you
are
among
friends,
and,
well,
better,.
B
We
have
already
talked
a
lot,,
but
we
have
sent
so
many
sites,
that,
well,.
There
is
the
list
and
if
you
want
to
read
the
room
for
a
good
half
hour,
but
I,
don't
think
I
will
finish
it
and
well.
What
else
is
there?
We
have
the
roadmap
too.
Ok,
if
there
is
something
they
stay,
fern
I
am
looking
to
see
it
on
the
blog,.
B
More
probably,
it
is
on
its
way
and
the
rome
is
public,
so
you
can
see
it,,
you
can
see
it
whenever
you
want,,
you
can
have
it
as
the
marked
su
in
your
in
chrome.
If
you
need
it,,
who
else
the
community
forum
in
their
language?
Finally,
in
fact,
we
have
someone
out
there
who
is
looking
behind
the
scenes
at
our
dear
andrea
griffiths.
B
Well,
what
I
put
is
also
in
terms
of
the
community
in
Spanish.
If
you
want,
you
have
questions,
you
can
ask
them
in
your
own
language
and
in
fact,
if
you
have
answers
and
well-
and
they
will
receive
then
also.
The
good
thing
is
that
they
can
now
submit
their
questions
in
Spanish,
spanish.
Well,
there.
It
is,
in
fact
they
go
to
their
profile,
change
the
language
and
that
easy.
D
D
D
D
Course,
and
well
,.
Today
we
are
here
with
alejandra
trejo,
with
my
namesake
and
in
it,
in
fact,.
We
know
her
because
she
was
as
an
intern
what
is
called
an
intern
on
YouTube,.
It
seems
to
me
that
two
years
ago
and
well
now
to
read
this
is
like
working
as
an
engineer
in
google
and
well.
She
is
also
from
monterrey,
mexico
and
well
here
she
is,
and
now
we
have
someone
talking
about
el
guijo
werning
lab.
She
was
the
woman.
E
Who
fell
for
the
introduction
and
well
now,
I
am
going
to
talk
a
little
about
what
it
is.
He
wants
to
play
my
side
and
software
localization.
So,
first
of
all,
what
is
to
continue
with
the
unit
and
well.
The
old
clarinada
is
an
interactive
platform
with
a
practical
approach
in
which
you
can
learn
on
the
different
topics
related
here.
The
programming
is
totally
free
and
you
don't
need
anything
more
than
a
hip
hop
account
to
start
that
right.
We
see
a
little
of
the
introductory
course
here,
the
hall
and
well.
E
What
is
super
cool
is
that
once
you
sign
up
for
a
pulse
this
course
basically
becomes
a
repository
in
your
account.
So
as
you
progress
through
the
course,
you
also
learn
how
to
follow
that,
because
you
have
to
do
you
have
to
open
and
chus,
you
have
to
put
your
code
in
punctual
and
berget.
So
what
better
way
to
learn
tap
than
using
hip
hop
and
well
it's
not
the
only
jaima
everything
that
can
surprise
in
the
eagle.
There
are
also
many
other
courses
like
old
catch.
E
Yes,
they
are
interested
in
making
their
own
website
and
that
it
be
followed
by
web
address
circles,
because
if
those
interested
in
the
box,
you
can
also
learn
to
write
your
first
gif
actions
in
javascript
and
well,.
Not
all
of
them
are
programming,
but
there
are
also
other
courses,
such
as
an
introduction
to
design
thinking
and
communicate
in
witmark
down
and
well
once
I
introduced
some
of
these
courses.
E
I
don't
know
if
you
noticed
something
like
that
when
I
went
to
the
lab
of
Turkish
origin
for
the
first
time,
and
I
realized
that
all
the
courses
were
in
English,,
which
made
it
a
little
more
strange,
because
the
truth
is
that
when
we
all
know
that
when
we
are
starting
to
learn
programming,
most
of
the
resources
were
in
English,.
But
well
one
says:
well
it's
that
there
are
many
people
who
speak
English
worldwide.
There
are
1,100
million.
E
But
if
we
think
about
the
world
we
are
around
7,700
million
people,
which
means
that
more
than
85%
of
the
world
population
does
not
speak
English
but
In.
My
opinion,,
not
knowing
English,
does
not
mean
that
you
cannot
learn
to
program
or
that
you
cannot
learn
how
to
use
the
course,
and
that
is
why
it
is
important
that
we
renew
that
language
barrier
so
that
more
people
can
benefit
from
these
courses
by
Lenin,,
although
they
are
great.
E
and
that
the
truth
has
taken
several
and
if
he
has
learned
a
lot,
then,
as
with
everything
he
is
from.
Bagram
I
started
working
on
the
location
of
the
good
side
of
me
before
Moving
on
to
how
I
achieved
this,,
it
is
important
to
define
certain
terms,,
which
is
translation
and
internationalization
and
localization,,
because
many
times
people
think
that
localization
is
nothing
more
than
translating
or
composing
a
bit
of
internationalization
with
localization,,
so
so
that
we
do
not
have
any
doubts.
E
Well,
if
you
are
wondering
how
it
is
that
I
got
to
work
in
reuse,
it
is
because,
since
you
did
not
alejandra
in
the
summer
of
2019,
I
did
an
internship
or
internship.
They
covered
mexico
here
with
old
and
there
I
am
I
won
one
of
the
couple
of
events
that
all
practitioners
had
a
san
francisco
and
well
now,
I'm
going
to
give
you
a
little
egypt.
What
an
explanation
of
how
we
managed
to
locate
the
folklore
kit
on
my
side
and
well,
the
first
step
was
to
define
the
problem.
E
Well,
no
could
only
say
well
I
want,
but
we
had
to
see
what
the
different
requirements
are
for
this
to
be
possible
and
if
it
would
really
be
useful,
if
there
were
people
who
used
a
pencil,
then
they
would
benefit
from
that.
And
if
we
discovered
that,
if
there
would
be
a
lot
of
people
who
would
love
to
have
a
location
and
who
would
use
it
to
learn
well
on
our
platform.
E
Well
after
we
were
already
very
sure
of
the
problem,
I
went
to
interview
different
young
people,,
which
is
what
they
call
people
who
work
in
business
and
expert
fields,,
who
are
like
university.
Students
who
are
kind
of
plaster
ambassadors
in
their
universities
and
I
went
to
talk
to
them,
and
what
interested
me
It
was
talking
to
people
whose
first
language
was
not
English,
but
any
other
language
and
well,
from
there.
E
One
of
the
interviews
that
helped
me
the
most
was
with
a
young
man
who
works
in
japan,
and
he
told
me
that
he
worked
in
war
sales
and
he
told
me
that
what
he
wanted
was
to
show
his
japanese
clients
how
it
worked
here.
But
the
problem
is
that
most
of
them
didn't
speak
any
English,
and
he
already
meant
that
hello
world
to
us.
So
he
mentioned
that.
If
it
is,
please
I
need
that
you
can
to
localize
I
'll
help
you
with
the
translations.
E
If
you
want,
but
this
would
help
me
a
lot
to
be
able
to
sell
and
in
java
different
clients,
then
well
once
we
knew
that.
Ok,
if
necessary,
and
that's
how
people
would
use
it
and
it
didn't
touch
us.
It
touched
me
investigate.
Ok,
what
type,
of
course,
or
which
course
would
be
the
one
that
we
should
locate.
First
as
a
test
and
well
I
got
the
statistics
of
which
courses
people
are
taking
and
which
will
be
the
particular
ones
and
well
to
no
one's
surprise.
The
most
popular
was
introduction
to
you.
E
E
Now
it
was
time
o
program,,
and
that
is
where
all
t
at
comes
in.
I
told
you
about
internationalization,
because
internationalization,
as
I
mentioned,
check
the
code,
you
have
and
see
how
you
can
make
it
localizable
in
a
simple
way
and
also
on
a
large
scale,
because,
well,.
