Blood is a powerful symbolism, and sometimes even has mystical powers. The Blood Oath makes use of this to make a commitment that can't be broken. (Or if it is, it's crossing the Moral Event Horizon.)
Bob has a secret he needs to get off his chest, but doesn't want it to be made public. Alternatively, he needs to be certain Al will do something for him. Either way, this is so serious that it requires making a blood oath.
In one common version, Al and Bob become Blood Brothers, cutting their hands open and shaking on the deal. (Don't Try This at Home; these rituals carry a risk of transmitting bloodborne infections like hepatitis and HIV.)
In another, Al cuts his hand open, and simply lets the blood drip to the ground. This is sometimes highlighted by the phrasing of the oath: "If I break my word may the Earth drink my blood!" Then giving the Earth a 'taste' of your blood so that it knows what to look for if you fail to keep your oath. Sometimes this version is used to swear an oath of vengeance- and making it clear that you mean business.
This is a subtrope of The Power of Blood. If it uses blood and binds you to an oath, then it belongs here.
Can overlap with Couldn't Find a Pen, which is any kind of writing in blood. Contrast with Heroic Vow. See also Geas. May or may not involve actual Blood Magic. When someone has broken this vow so thoroughly they become ostracised they're The Oath-Breaker.
Examples:
- It's implied that this is the traditional way in Mahou Sensei Negima! to induce a Pactio. But that's messy and doesn't have nearly enough fanservice, so they kiss instead.
- This is also all one really has to do to exchange mana in the Nasu Verse as well. Again, sex is more fanservice.
- Naruto:
- An interesting variation occurs as Naruto swears to Neji on Hinata's blood during the Chunin exam preliminary battles for the final test, "You... are going down", promising to defeat him. He makes the same gesture at the beginning of their fight in the finals.
- Summoning contracts are also typically sealed in blood, with a small blood offering made each time the summon is invoked.
- In Mobile Suit Zeta Gundam, Paptimus Scirroco seals his loyalty to the Admiral Jamitov Hymen and Titans with a bloody thumbprint. This does not stop him from murdering Jamitov and taking over the organization.
- It's explicitly said in Chrono Crusade that when Chrono made a contract with Mary Magdalene, his first contractor, that she had to give him some of her blood to complete it. It's implied (using vampire imagery) that this was also the case with his contract with Rosette.
- In Monstress, it's shown that Arcanic wedding ceremonies involve having both participants cut themselves and bleed into the same cup, followed by them both drinking the mixed blood, representing how they've symbolically become one.
- At the beginning of Double Agent Vader, Anakin has an epiphany about the course his life has taken, and swears a blood oath that he will bring about the destruction of Palpatine, "the downfall of his Empire, and the collapse of his power, and the final defeat of all his plans". With his body sealed up in the Darth Vader life-support suit, it requires a bit of doing to get the blood to make the oath.
- A Growing Affection has the Blood Oath Jutsu, the user swears an oath, sets a condition for breaking said oath (two examples in the story are memory loss and death), and then writes the kanji for Honor over his or her heart in his or her blood. Breaking the oath will cause the condition to occur. Only one person in the world has ever successfully removed a Blood Oath seal, and she has less than a fifty percent success rate in doing so.
- In Coventina's Crown, Morain cuts her palm, lets the blood drip onto fire, and swears by her own blood to bring her kidnapped brother back.
- In The Devil and Daniel Mouse, Jan signs her contract with her own blood. It's the one thing in her first encounter with B.L. that makes her hesitate, but only until he basically threatens that it's now or never.
- Robin Hood: Prince of Thieves: Kevin Costner's Robin Hood does it when he swears to avenge his father's death.
- The wild men swear to obey Saruman this way in The Lord of the Rings.
- Allen tries to do this with the rest of the pack in The Hangover. It gets voted down.
- The Outlaw Josey Wales and Ten Bears take a blood oath to seal the "words of iron" peace treaty between the Comanches and Josey's friends at the Turner Ranch and Santo Rio. It is strongly implied, though unstated, that this also makes Josey and Ten Bears Blood Brothers.
- In Mongol young Temudgin (the future Genghis Khan) makes a blood oath with Jamukha, who saved his life. They become Blood Brothers, complete with slicing their palms and letting the blood drip into a bowl of milk that they drink. In the end, Temudgin lets Jamukha go, even though he proves to be a threat in the future, saying that he's not sparing an enemy, he's freeing his brother.