We
are
translating
or
localizing
a
page,
well,.
If
it
is
a
few
paragraphs,
Well,
it's
easy
and
you
just
grab
the
translations
and
the
copies
and
pastes,.
E
But
if
we're
talking
about
several
languages
and
several
courses,,
then
that's
no
lo
ger
possible,
and
they
know
how
to
have
as
much
as
it
wo
ld
complicate
limits,,
well,
no,.
So
they
had
t
find
a
way
to
make
t
more
automated.
Well,
once
I
found
that
way
and
the
program,
it
was
time
to
give
a
demo
and
receive
feedback.
V.
The
state
of
the
internet,
rave
and
the
internships
I
had
on
github
is
that
in
the
end,,
everyone
in
the
company
tends
to
listen
to
all
the
interns..
E
These
are
the
projects
that
we
did
for
this
demo
that
I
did
in
front
of
everyone
in
the
company.
We
were,.
We
already
had
the
virgil
introduction
course
localized
in
spanish
in
japanese,
and
if
you
see
that
there
is
one
this
in
the
course
of
interactions,
had
a
spanish
that
is
already
strong
with
those
translations
and
well,
then,
for
me,
it
was
a
super
pride
to
be
able
to
go
from
this
at
the
beginning
of
my
practice
to
this,,
which
is
already
a
localizable
version
from
Liège,
finished
in
Spanish,
and
also
in
Japanese,
and
I.
E
Think
that
at
this
time
someone
has
also
contributed
with
the
translation
into
French,,
which
is
very
cool,
and
well,.
I
think
that
technology
has
to
be
more
accessible
for
everyone,
and
localization
is
a
big
part
of
their
process
and
well.
Good
news
is
that
they
can
also
help
us
in
this
process
by
translating
courses
from
gijón
learning
lab
to
Spanish,
and
even
more
good
news
is
that
it
is
super
simple,.
It
only
requires
two
steps
and
the
first
is
to
modify
the
conflict
file.
E
I
call
that
each
course
has
to
add
your
language
to
the
language
preferences
and
translate
the
different
steps
of
the
course,
because
in
that
file
it
is
where
all
the
logic
of
the
course
is
handled,
like,
well,
what
happened
more
and
what
actions
you
have
to
take,.
But
the
good
thing
is
that
you
don't
have
to
modify
any
of
the
logic
of
the
course,
rules,
have
to
add
Spanish
to
the
language
preferences
and
translate
to
Spanish
in
the
different
titles
of
each
step,
well,
once
they
have
done
that,.
E
The
second
step
would
be
to
translate
the
files
with
the
instructions
and
the
auto
language
posts,.
So
the
way
the
learning
lab
works
is
that,
with
a
course,
you
have
a
bot
that
gives
you
instructions
in
comments
or
starts,
and
that
is
basically
grabbing
smart
ground
files
that
they
already
have
as
in
each
step.
They
already
know
that
this
is
this
arc.
Hivo
is
for
this
step
of
super
another,
so
that
makes
it
even
easier
to
locate
it,
because
you
just
have
to
see
these
markdown
files
and
translate
them
and
that's
it
and
well.
E
It
is
important
that
you
have
to
note
that
it
is
where
Kirchner
with
doctrinal
diagonal
transfer
entry
is
where
a
video
comes
with
all
these
steps.
That
I
have
just
told
you
in
more
depth
and
also
these
cities
I
think
it
is
road,
and
there
is
also
a
tobacconist
that
all
the
steps
like
this
dot
by
dot
so
that
they
can
start
translating
their
own
courses
from
the
link,
which
is
also
a
super
interesting
way
to
start
contributing
to
open
source
projects.
It
is
something
that
interests
them
and
it
is
like.
E
E
D
D
Questions
before
you
go
and
well
obviously,
and
if
you
can,
after
your
meetings
the
same
and
you
join
our
zoom
I,
send
you
this
link
through
friends.
We
communicate
right
now,
but
well,
something
I
wanted
to
ask.
You
is
I,
told
him
in
the
people.
You
want
from
Mexico
that
to
many
people
who
are
greeting
since
well,
we
have
Several.
People
who
are
here
are
also
from
Mexico.
In
fact,.
Most
of
those
who
see
us
are
from
there.
That's,
fine,.
D
And
well,
I:
don't
know,
well,
anything!
You
want
to
say,
any
resource,,
something
you
think
you
can
recommend
to
people
who
want
to
learn.
more
to
learn
more
about
which
copy
one
side
to
learn
more
about
programming
in
general.
Well,
I
think
he
said:
learning
I'll
do
localization.
If
they
give
me,
you
thought
I'd
help.
You
It
helped
a
lot
because
Andeans
go
down.
E
Because
there
is
documentation
about
wanting
to
finish,
which
is
super
good
because
they
saturate
themselves
with
water
setting
up
their
courses,
and
you
also
do
something
else,.
Not
only
can
they
help
with
locating
courses,
but
you
can
also
create
your
own
courses
and
do
them
directly
in
Spanish,
which
the
community
also
helps
a
lot
so
that
there
are
precisely
more
resources
in
Spanish,
so
that
more
people
have
access
to
learning
to
program
which
is
great
and
pedal
that
helped
me
a
lot.
E
The
truth
is
always
to
see
how
other
other
programs
did
it
for
localize
its
well.
Its
software
and
I.
Remember
that
I
began
to
see
how
react
has
a
very
good
localization
boasts
of
its
documentation
and
the
people,
the
technology
community,
super
friendly
and
super
accessible.
So
I,
don't
think
I
found
that,
although
which
engineer
had
worked
in
that
and
on
twitter
I
sent
them
one
day
that
nowadays
citizens
and
that
the
truth
is
that
I
did
not
expect
that
to
answer.
E
But
he
did
answer
me,
and
there
is
also
san
francisco
and
I
also
ask
what
they
do
or
not.
If
you
want,
let's
have
a
coffee
and
I'll,
explain
it
to
you,
then
it
was
a
very
good
experience
and
I
say
that
in
general
they
are
also
very
good.
You
never
be
afraid
that
I
don't
know
how
to
send
a
message
to
a
good
programmer
or
someone
they
admire
in
the
community,
because
most
of
the
time
they
will
respond
to
them
and
well,.
You
learn
a
lot
from
their
talks
and
they
also
don't
leave,.
E
D
B
I,
don't
know
when
you
return
from
simply
sending
a
message
to
someone
who
can
help
you,
the
worst
that
can
happen
is
that
maybe
they
send
you
the
message
and
you're
in
the
same
situation,
but
hey
and
changing
the
subject
a
bit.
We
go
to
our
next
super
speaker,
a
cameraman
from
here
from
git
hub
álvaro
muñoz
works
as
a
security
researcher
at
github
to
follow
them
where
he
helps
protect
open
source
software
and
educates
developers
about
defensive
programming.
B
F
F
That
is
all
good
is
not
perfect
because,
as
jaime
said,
he
calls
me
álvaro
muñoz
put
esther
on
social
networks,
twitter,
whatsapp
and
I
work
in
the
__
]
security
kit.
It's
worth
it,
that's
something
that,
from
what
I
realize
a
lot
of
people
don't
know
are
not
familiar
with
what
bid
hub
does
in
terms
of
trying
to
secure
the
entire
open
source
ecosystem
and
all
the
applications
that
are
paid
for,.
F
We
also
try
to
train
both
developers
and
developers
as
security
researchers
and
how
we
do
this
because,
on
the
one
hand,
all
our
methodology
all
the
ways
in
which
we
search
for
vulnerabilities.
We
try
to
make
them
public
and
share
them
with
the
community,
so
that
the
community
can
also
find
this
type
of
vulnerabilities
and,
on
the
other
hand,
let's
also
say
that
we
release
a
little
the
tools
that
we
use.
F
The
queries
or
perez
that
we
are
going
to
present
now
is
during
this
talk,
so
that
you
yourselves
can
take
those
strings
and
run
them
on
your
applications
and
see
if
they
are
safe,
insecure.
If
you
find
vulnerabilities.
On
the
other
hand,
also,
as
jaime
has
said,
we
put
a
lot
of
emphasis
and
try
to
promote
safe
development
practices,
and
for
that
we
are
starting
a
series
of
blog
posts
in
which
we
are
trying
to
introduce
the
best
defensive
development
practices.
Is
dec
go
even
without
having
any
idea
of
f
the
vulnerabilities?
F
How
we
ca,
prevent
certain
vulne
abilities.
They
simply
have
two
certa
n
precautions,
the
way
in
which
it
progr
ms
and
f
nally,
the
last
pillar.
Let's
say
serio
s
is
le
's,
say:
try
to
increase
colla
oration
between
communities,
both
devel
pment,
with
security
and
intra
security
community,
so
that
we
can
share
which
ones
we
do.
F
One
of
the
consultations
we
do
with
those
we
do
with
others
and
in
this
way
try
to
ensure
that
this
information
circulates
freely
and
reaches
as
many
as
possible
as
an
example
of
meadows
of
that
first
pillar
of
finding
vulnerabilities
To.
Give
you
an
idea
within
the
group
of
one
of
the
security
laboratory
that
we
will
be
about
five
or
six
people
actively
participating,.
Let's
say
in
the
security
investigation
last
year
we
reported
223
tve
is
that
they
are
unique
identifiers
of
vulnerability
in
applications
that
require
a
cb.
F
F
F
But
first
let
me
go
back
a
few.
How
many
years
to
2012
we
were
all,
let's
say
a
little
happier.
At
least
we
didn't
have
to
carry
more
veneer,
but
the
pandemic
was
not
yet,
let's
say
well,
well,,
bothering
us
day
to
day,
to
put
it
in
a
final
way
and
that
year,
2012
I,
don't
know
if
you
remember,
but
the
space
probe
carried
by
the
nasa
curiosity
rover
was
traveling.
Let's
say
to
mars
was
on
its
way
to
mars.
F
The
code
is
not
exactly
this.
This
is
a
simplification
of
the
code,
but
it
is
quite
representative
of
how
the
code
was
a
code
expires
and
what
it
did
basically
had
a
function
which
was
in
charge
of
turning
on
the
thrusters
and
which
took
a
coordinate,
vector
of
12,
coordinates
to
be
exact,
and
these
coordinates
enadas
were
represented
by
giving
them
later
in
the
code.
If
I
entered
this
function,
but
instead
of
passing,
an
array
of
12
coordinates,
it
was
passed.
F
A
root
of
three
coordinates
that
passed
well
in
the
first
place
is
that
this
12,
which
is
really
an
annotation,
and
that
is
eliminates,
let's
say
at
compile
time
so
at
run
time.
There
is
no
validation
that
the
array
we
are
passing
to
it
has
12
doubles
or
has
3
or
has
5
or
whatever.
Therefore,
that
has
to
be
something
that
is
incorporated.
Let's
say
inside
of
our
function:
in
this
case,
no
type
of
checks
were
made
and
what
the
code
did
was
pass.
Three
coordinates
and
later
it
read
12,.
F
C
F
The
fourth
space,
let's
say
double
within
that
region
of
memory,
it
was
no
longer
reading
for
nothing.
It
was
reading
initial
memory
and
it
does
not
initialize.
It
gives
variables
initialized
but
not
belonging.
Let's
say
to
this:
this
function
other
parts
of
the
stack,
that
is
to
say
it
was
seeing
garbage
that
was
going
to
make
it
possible
for
it
to
crash
the
program
and
with
the
serious
consequences
that
it
could
have
on
landing.
F
Well,
at
that
time,
nasa
was
collaborating
with
an
oxford
start-up
called
semel
and
that
was
acquired
last
year
by
richard,
and
that
is
the
engine
of
code
scaling
that
we
will
talk
about
later
bit
of
the
good
heart
and
that
is
based
on
a
tool
in
a
query:
language
called
co
tv.
What
they
did
was
take
the
knowledge
that
the
nasa
auditor
who
had
found
that
vulnerability
had
had
and
translate
it
into
a
query,
a
kind
of
query
sql,
which
they
could
then
execute
and
run
around.
F
F
I
know
that
they
are
probably
not
familiar
with
Codwell,,
but
to
give
you
an
idea
of
what
it
looks,
like,,
what
syntax
it
uses
is
very
simil
r
to
sql
in,
in
the
sense
that
it
is
a
declarative
language
and
in
which
we
have
the
three
main
from
where
and
select
statements
in
the
first.
We
declare
some
variables
a
series
of
tables
that
can
be
the
results
and
in
the
web
class.
F
What
we
are
going
to
do
is
limit
these
duplas
through
the
imposition
of,,
let's
say,,
different
restrictions
or
conditions,,
for
example,
in
the
first
one.
What
we
are
doing
is
that
not
all
the
functions
and
all
the
function
calls
are
valid,,
but
only
all
the
calls
that
are
to
a
specific
function
are
valid
well,.
Without
going
into
the
details
of
this
query,
a
bit,.
F
What
we
are
doing
is
verifying
that,
when
there
is
a
call
to
a
function
and
this
function,
ón
takes
a
parameter
that
is
of
type
array
the
size
of
the
root
that
it
takes
in.
The
call
is
less
than
the
size
of
the
root,
as
declared
in
the
function
definition,
and
if
that
is
the
case,
we
report
an
error
under
a
vulnerability,
nasa
executors
tacuary
in
their
code
base
and
found
30
similar
bugs,
which,
and
this
most
surprisingly,
they
were
able
to
correct
in
the
space
probe
while
it
was
flying
towards
mars.
F
Well,
we
all
know
how
this
ended.
The
probe
landed
safely
on
the
surface
from
mars,
and
let's
say
it
went
away
a
little
thanks
to
anyone
it
's
more
this
year.
This
is
a
tweet
from
our
ceo
of
nothing
on
february
19,
the
second
perseverance
probe
was
sent,
which
has
already
landed
and
again
at
nasa,
has
used
any
and
other
elements
of
rip
hub,
such
as
beat
hub
actions
to
implement
and
secure
the
code
that
is
executed.
Let's
say
in
both
the
probe
and
the
rover,
and
this
is
really
what
the
an
Variant
analysis
First.
F
Let
me
scale
it
now.
Let
me
go
forward
six
years
in
time
we
are
already
in
2018,
and
this
year
a
vulnerability
was
reported
in
the
nexus
repository
manager.
It
is
worth
it
for
those
of
you
who
do
not
know
it
is
the
sona
type
artifact
server,
which
is
the
company.
Let's
say
that
maintains
the
central
repository
of
th
e
maiden,
for
where
are
all
the
artifacts
left.
At
that
time
a
vulnerability
was
detected.
It
was
reported
as
a
new
expression
land,
which
injection
and
little
more
little
more
was
said
in
that
in
that
country.
F
F
Ok,
let's
say
that
the
library
or
the
reference
implementation
of
liévin
validation
and
play
is
very
rich.
It
comes
with
a
lot
of
annotations
that
are
useful
for
90%
of
the
cases,
but
many
times
we
want
to
validate
something
in
a
custom
way,
and
this
is
exactly
what
nexus
was
doing
in.
Let's
say,
your
application
had
a
front
end
in
which
an
administrator
could
register
new
users
and
could
also
modify
the
users
and
among
the
things
he
could
do
with
these
users.