- Being deemed negro was an important plot point in Show Boat. By sharing a drop of blood, the hero was now deemed negro and could marry his sweetheart without violating the miscegenation laws.
- Faust: Love of the Damned: Jaspers' contract with M for demonic superpowers is, of course, written in blood.
- In John Wick: Chapter 2, the concept of "Markers" is introduced. When made, the participants are given a special medallion that can be imprinted on with two thumbprints in blood; the person asking for the initial favor must place their thumbprint while the helper hangs on the medallion until it comes time to repay the favor. Once the favor has been repaid, the helper adds their thumbprint and also signs a special book at a their nearest Continental to clear the debt. John is revealed to have used one of these to help in his "impossible task" when he initially tried to retire, in this film- the crime lord who he asked for help decides that it's time for John to repay the favor, kickstarting the film's central events.
- In Curse of the Crimson Altar, Peter signs Lavinia's book in blood. According to Professor Walsh, this is a step there is no coming back from.
- Phantom of the Paradise: Anyone "under contract" in this movie is implied to have signed one, and we see Winslow sign one onscreen.
Swan: Ink isn't worth anything to me, Winslow.
- Fantastic Beasts: The Crimes of Grindelwald reveals that Grindelwald and Dumbledore made a blood pact to never fight each other, which is why Dumbledore has made no moves to directly oppose Grindelwald.
- In The Baroque Cycle, the members of the Cabal swear various oaths of their loyalty to each other and specifically to Jack. Van Hoek swears by his right hand. When Jack reminds him "But Cap'n, you are left-handed!", van Hoek points out that he'll need his strong left hand to chop his right off if he ever breaks the oath — and then, as a symbol, he chops his own little finger off and throws it into the fire. (He then faints into the dust, but it's the symbolism that counts with these things.)
- Recycled In Space for the Boojumverse tale "The Wreck of the Charles Dexter Ward" with the protagonist providing both a thumbprint and DNA sample to seal a contract. There's a Deal with the Devil feel to it as well, as she's been given a Too Good to Be True offer that she's not in a position to refuse.
He slid a tablet across the rented desk. Cynthia pressed her thumb against it; a prick and a buzz, and her blood and print sealed the contract.
- Likewise in "Boojum" involving a crew of Space Pirates. A Boojum is a Living Ship that has the ability to eat intruders, so it would have to identify its crew, presumably through DNA.
Just as she had when she took Captain Songs oath and slit her thumb with a razorblade and dripped her blood on the Lavinia Whateleys decking so the ship might know her, Black Alicemetaphorically speakingtook a breath and jumped. - In Bravelands, lions make oaths by lightly scratching each other on the throat and swearing to hold their bargain.
- Marie Brennan's Doppelgänger duology features a blood-oath as a plot point in both books. If the oath is broken, the magically-sealed scar will bleed the Hunter (or witch or Cousin in the second book) to death through one wrist. Unique in that the oath binds both parties to their word (presumably; the actual wording states that the contractor binds him/herself to grant the contractee three boons without conditions, so magical compulsion may or may not extend to the contractor).
- In the Incarnations of Immortality series, when 2 immortal Incarnations sign an agreement, they choose to shed some blood to sign their names. This binds even the Incarnations to the deal. It happens once between two Incarnations Fate and Satan.
- In It, after defeating Pennywise the first time, the Losers Club make a blood oath by cutting their hands with a broken bottle and promise that if Pennywise ever returned, they would reunite and stop him for good.
- Parodied in one of humorist Patrick McManus's short stories about his childhood adventures with his pal Crazy Eddie Muldoon; the duo always talks about sealing their (not terribly vital) secrets with blood oaths, but since that would involve, you know, cutting yourself, they only do it when one of them accidentally damages himself while playing, and they "share" the blood.
- Nightfall (Series): Myra and Armida strike one. It is more binding to Armida, who is a vampire and cannot break a blood oath.
- In Shadows for Silence in the Forests of Hell, by Brandon Sanderson, shedding blood will draw the wrath of the shades like nothing else. An accidental bump or nosebleed doesn't count, but blood shed in anger, exposed to the air, will enrage every shade in the vicinity.
- A Song of Ice and Fire
- New members of the Second Sons (a mercenary company) initially had to sign their contracts with their blood, but nowadays red ink is used instead, because blood turned out to be a not very optimal substitute for ink. When Tyrion Lannister joins the company though, he adds a bit of his own blood to the ink, stating that he likes traditions.