F
He
could
add
them
and
modify
the
roles
that
these
users
had
and
what
the
part
of
the
backend
is
that
when
it
received
the
request
from
the
front
end,
it
validated
that
all
the
roles
were
valid
and
according
to
a
list
of
ro
les
valid
for
it
implemented,
let's
say
a
custom
validator
implementing
extending,
in
this
case
the
support
constructor
and
towards
one
sees
raid.
The
method
is
ok.
Ok,
in
this
case,
the
code
was
just
a
little
more
or
less
this.
F
It
is
okay,
because
this
small
piece
of
code
allowed
an
attacker
to
execute
code
remotely,
which
is
the
most
critical
vulnerability,,
let's
say,,
because
it
goes
beyond
the
application
and
compromises
the
server
that
is
executing
the
application.
tion
and
from
there
you
can
run
any
process,
jump
to
the
internal,
network,,
etc.
F
It
is
very
difficult
for
you
to
see
this
vulnerability
because
you
have
to
be
familiar
with
the
shapis
in
particular,,
but
in
this
case
the
important
thing
is
that
in
the
first
place,
this
ball,,
which
is
what
was
looking
at,
normally,
it
is
unreliable
data,
in
the
sense
that
it
is
usually
controlled
by
the
user,
that
is,.
If
you
are
validating
it,
is
normally
because
it
comes
from
the
user,.
Therefore,
it
can
also
come
from
an
attacker,
and
on
the
other
hand,
there
are
two
words
here.
They
are
a
key
with
template.
F
What
it
does
is,
it
is
going
to
build
an
error
message
using
a
template
engine.
It
is
good
for
those
of
you
who
know
a
little
about
template
engines,
for
example,
in
java
they
are
very,
very
famous
or
popular.
The
archer
velocity
are
engines
that
they
will
interpolate
different
values
within
a
tem
late
and
normally
it
also
allow
the
interpolation
of
expressions.
The
e
will
go
pressures
you
can
think
of
them
as
if
they
were
small
pieces
of
code
in
this
case
of
java
code.
F
In
fact,
if
we
go
to
the
definition
of
the
pencil,
which
is
something
we
do
a
lot,
let's
say
within
security
research,
we
can
see
that
there
is
valid
vernet
aitor,
which
is
the
reference
implementation
of
this
app
and
from
version
1.1.
It
added
support
for
the
unified
expression
language,
and
what
does
this
basically
mean
today
when
we
make
an
annotation
for
example?
In
this
case,
we
want
to
validate
that
the
price
is
less
than
100,000.
F
What
we
are
going
to
do,
is
validate,
well,
print
or
generate
an
error
message
in
which
we
have
an
expression,
here,,
a
type
expression
and
the
language
expression,,
and
what
it
is
going
to
do
is
resolve
this
expression
in
this
case,
as
simply
as
it
is
going
to
be
resolved
for
this
value.
But
here
we
could,
for
example,
pass
a
string
from
uppercase
to
lowercase.
F
Do
a
super
string
do
an
if,
yes
and
let's
say,
put
cier
This
logic
in
the
generation
of
the
message,
etc.,
is
worth
it,
without
further
ado,
the
way,,
let's
say,,
of
attacking
this
code
repository
was
simply.
This
is
the
request
that
was
sent
from
the
front
end
when
the
administrator
introduced
a
new
user,
in
this
case,.
The
user
is
being
created,
test
123
and,
as
you
can
see
here,
it
is
assigning
a
role
called
nx
admin
and
then
comes
the
expression
or
the
dollar.
You
see
909
1999
1
and
the
response.
F
Although
the
http
code
is
200,
ok,
it
really
is
an
error
response,
as
you
see
here,
and
it
says
that
are
missing,
missing
rose
and
it
puts
here
in
x,
admin
10000.
What
does
this
mean
that
the
expression
of
expression
language
has
been
evaluated?
And
that
means
that
in
this
case
we
are
adding
22
integers,
which
helps
us
to
verify
that
the
application
is
vulnerable,
but
here
we
could
already
interpolate
any
piece
of
java
code.
F
We
could
start
a
new
process
on
the
server
and
fully
commit
it,
as
part
of
this
is
root,
cause
analysis,
z
as
part
of
my
work.
Last
year,
analyzing,
this
vulnerability
wrote
a
query
with
q,
let's
say
similar
to
the
one
we've
seen
before
from
nasa,
but
in
this
case
for
java
and
what
I
did
was
then
dump
a
bit
of
that
knowledge.
I
had
acquired
into
this.
This
root
cause
analysis
and
model
that
vulnerability
with
a
query.
F
So
we
run
this
query
on
the
nexus
code
two
years
later,
because
this
vulnerability
or
I
remember
that
was
reported
in
2018
and
four
variants
were
found.
Four
new
instances
of
this
vulnerability.
Two
of
them
they
were
post
authentication,
that
is,
they
required
that
the
user
had
been
authenticated
and
I
think
it
was
with
administrator
permission,.
Therefore,
it
is
not
so
severe,,
but
two
of
the
new
ones
that
we
found
were
pre
authentication,,
that
is,
any
user
that
could
send
a
request
to
the
port
of
nexus
could
compromise
the
server
completely.
F
Apart
run
this
query
on
a
few
projects
as
an
example,
let's
say
not
as
an
example,
but
a
subset
of
projects
and
I
found
many
vulnerable
projects,
such
as
certain
content,
orchestrators
of
netflix
drop
wizard,
which
is
an
application
to
make
a
framework
to
make
web
applications
apache,
syncope
and
many
more.
It
is
worth
it
later.
As
the
next
step,
Let's
say
once
we
have
seen
that
the
query
is
mature
in
the
sense
that
it
does
not
have
many
false
positives
and
generate
quality
results,.
F
We
pass
this
to
the
repository,
which,
by
the
way,
is
an
open
source
repository
and
therefore
you
can
consult
all
the
queries.
All
the
schools
that
we
have
stored.
There
are
in
enguita,
dotcom,
barra,
barra
kouchner,
and
these
are
the
rules,
the
queries
used
by
git
hub
code
scanning.
It's
good
for
those
of
you
who
don't
know
a
little
about
it,
because
it's.
D
F
Been
relatively
new,
which
basically
doesn't
do
any
scanners
either
you
can
go
in
your
right
public
repository.
You
can
go
to
the
tab
security
and
you
will
be
able
to
enable
github
code
scanning
from
then
on.
When
you
add
a
new
curriculum.
What
it
will
do
is
execute
a
series
of
queries
and
queries
to
verify
that
this
eps
request
is
not
introducing
vulnerabilities
in
your
project
and
thus
prevent.
Even
from
the
first
moment,
we
send
the
pool
request
before
the
merckx
is
done,
so
that
this
vulnerability
is
incorporated
into
our
application.
F
One
of
the
results
that
caught
our
attention,
the
most
was
one
that
was
in
the
corona
world
observer.
Well,
when
we
went
to
see
it,
we
saw
that
it
was
It
was
about
the
server
that
provides,,
let's
say,,
a
service
that
makes
the
backend
of
contact
applications
without
in
Germany,
that
is,,
these
applications
that
are
in
charge
of
monitoring
our
exposure
to
other
devices
and
in
such
a
way
that,
when
a
person
declares
that
they
have
tested
positive,,
let's
say
in
Kobe
Nineteen.
F
What
you
can
do
is
that
this
information
is
uploaded
to
the
server
and
this
information
is
and
share
it
with
all
the
users
of
this
system
in
such
a
way
that
it
can
notify
you.
If
you
have
been
exposed-
and
in
this
way
you
can
prevent
self-confinement
or
take
the
preventive
measures
that
you
consider
is
a
very
critical
application
because,
obviously
being
able
to
compromise,
this
server
means
that
you
can
take
it
down
and,
let's
say,
do
a
denial
of
service.
On
german,
let's
say:
contact
tracing
efforts.