- Stannis Baratheon uses his own blood to sign an accord with the Iron Bank of Braavos, because his ink has frozen. Given what the Iron Bank does to people who don't pay their debts, it has all the connotations of this trope.

- The Bazhir of Song of the Lioness have a lot of blood oaths. Members share blood to induct new people into the tribe, as part of the ceremony of making someone into the Voice of the Tribes, and as an adoption ritual. Alanna, who becomes part of the Bloody Hawk tribe, once sighs, looking at the scars she's already picked up while with the tribe and thinking she's just vain enough to not want to pick up more.
- Used frequently by Aly in the Trickster's Duet when she's turning enemy spies into double agents for the rebels it's harsh, but it discourages betrayal better than milder options would, so she doesn't let herself be bothered by it.
- Warhammer 40,000: It is revealed that before the events of the Gaunt's Ghosts series, Gaunt and several other officers made a blood oath with Warmaster Slaydo, promising to continue the Crusade and protect Saint Sabbat to the best of their efforts in the event that he died (which he did), and that this is the reason Gaunt is willing to disobey Lugo's orders.
- In the last season of Angel, Angel signs a contract from Wolfram and Hart in his own blood. He learns this when the person offering him the pen stabs it into his hand.
- In Farscape, when John needs Scorpius's help to rescue Aeryn, Scorpius first makes him perform a "Scarran blood vow", which involves both of them cutting their fingers and drinking each others' blood and then their own. John is understandably squicked.
- Lost in Space episode "The Space Pirate". After the title character takes Will Smith hostage, he decides that he has to tie Will up before going to sleep so Will can't escape. When Will objects, he proposes that Will take the Pirate's Oath instead.
- Played for Laughs in Malcolm in the Middle, when Hal remembers that he made a promise sealed in blood to nine year-old Francis that he will make up for missing his school play by taking him on a motorcycle trip for his twenty-first birthday. A promise Hal originally made just to get his son to stop crying.
- In Merlin (1998), Merlin swears an oath, complete with drawing a small amount of his own blood, to not use his magic except to defeat Queen Mab.
- An episode of Star Trek: Deep Space Nine is actually titled "Blood Oath". In it, Dax is called upon to fulfill a vow of vengeance her previous self made with three Klingon friends twenty-five years ago.
- A frequent trope for the Klingons in most Star Trek series. Everything requiring the slightest bit of commitment must be sealed with some blood from the hand (adoptions, contracts, weddings, birthdays, bachelor parties...)
- Manowar signed their contract with Megaforce Records with their own blood.
- In The Bible, the covenants that God makes with His people require the shedding of blood to make them effective and binding. Moses sprinkled the book of the Mosaic Covenant as well as the Israelites with the blood of goats and calves to sign and seal that covenant. Years later, Jesus would shed His blood on the cross to put into effect the New Covenant between God and His people, the Christians.
- During a famous feud with Jerry Lawler in Memphis, legendarily crazy lumberjack wrestler Jos LeDuc famously took a blood oath (pronounced "oat") swearing he would end Jerry Lawler's career. LeDuc ramped up the squick factor several notches by using a double-bladed axe and REALLY CUTTING A SCAR INTO HIS OWN ARM!
- Earthdawn: Earthdawn Gamemaster Pack, "Gamemastering Earthdawn" booklet. Magical blood charms are used to seal bargains: if either person violates the conditions, the magic punishes the violator.
- White Wolf:
- Vampire: The Requiem has the Invictus (a covenant of fedualist vampires heavy on inherited power) and their Blood Oaths, magical bonds with heavy penalties for violation.
- Changeling: The Lost has many forms of oaths, and your health or life can be put on the line for them. With heavy costs comes heavy rewards - the more you'll lose if you break the oath, the more benefit you can gain from it.
- The card Sign in Blood from Magic: The Gathering. Apparently it's quite a long document, because it hurts as much as getting mauled by a bear.
- Starting with 4th Edition, some of the Triad gangs in Shadowrun have started swearing blood oaths that are magically binding, resulting in Death of a Thousand Cuts if they violate those oaths (particularly the oath of secrecy).
- Subverted in Damn Yankees, where Applegate laughs at the idea of having Joe sign his name in blood to the contract.
- In Goethe's Faust, as well as the 1926 film adaptation, the title character's contract with Mephistopheles is signed with a drop of blood.
'Mephistopheles: Du unterzeichnest dich mit einem Tröpfchen Blut. (You sign it with a drop of blood.)
- A quest chain in World of Warcraft starts off with you making one of these with a troll, to show that you'll both honor a truce.
- In the backstory, the original Orc chieftains on Draenor gave themselves up willingly to the Burning Legion for power. To seal the pact, the chieftains drank the blood of Mannoroth, binding the entire Orc race to him while infusing them with his fell power.
- In Fire Emblem: Radiant Dawn, a blood pact is a contract that two or more people sign in blood. If the terms of the pact are not upheld, the person's subjects die off—first slowly, then progressively faster hence the plague that struck years ago. They can only be broken by killing at least one person involved in the pact AND destroying the document.
- In Thief 2 Enemy Mines seal their alliance this way (blood on earth variant).
- Okku from Neverwinter Nights 2: Mask of the Betrayer swears in blood to stop the recently emerged spirit-eater (that is, you, the protagonist). If spared, he calls a truce which lasts as long as you agree to suppress your urge to devour spirits and breaks if you meet certain conditions (commiting some certain evil acts in Okku's presence or getting his approval below zero).
- "Ares! Destroy my enemies and my life is yours!" Ascension reveals that this was a Blood Oath.  When Kratos turned against Ares after that last one, the Furies hounded him to bring him back to Ares' service.
- Madoc of Wake the Sleepers accepts a contract through blood on a bounty, as his crazy Assassin culture requires.
- Rowasu of Juathuur is full of scars because of this trope. He still breaks the last oath he makes.
- In The Order of the Stick, a Blood Oath binds not just the oath-taker, but all of their descendants. And if they don't die trying to fulfill the oath, they're denied entry into the afterlife while their children have a go at it.
- Of course, the specific instance mentioned here (namely, Eugene Greenhilt's oath against Xykon filtering down to his son Roy) is an odd case. The father in question abandoned the oath pretty quickly, only to try to force it on his child when he was getting old. After the child's death (he died trying to fulfil it), he gets into Heaven while the father is stuck in the "waiting room". When the father gets enraged at this, the angel who made the decree chews out the father for being so careless with a blood oath and points out that the child didn't actually have to take up the oath, but doing so out of free will and trying his best to fulfil it makes him a better person than the father.
- It should also be noted that "Start of Darkness" depicts taking the Oath much like getting a tattoo. Including the part where Eugene got it while he was smashed and had little recollection of doing so later.
- Of course, the specific instance mentioned here (namely, Eugene Greenhilt's oath against Xykon filtering down to his son Roy) is an odd case. The father in question abandoned the oath pretty quickly, only to try to force it on his child when he was getting old. After the child's death (he died trying to fulfil it), he gets into Heaven while the father is stuck in the "waiting room". When the father gets enraged at this, the angel who made the decree chews out the father for being so careless with a blood oath and points out that the child didn't actually have to take up the oath, but doing so out of free will and trying his best to fulfil it makes him a better person than the father.
 Given that the last time she was seen in Scary Go Round before reappearing without explanation in Bad Machinery she was in the company of and (technically) married to Aleister Crowley, and trapped in Hell, this may bode ill.
- In Sinfest, Satan wants the forms and waiver filled out in blood, of course.
- Vard, Kai and Marya are bound to the Unknown Champion with one for a year in exchange for her help saving the woods near where Kai and Marya live in Unknown Lands.
- In Sluggy Freelance only Gwynn can use the Book of E-Ville to cast spells because her name has appeared on the inside cover written in blood. Right above instructions to, if lost, drop in any mailbox to return it to the rightful owner.
- Played With in The Weave; freshly murdered and dying fairy queen Rhiannon gets her blood onto the only witness of the murder, Tally, and subsequently can contact Tally in her dreams because she wants to convince her to help avenging her murder, but Tally really only seals the deal when she agrees to help Rhiannon.
- Whateley Universe example: Carmilla and Fey made a blood pact that was so powerful it gave them some of the other's traits. Carmilla now has Fey's body (including Pointy Ears) and hair, and Fey got some of Carmilla's mental capacity.
- In one episode of The Power Puff Girls 2016, Bubbles and Buttercup sell Blossom's soul to HIM for a dollar, and this trope is implied when the girls sign the contract that HIM gives them.