This
is
a
very
popular
app.
F
In
fact,
it's
the
biggest
open
source
app
ever
developed
in
germany
on
behalf
of
or
commissioned
by
the
german
government
and
in
june.
According
to
this
company
declaration,
caesar
declarations
that
he
is
really
the
company
that
develops
it.
I
think
it
was
a
month
after
its
launch.
There
were
already
7,250
participants
in
this
project.
F
Once
I
reported
this
sap
vulnerability,
it
took
four
days
to
release
a
patch
I
think
the
vulnerability
was
fixed
up
to
date,
next,
a
few
hours
later,.
What
happens
is
that
they
had
to
spend
another
three
days
to
go
through
a
battery
of
tests
to
verify
that
this
patch
did
not
break
something
on
the
other
hand,
no,,
but
in
four
days,,
let's
say,,
the
application
was
in
production,
deployed
and
correctly
Sure,.
F
F
But
the
important
thing
about
this
news
is
that
it
was
very
positive
in
the
sense
that
they
highlighted
that,
thanks
to
the
fact
that
the
German
government
had
made
this
application
in
an
open
source
way,,
there
were
hundreds
of
eyes
of
security
auditors
of
people
who
were
editing
the
quality
of
the
code,
who
could
contribute,
report
skills
and
in
the
end,,
contribute
to
make
it
a
safer
and
more
reliable
software.
Let's
say
that
there
are
many
people
who
did
not
want
to
use
this
type
of
application
tions,
because
I
thought
I
could
clean
personal
data.
F
Private
data
is
not
the
case
and,
in
fact,
I
think
it
was
the
main
root
reason
why,
in
germany
and
many
other
countries
they
have
made
these
open
source
projects
to
generate
all
the
transparency
necessary
for
it
to
be
audited.
The
code
shows
that
the
mobile
devices
are
not
really
sending
the
location
or
any
type
of
private
data
and
that
of
their
work
suck.
We
audit
and
effectively
verify
that
it
is
so
good,
I
think
a
little
over
time,
but
quickly
the
vulnerability
in
the
server
application
from
covite.
F
Let's
say:
interpolate
the
country,
the
name
of
the
country
within
the
error
message
and
finally,
the
function
would
be
called
violation
and
Álvaro
Lecture
is
going
to
call
pili
constraints
in
wembley,
which
is
the
function
that
we
have
seen
before.
In
this
way,
let's
say
we
are
able
to
simply
send
a
request
with
a
fake
country
that
did
not
exist
compromising
this
server.
F
The
story
has
a
happy
ending
in
the
sense
that
for
a
few
months,
we
were
talking
with
those
responsible
for
jayber
net
valley
dator
and
in
the
end
we
got
one.
It
was
a
joint
decision
which
is
disabled.
If
the
evaluation
of
expressions
of
this
type
of
expression
of
this
language,
expressions
by
default,
let's
say
so
that
when
do
a
developer,
is
generating
an
error
message
programmatically
using
this
app
and
bill
with
30
reais.
Are
we
template?
The
evaluation
of
these
expressions
is
disabled
by
default
because
it
was
very
normal.
F
C
B
D
D
Very
finished
the
truth.
Super
This
is
interesting
and
well,.
If
you
have
the
opportunity
to
reach
us
in
about
20
minutes
It's
in
the
south,,
then
people
come
from
there
because
from
there
you
can
also
ask
questions
live,,
let's
see,
I'm,
seeing
a
good
one,,
because
it
seems
that
we
are
continuing
now
with
the
presentation
of
Adrián,.
B
D
Well,
I'll
tell
you
a
bit
about
this.
I,
just
started
working
in
the
area
of
accessibility
in
hi
hop,,
and
it
was
through
this
new
r
le
that
I
have
a
son
that
I
met,
A,
rián.,
This,
good
Adrián
is
an
exper
in
accessibility
and
well
posting.
A
lot
of
things
in
Girón
has
some
really
great
articles,
for
example
this
one
where
he
talks
about
how
you
can
do
an
automated
workflow
using
kírov
actions
and
another.
D
C
C
Good
or
hello,
today
we
are
going
to
talk
about
web
accessibility.
First
of
all,.
What
you
see
below
my
presentation
are
automated
subtitles
that,
unfortunately,
will
not
always
be
correct,,
but
at
least
the
people
who
cannot
or
do
not
want
to
listen
to.
The
audio
of
this
talk
will
at
least
to
be
able
to
follow
what
I
am
saying
for
the
moment.
C
I
love
web
accessibility,
or
at
least
I
advocate
for
it,
and
you
can
find
me
almost
on
all
networks
by
my
last
name.
We
are
going
to
talk
about
accessibility
and
one
of
the
big
questions
that
everyone
asks
me
when
we
talk
about
this
The
issue
is
that
it
is
that
at
11
and
that
we
always
see
when
accessibility
is
talked
about,.
This
is
the
international
acronym
for
accessibility,
and
it
is
because
there
are
11
letters
between
e,
the
a
and
the
y
in
the
word-
accessibility
in
English.
C
In
fact,
in
Spanish.
It
so
happens
that
there
are
also
11
letters
between
the
and
the
accessibility,
because
it
is
so
obvious
that
in
the
real
world,
these
four
situations
are
completely
incorrect.
The
first
two
we
see
a
super
super
steep
ramp
in
the
third
image.
We
see
a
ramp
that
at
the
end
there
are
stairs
and
the
fourth
ramp
is
completely
useless
or,
for
example,
someone
arrives
in
a
wheelchair
and
there
is
an
accessible
and
perfect
button.
The
door
opens
automatically
but
surprise
behind
that
door.
C
If
you
have
to
click
on
the
button
in
the
upper
right
corner
or
you
want
to
change
your
email
because
they
can
tell
you
something
like
you
do
not
have
to
click
on
the
icon.
That
looks
like
a
motor
wheel,
but
for
someone
blind,
there
is
no
such
icon.
That
looks
like
a
motor
wheel
or
a
floppy
disk
or
an
arrow,
or
there
is
no
upper
right
corner.
C
We
have
to
take
that
into
account
when
we
develop
our
websites,
a
very
quick
fact,
a
couple
of
years
ago
we
are
now
almost
7.8,
but
a
couple
of
years
ago
we
were
7.7
billion
and
more
than
1.3
billion
people.
Some
people
live
with
some
visual
deficiency,.
It
may
be
people
who
wear
glasses
at
10
or
20
percent,.
It
may
be
people
with
color
blindness,.
It
may
be
people
who
are
one
hundred
percent
blind,.
C
Also
think
about
that
today
we
are
not
going
to
talk
about
how
to
develop
accessible
websites.
I
have
another
talk
talking
about
this.
You
can
look
it
up
on
youtube,
but
today
I
am
going
to
talk
about
how
to
make
sure
that
what
we
develop,
the
code
that
we
generate
is
accessible
and
when
we
talk
about
testing
web
accessibility,
we
normally
talk
about
automating.
These
tests
and
automating
tests
is
very
good.
It
can
even
free
our
testing
team,
our
team
from
doing
all
the
three
test
manuals
our
website,
but
it's
not
magic.
C
This
doesn't
doesn't
make
our
website
our
website
accessible.
We
have
to
understand
ta
Also,
that
only
between
20
and
50
percent
of
accessibility
problems
can
be
detected
with
automated
tests
and
that
these
automated
tests
are
part
of
a
larger
testing
process
in
which
manual
testing
is
as
important
as
automatic
or
automated
testing.
C
So
today,
I
want
to
give
you
advice
that
I
personally
use
to
test
and
how
to
be
sure
that
the
code
we
generate
is
accessible.
So
my
first
advice
is
to
be
with
your
code.
While
you
develop
during
the
development
process,
I
have
created
an
application
in
react
with
three
components:
very
small.
The
first
is
a
button.