Bubbles: I like the red ink.HIM: Uh...Yeah...Ink.
- There are blood vial pendants for sale around the Internet. The idea behind them is for the couple to carry a bit of each other's blood close to their chests as a sign of their bond.
- The 1876 April Uprising, Bulgaria's most significant rebellion against the Ottoman Empire, was declared through the so-called "Blood Letter", which the Rebel Leader Todor Kableshkov signed with the blood of his hometown's assassinated governor and sent to the town where the revolutionary organisation's HQ resided.


Bootstrap4: This site was built using Bootstrap 4 and its Flexbox features, components such as cards, buttons, and customizable navbars.
Rogue Pickings
Coding Responsive Websites: My first project on coding a responsive, mobile-first website using Flexbox and CSS, which involves turning a static website into a responsive website.
Unplugged
Coding Responsive Websites: The final project for the class, using HTML5 and Flexbox to create a responsive, three-page, mobile-ready website with responsive iframes & icon fonts.
Election Map
JavaScript & JQuery: This project was created using JavaScript & JQuery to create a fun website featuring an interactive election map of the United States.


wynn-las-vegas
Businessmodel of Wynn Las Vegas
Customer Segments
Wynn Las Vegas has a mass market business model, with no significant differentiation between customer groups. The company targets its offerings at all consumers who desire hospitality and entertainment services.
Value Proposition
Wynn Las Vegas offers three primary value propositions: innovation, cost reduction, and brand/status.
The company has embraced innovation throughout its history. Its groundbreaking efforts include the following:
- Tallest hotel building on the Vegas strip upon its completion, a record that lasted two years
- First Las Vegas casino to feature a car dealership, Ferrari-Maserati
- First combination of a room key and a casino frequent-player card into a single card
- Largest distribution of HDTV into hotel rooms in the world
- Largest installation of voice-over IP technology for hotel phones
-
First Las Vegas casino to install RFID tags inside chips to better detect counterfeiting The company reduces costs through its Wynn Insiders loyalty program. The program offers the following benefits:
- The lowest hotel prices available anywhere, guaranteed
- 15% off every room booking with no black-out dates
-
The Wynn Rate Promise: easy changes to reservations, no hidden fees, and special offers The company has established a strong brand due to its success. It is the world’s seventh largest hotel, and is on the Standard & Poor’s 500 and NASDAQ 100 indexes. It has earned the following:
- The Tower Suites at Wynn Las Vegas received the Forbes five-star distinction nine years in a row
- The Spa at Wynn Las Vegas earned five-star recognition from Forbes for seven years in a row
- The Tower Suites at Encore at Wynn Las Vegas and the Spa at Encore at Wynn Las Vegas have also received Forbes five-star distinction Wynn Las Vegas and Encore Las Vegas (its sister property) together have won more Forbes five-star awards than any other resort/casino worldwide. Wynn Las Vegas also made history by obtaining five-star ratings in every category (Spa, Restaurant, and Hotel) for two consecutive years. The resort has also earned Mobil five-star, Michelin five-star, AAA five diamond, and Zagat Survey Top U.S. Hotel ratings, in addition to a Michelin star for its Wing Lei restaurant. Lastly, it has been recognized by the Condé Nast Traveller Gold List as one of the “Top Hotels in the World”.
Channels
Wynn Las Vegas’s main channel is its website. The company promotes its offering through its social media pages, advertising, and participation in trade shows and conferences.
Customer Relationships
Wynn Las Vegas’s customer relationship is primarily of a personal assistance nature. It provides customers with services such as room bookings, room upkeep, and room service. That said, there is a self-service component. The company’s website features Wynn Magazine, which offers informative articles on Food & Drink, Fashion & Style, and Art & Design.
Key Activities
Wynn Las Vegas’s business model entails designing, developing, and delivering its services for customers.
Key Partners
Wynn Las Vegas’s key partners are the suppliers that provide it with the products and services it needs to offer its services to customers. These include slot machines, retail goods, security and surveillance systems, ferry tickets, gaming equipment and accessories, construction, and other administrative services.