The
second
is
a
false
button
that
I
already
told
you
should
not
be
done.
It
is
a
macro
link.
C
It
is
a
link
with
the
role
of
button
and
the
third
is
an
image
and,
in
the
main
part
of
our
application.
I
have
put
a
bunch
of
accessibility
bugs
to
see
how
we
can
find
them.
Since
I'm
using
this
framework,
I
'm
going
to
follow
up
with
some
tools
applied
to
this
framework
at
first
is
a
tool
called
ax
or
react
access.
C
The
the
library
for
this
framework
in
which
the
company
develops
has
said
and
that
we
can
install
it
as
a
dependency
of
our
application,
and
we
have
to
make
sure
that
we
only
execute
it
wait
na
that
we
only
import
and
execute
this
library
if
we
are
not
in
a
production
environment.
We
are
in
a
testing
environment
because
otherwise
we
would
expose
all
those
vulnerabilities
of
our
website
to
the
public
that
this
tool
makes
this
tool
executes
the
accessibility
tests
in
the
code
of
your
application,
using
the
test
library
or
the
acz
test
engine.
C
How
can
we
see
the
results
of
these
tests?
Well
when
they
run
your
app
in
a
browser
in
the
dev
tools
in
the
console,
we
can
see
a
summary
of
your
or
vulnerabilities
in
your
code.
If
it
happens
more
once
the
same
vulnerability
will
be
grouped.
We
also
have
a
level
the
gravity
one
for
each
vulnerability,
because
we
can
see
minor,
moderate,
serious
or
critical.
C
Another
tool
that
I
recommend
that
you
use
during
our
development
process,
not
only
for
accessibility
tests
but
for
any
other
test,,
and
they
are
of
interest
to
those
who
do
not
know
what
a
link
is,
a
configuration
file,
apart
from
being
a
tool,,
is
a
configuration
file
where
you
establish
rules
for
your
code,
editor
to
warn
you
that
you
are
doing
something
wrong
in
this
case.
I
am
extending
the
rules
of
my
application
to
have
the
accessibility
rules
in
this
case.
C
I
am
using
that
link
that
I
recently
of
you,
it
is
link
for
it
is
written.
It
was
a
sin
to
always
use
and
it
is
slow
and
you
can
use
this
plugin
p
To
find
these
vulnerabilities
once
you
have
the
plugin
installed
and
once
you
have
it
included
in
your
configuration
file,
you
will
be
able
to
see
those
vulnerabilities
directly
in
your
editor.
C
As
you
can
see,
there
is
an
underline,
as
well
as
some
red
waves
on
the
line
of
code
that
is
generating
an
error,
and
if
you
put
the
cursor
on
that
line,
a
small
window
will
appear
a
modal
with
the
information
of
this
error,
and
so
you
can
go
to
fix
it.
You
will
also
be
able
to
see
these
vulnerabilities
in
the
terminal
when
you
run
your
application
with
on
foot
or
with
jan
on
it
depends
of
the
package
manager
that
you
use
to
execute
your
application.
C
If
you
use
components
not
only
of
the
javascript
framework
that
I
have
used,
you
can
use
others,
you
can
use
angular,
you
can
use
owl,
you
can
use
react
and
I
recommend
you
test
your
components,
your
component
library,
with
the
storybook
tool,
I,
have
written
an
article
on
how
to
test
the
accessibility
of
its
components,.
You
can
go,
see
it
or
me
to
my
blog
and
learn
a
little
more
about
those
components.
C
We
can
inspect
the
html
and
css
elements
the
styles,
and
if
we
see
in
any
property
that
there
is
a
color,
we
can
click
on
that
color
and
a
box
will
appear
where
we
can
see
the
color
and
the
background
color
on
which
that
text
is
In.
This
case,
I
am
inspecting
a
text
if
the
color
contrast
is
suitable
for
triple-a
or
double-a,,
which
are
two
w3c
standards
that
establish
these
accessibility.
Standards.
In
this
case,
color
contrast,,
as
I,
have
already
told
you
in
the
two
browsers.
There
is
this
type
of
tool.
C
C
,,
the
google
chrome,
accessibility
inspector
tells
you
exactly
what
that
screen.
Reader
is
going
to
read
and
it
has
its
limitations,
but
I
think
it
is
very
convenient
to
see
this
accessibility
tree.
Also
in
the
lower
part,
we
see
what
are
the
specificity
levels
of
the
properties.
We
see
that
the
title
of
a
link
is
the
least
important
the
content
of
the
link.
Then
the
area
would
go
'label
and
the
law
area
bold
by.
We
know
the
specificity
of
these
property
levels.
We
also
have
this
accessibility
inspector
in
the
firefox
browser.
C
C
More
tips
write
your
own
unit
tests
and
I
think
this
is
not
just
accessibility,
advice,
I
think
it
is
advice
to
any
developer.
You
should
write
your
own
unit
tests
if
you
are
doing
one
application
with
components
and
you
want
to
do
in
twente
or
you
want
to
do
instead
of
integration
or
visual
regression.
They
are
also
very
important
in
this
case.
I
am
going
to
teach
you
how
to
execute
or
how
to
create
your
own
unit
tests
for
and
check
accessibility
in
this
case,
as
I
am
using
javascript.
C
C
We
are
using
the
react,
dom
server
to
generate
a
string,
a
string
from
our
application,
and
what
we're
going
to
do
is
send
that
string
to
the
ax
testing
engine
to
find
vulnerabilities
like
this
is
a
test
I'm,
going
to
hope
that
I
won't
have
any
vulnerability,
no
violation
of
any
accessibility
principle.
When
I
run
this
test
in
the
terminal,
then
we'll
see
a
result,
a
summary
of
all
the
errors
that
my
application
is
having
in
this
case,
I
see
that
there
is
some
image
that
does
not
have
an
alternative
text.
C
C
C
As
always,
it
has
has
a
big
part
here,
p,
a
11
and
it's
also
a
quite
used
tool
and
then
we'll
see
lighthouse,
let's
go
with
the
first
l
first
in
this
case,
and
instead
of
installing
it
as
a
package
of
our
application,
what
we
are
going
to
do
is
install
it
globally
in
our
machine.
We
are
going
to
install
it
globally
in
our
computers
and
we
can
execute
it
in
the
terminal,
putting
accent
followed
by
the
url
that
we
want
to
test
in
this
In.
This
case,
I
am
testing
a
fairly
well-known
website,.
C
This
cover
flow,,
and
we
see
that
what
access
executes
is
an
instance
without
a
head.
I,
don't
know
if
it
is
a
good
translation,,
but
without
the
head
of
the
Chrome
browser,,
and
it
will
execute
all
those
tests,
as
we
always
see,
that
are
very
similar
in
this
library..
What
is
the
error?
Where
is
it
and
what
element
is
generating
the
error
and
that
direct
link
to
the
documentation
provided
by
this
company?
C
We
must
also
install
it
globally
on
our
machine,
the
same
procedure
we
use
in
the
terminal,
followed
by
the
url
that
we
want
to
test,
and
we
see
that
the
result
is
very
similar,.
What
is
the
error?
In
this
case?
We
are
giving
us
to
a
little
more
information.
What
is
the
principle
that
we
are
violating
and
what
is
the
element
that
is
generating
that
error?
It
also
gives
us
even
the
html
map
of
the
structure
of
our
file.
C
We
do
not
need
to
put
that
code
in
a
test
site
or
on
a
server.
We
can
do
it
to
our
our
local
server
and
well.
You
can
think
that
I
have
many
urls
to
test.
No
I
don't
want
to
go
one
by
one.
You
could
also
make
a
script,
but
this
particular
tool
has
an
extension
that
allows
you
in
this
case
the
same
installed
globally
on
our
machine.
C
C
I
am
setting
a
time
out
of
50
seconds
very
high
by
the
way,
and
in
and
I
am
generating
I
take
a
screenshot,
and
in
the
third
case,
which
is
the
I
think
the
interesting
thing
about
this
application
is
that
I
can
generate
actions.
I
can
wait
for
an
element
with
an
id
to
be
visible,
with
an
element
with
a
class
being
visible
click
on
that
element
and
go
to
navigate
to
another
page
and
take
a
screenshot
again.
C
So,
when
I
execute
that
command
in
the
terminal,
what
it
will
do
is
look
for
that
configuration
file
in
the
root
of
my
application,
and
it
will
execute
all
those
tests
are
going
to
take
a
little
longer
because
it
is
generating
those
screenshots.
You
have
those
actions
that
they
have
to
execute
and
well
we
see
a
little
bit.
The
result
is
very,
very
similar
to
what
we
see
in
the
root
directory
of
our
application.
C
Those
screenshots
are
screen
that
we
can
later
use
to
generate
reports
for
or
for
what
I
was
talking
about
before
for
visual
regression
tests.
We
can
compare
that
our
styles,
our
css,
has
not
changed
or
is
it
our
website,
and
then
we
have
lighthouse
that,
in
the
end,
lighthouse
is
not
a
purely
testing
tool,
but
more
for
generating
reports,
but
well
line
house
is
a
tool
that
is
written
and
created
by
google,
and
that
is
included
in
all
our
browsers
from
google
chrome.
C
But
in
this
case
you
can
also
install
it
globally
on
your
machine
and
use
it
from
the
terminal
the
same
procedure.
We
use
the
lighthouse
command,
followed
by
the
url
of
the
site.
We
want
to
do,
and
in
this
case
what
I
am
doing
is
using
view
because,
when
I
just
ran
this
test,
what
I
want
is
for
it
to
launch
the
report
directly
and,
as
you
can
see
in
this
case
it
is
not
a
headless
instance.
C
We
said
before
in
this
case
it
is
a
complete
instance
of
google
chrome
and
you
are
going
to
see
it
is
running.
A
lot
of
tea.
Performance
tests
are
being
carried
out
from
responsive
internet
tests
at
low
speed
and,
above
all,
also
accessibility
tests,
and
we
are
going
to
see
what
This
report
is
launched
directly
or
we
cannot
click
on
accessibility,
and
we
see
a
summary
of
the
vulnerabilities
and
errors
that
we
have
in
our
code.
C
C
C
Then
I'm
going
to
teach
a
little
bit
how
to
do
it
with
guitar
actions
for
your
repositories?
How
about
what
are
the
diets
jones
packs?
First
allow
us
to
automate.
Customize
are
workflows,
in
other
words,
in
a
nutshell:
it's
your
own
pipeline
directly
in
your
get
up
repository
and
that
workflow
is
a
process
multitasking.
C
C
C
When
you
generate
a
pull
request,
it
will
execute
those
actions
and
we
will
see
with
a
green
tick
or
a
red
cross
if
they
are
executed
successfully,
or
there
is
an
error
that
it
is
going
to
do
that
it
is
going
to
prevent
that
pull
request
from
ending
up
in
my
main
branch's
code
that
in
the
end,
what
the
philosophy
of
the
continuum
is
free
is
that
any
code
that
is
in
your
main
branch,
it
is
going
to
be
in
production.
What
we
are
avoiding
with
this
is
putting
inaccessible
code
in
production.
C
C
And
in
the
case
of
lighthouse,
what
it
will
generate
is
the
report
that
we
had
previously
seen
locally.
In
this
case,
it
will
host
it
on
a
public
server
if
you
have
an
application
that
needs
to
be
protected,
or
it
has
a
little
more
security.
What
you
can
do
is
generate
your
own
lighthouse
report,
server
and
host
them
directly
there.
C
So
these
three
manuals
are
as
important
as
the
three
automated.
So
what
can
we
do
to
test
manually?
Well,
we
could
use
a
screen
reader
always
advisable,
but
in
this
case
I
am
going
to
show
you
some
extensions
for
your
browsers.
All
the
extensions
that
I
am
showing
in
this
case
are
for
google
chrome
all
these
extensions
too.
They
exist
for
firefox,
so
we
start
with
the
first
one.
As
always,
we
return
to
the
family
of
access
tools.
C
In
this
case,
we
can
find
it
under
the
development
tools
and
we
simply
have
to
click
on
analyze,
and
in
this
case
it
will
do
a
complete
analysis
of
our
website
that
is
going
to
give
us
the
same
practically
the
same
information.
What
is
the
element
that
is
generating
the
error?
What
error
are
we
violating
the
impact?
If
it
is
serious,
critical
minimum
and
well
a
link,
as
we
said
before,
to
the
official
documentation
provided
by
this
company,
another
very
similar
extension
is
rc.
C
You
can
also
find
it
under
the
development
tools
and
well
run
different
tests
on
several
families.
In
this
case,
the
child,
the
images
family
I,
see
that
some
images
do
not
have
alternative
text
and
I
can
even
go
directly
to
my
code
to
see
what
element
it
is,
and
we
see
that
in
the
window
underlines
them
to
clearly
see
which
images
they
do
not
have,.
In
this
case,
they
do
not
have
alternative
text,
a
tool
that
I
use
a
lot
and
that
I
think
is
very
complete.
C
Of
navigation
using
the
tab
key,
why
I
say
this?
We
have
to
understand
that
many
people
with
disabilities
They
do
not
normally
use
or
navigate
our
websites
using
a
mouse
or
use
a
special
keyboard
or
directly
use
the
tab
key
to
navigate
through
the
different
interactive
elements
that
your
website
has,,
whether
they
are
links,,
buttons,,
forms,,
etc.,
and
that
tabulation
order
that
navigation
order
has
to
be
consistent
with
the
content.
That
of
your
website.
C
Has
to
be
a
valid
order
and
what
this
application
allows
us
to
do
is
make
a
map
of
s
from
navigation
of
that
navigation
flow.
We
go
generating
that
map
from
our
tabs
and
we
see
and
that
order
well,
it
makes
sense
with
the
content
with
the
sections
of
our
website.
Again,
you
can
use
this
this
map,
you
can
take
a
screenshot
to
use
it
as
a
file
for
accessibility,
reports,
etc.
C
It
is
in
the
d
bar
of
extensions.
It
is
not
in
the
s
development
tools
and
once
you
click
on
it,
it
will
generate
that
very
complete
accessibility
test.
You
will
have
all
the
errors.
For
example,
in
this
case
of
images,
without
alternative
text,
you
can
see
the
structure
of
the
headers
h1
h2
h3,
also
very
valid
for
him
for
that
country.
C
With
the
color
contrasts
that
we
had
said
before,
double
a
and
triple
a
you
can
even
completely
disable
all
the
styles
and
see
what
the
content
of
that
website
is
without
styles,
and
you
can
even
inspect
the
code
of
that
website.
I
think
it
is
a
very
useful
tool,
interesting,
very
complete.
That
will
give
you
many
many
results
of
how
a
website
is
made
and
what
accessibility
errors
it
has,
but
not
only
do
we
not
only
have
to
test.
C
It
is
also
very
interesting
and
put
ourselves
in
the
shoes
of
a
user
with
vision
deficiencies
in
this
case
I
present
to
you
today,
I
present
to
you
this
extension.
It
is
called
nou
confi
and
it
is
a
vision
simulator.
What
it
is
going
to
simulate
is
like
someone
with
some
a
vision
deficiency
could
see
your
website
in
this
case,
someone
who
wears
glasses,
for
example,
and
does
not
have
them
with
her,
because
that
is
how
your
website
will
have
other
different
ones.
There
are
people
who
have.
C
Some
part
of
the
eye
that
does
not
see
deficiencies,
for
example,
of
color,,
for
example,
color
blindness
itself
to
another
type
of
color
blindness,
or
simply
achromatopsia
simply
does
not
see
colors.
Then
it
will
give
you
an
idea
of
how
not
and
t
ust
only
in
colors
the
red,
dange,
the
red
error
and
the
green
satis
action.
You
cannot
only
only
trust
only
in
colors
that
this
is
going
to
give
you
a
very
good
vision
of
it.
C
So
my
advice
that
I
have
given
you
to
test
while
you
develop,
you
have
to
include
your
your
accessibility
tests
during
the
development
process
in
this
development
process.
You
can
even
test
in
the
editor
of
code
or
you
can
test
in
the
browser
using
the
development
tools
that
are
native
to
this
one
of
those
browsers.
You
can
automat
ize
these
accessibility
tests
and
include
them
in
your
continuous
delivery
and
continuous
integration
pipelines.
You
can
use
git
factions,
for
example,
if
you
use
github,
you
can
use
another
type
of
mechanism.
C
The
slides
of
these
slides
You
can
find
this
presentation
and
any
other
remaining
presentation
on
my
speaker,
profile.
tec.
You
can
go
through
my
website
through
my
blog
and
see
a
little
bit
of
each
section
that
I
have
talked
about.
It
is
like
I
have
different
posts
on
my
blog
and
you
can
take
a
look
at
it
and
I
want
to
take
this
opportunity
to
advise
you
on
an
introductory
course
on
web
accessibility,
not
only
for
technical
people
but
for
the
entire
w3c
official
world
on
the
x
platform
and
well
take
a
look
I.
C
Think
if
I
remember
correctly,
it
started
there
in
the
course.
So
maybe
you
still
have
time
to
enroll
them
in
that
completely
free
course.
Obviously,
but
a
good
course
and
I
want
to
leave
you
with
a
couple
of
sentences.
The
first
one
I
think
encompasses
a
bit
the
concept
of
accessibility,
and
it
is
not
just
about
disabled
users
being
able
to
access
your
website.
It
is
about
everyone
being
able
to
access
your
site
web
because
you
don't
know
when
you
are
going
to
be
disabled.
I
always
say
that
we
are
all
disabled.
C
We
still
don't
know
when
you
have
your
child
in
your
arms
and
you
have
to
use
a
website
with
just
the
tab.
Key
your
computer
screen
breaks
and
it
's
black
and
you
have
to
use
a
screen
reader.
You
don't
have
your
glasses
with
you,
then
you
see
a
completely
blurry
website
and
you
have
to
rely
on
the
size
of
font
in
the
colors
in
the
in
the
visual
feedback
of
the
focus.
Where
are
you
at
all
times?
And
why
do
I
say
this?
Because
accessibility
is
not
a
functionality,
because
disability
is
not
an
option?
C
I
have
said
and
I
have
recommended.
You
should
test
during
the
development
process,
but
not
only
that
we
have
to
get
used
to
including
web
accessibility,
not
only
during
the
development
process,
but
also
during
the
ideation
process
of
a
design
concept
has
to
be
a
thing
that
we
are
not
responsible
for.
Only
the
developers
here
comes
in.
Everyone
here
comes
in
the
designer.
C
The
project
manager
you
or
your
cto
is
a
part
of
a
website
in
which
the
whole
team
should
be
involved,
as
the
whole
team
should
be
involved
in
your
case,
developer
should
be
involved
in
the
development
process,
not
only
creating
unit
texts,
testing
but
informing.
You
I
think
that
a
A
large
part
of
accessibility
errors
are
caused
by
a
lack
of
education.,
I
believe
that
educating
yourself
and
understanding
well,
the
html
language,,
the
javascript
language
or
any
language
that
you
are
using,
the
basics,.
C
The
basics,
are
very
important
because
they
are
the
foundation
of
every
website.
And.
In
this
case
of
accessibility,
well,
then,
I
recommend
that
you
get
informed
and
educated,
and
that's
great,.
If
you
have
any
questions,
search
on
Google,
search
on
the
Internet,,
there
will
always
be
someone
who
will
help
us,
Alejandro
commented
on
it
in
her
talk,
don't
be
afraid
to
talk
to
people
because
well
we
have
an
incredible
community
I.
C
'm
going
to
take
advantage
of
p
Now
to
say
that
I
believe
that
the
Spanish-speaking
development
community
is
incredible,.
Immense,
then
take
advantage
of
that
community
that
we
have
to
educate
them
and
to
acquire
all
that
knowledge
that
you
think
you
lack
to
make
your
websites
a
much
more
accessible
place,
and
that's
all.
C
Not
only
computers
have
readers
of
screen,
but
mobile
phones
also
have
screen
readers,
so
you
always
have
to
look
for
it.
Take
that
little
step
further
and
ask
ourselves
this
button.
Does
it
have
a
sufficient
description?
This
image
has
a
sufficient
description.
There
is
someone
with
a
visual
disability
who
may
not
see
that
image
and
for
me
it
is
very
explicit.
So,
yes,
there
is
There
are
no
tools,,
but
there
are
tools
in
particular
for
mobile
accessibility,
testing,.
D
B
But
I
thank
adrián
for
his
super
talk,
the
expulsion
link
to
the
documentation
about
accessibility
for
specifically
for
fire.
If
they
are
developing
mobile
software,
but
well
we
are
going
to
change
the
conversation
a
bit
by
going
back
to
those
exponents.
We
put
it
a
couple
of
times
there,
but
if
they
want
to
be
an
exponent,
if
they
want
to
submit
a
presentation,
a
presentation
proposal
there
they
are
link
in
the
external
page
is
in
the
center
escobar.
In
the
chat
you
can
see
who
made
it
new
today,
I
installed
it
on
ale's
twitter.
B
D
B
D
B
D
Course,
well,
look
at
this,.
We
have
a
survey
that
is
really
very
important
because
he
wants
to
tell
us
if
he
likes
what
we
do
in
the
event,
and
the
best
thing
is
that
they
give
us
comments
that
they
tell
us.
Why
example,
what
topics
do
you
want
to
hear,
or
what
do
you
want
us
to
talk
about
and
actually
today
add
another
question:
what
is
so
special
in
terms
of
something
that
I
have
been
asked
recently?
That
is
if
we
were
to
translate
some
of
the
elements
of
hip
hop.
D
That
is
what
will
be
good
What
we
focus
on
is
that
it
is,
for
example,.
We
have
already
said
that
we
already
have
our
mobile
and
we
also
have
the
Guijo
documentation,,
but
well,.
What
do
you
want
it
to
be?
The
next
thing
that
back
we
looked,
for
example,
the
dotcom
hip
hop
marketing
site,
or
would
you
rather
see
blog
articles
and
good
articles,
for
example,
that
talk
about
filters,
or
maybe
you
want
to
invest
yesterday-
is
in
Spanish.
That
is
tell
us.
D
B
And
well,
the
zoom
is
still
there,.
Please
go
there
a
point
or
talk
and
continue
preaching
with
us.
If
you
want,
we
are
already
finishing
this
presentation.
What
I
want
to
tell
you
by
miracle
is
that
if
you
liked
it
tell
your
friends
if
you
didn't
like
it,
also
tell
your
friends,
so
they
can
come
see
why
they
didn't
like
it
and
a
few
words
and
to
finish
nothing.
D
Of
course,
yes
and
well
then
a
lancia
us
in
the
zoom
in
a
few
moments,
and
also
we
are
going
to
have
three
prizes
hopefully
and
that
they
have
been
putting
or
attention
because
they
are
the
prizes
where
we
can
send
you
a
t-shirt,
one
from
Jewish
states
and
also
a
bus,
so
join
us.
And
we
are
going
to
ask
these
questions
to
see.
If
you
win
something
and
well
see
you
in
a
few
minutes.