Key Resources
Wynn Las Vegas’s main resources are its physical resources. Its integrated Las Vegas resort of Wynn Las Vegas and Encore at Wynn Las Vegas features 186,000 square feet of casino space with
232 table games, 1,849 slot machines, and two luxury hotel towers with a total of 4,748 guest rooms, villas, and suites. Wynn Las Vegas Encore includes 34 food and beverage outlets, 99,000 square feet of retail space, 290,000 square feet of meeting and convention space, an on-site 18-hole golf course, a Ferrari and Maserati dealership, two showrooms, three nightclubs, and a beach club. The company places a high priority on its intellectual property, with its trademarks important to its business.
Cost Structure
Wynn Las Vegas has a value-driven structure, aiming to provide a premium proposition through significant personal service and frequent service enhancements. Its biggest cost driver is casino operation costs. Other major drivers are in the areas of food/beverage costs and administration.
Revenue Streams
Wynn Las Vegas has two revenue streams: casino and non-casino revenues.


{% extends "tutorial.html" %} {% block head %} {% endblock %} {% block iscompatible %} {% endblock %} {% block html5badge %} {% endblock %} {% block content %}
The web’s security model is rooted in the same origin policy. Code from https://mybank.com
should only have access to https://mybank.com
’s data, and https://evil.example.com
should certainly never be allowed access. Each origin is kept isolated from the rest of the web, giving developers a safe sandbox in which to build and play. In theory, this is perfectly brilliant. In practice, attackers have found clever ways to subvert the system.
Cross-site scripting (XSS) attacks, for example, bypass the same origin policy by tricking a site into delivering malicious code along with the intended content. This is a huge problem, as browsers trust all of the code that shows up on a page as being legitimately part of that page’s security origin. The XSS Cheat Sheet is an old but representative cross-section of the methods an attacker might use to violate this trust by injecting malicious code. If an attacker successfully injects any code at all, it’s pretty much game over: user session data is compromised and information that should be kept secret is exfiltrated to The Bad Guys. We’d obviously like to prevent that if possible.
This tutorial highlights one promising new defense that can significantly reduce the risk and impact of XSS attacks in modern browsers: Content Security Policy (CSP).
The core issue exploited by XSS attacks is the browser’s inability to distinguish between script that’s intended to be part of your application, and script that’s been maliciously injected by a third-party. For example, the Google +1 button at the top of this article loads and executes code from https://apis.google.com/js/plusone.js
in the context of this page’s origin. We trust that code, but we can’t expect the browser to figure out on it’s own that code from apis.google.com
is awesome, while code from apis.evil.example.com
probably isn’t. The browser happily downloads and executes any code a page requests, regardless of source.
Instead of blindly trusting everything that a server delivers, CSP defines the Content-Security-Policy
HTTP header that allows you to create a whitelist of sources of trusted content, and instructs the browser to only execute or render resources from those sources. Even if an attacker can find a hole through which to inject script, the script won’t match the whitelist, and therefore won’t be executed.
Since we trust apis.google.com
to deliver valid code, and we trust ourselves to do the same, let’s define a policy that only allows script to execute when it comes from one of those two sources:
Content-Security-Policy: script-src 'self' https://apis.google.com
Simple, right? As you probably guessed, script-src
is a directive that controls a set of script-related privileges for a specific page. We’ve specified 'self'
as one valid source of script, and https://apis.google.com
as another. The browser will dutifully download and execute JavaScript from apis.google.com
over HTTPS, as well as from the current page’s origin.
With this policy defined, the browser will simply throw an error instead of loading script from any other source. When a clever attacker does manage to inject code into your site, she’ll run headlong into an error message, rather than the success she was expecting:
While script resources are the most obvious security risks, CSP provides a rich set of policy directives that enable fairly granular control over the resources that a page is allowed to load. You’ve already seen script-src
, so the concept should be clear. Let’s quickly walk through the rest of the resource directives:
base-uri
restricts the URLs that can appear in a page’s <base>
element.child-src
lists the URLs for workers and embedded frame contents. For example: child-src https://youtube.com
would enable embedding videos from YouTube but not from other origins. Use this in place of the deprecated frame-src
directive.connect-src
limits the origins to which you can connect (via XHR, WebSockets, and EventSource).font-src
specifies the origins that can serve web fonts. Google’s Web Fonts could be enabled via font-src https://themes.googleusercontent.com
form-action
lists valid endpoints for submission from <form>
tags.frame-ancestors
specifies the sources that can embed the current page. This directive applies to <frame>
, <iframe>
, <embed>
, and <applet>
tags. This directive can’t be used in <meta>
tags and applies only to non-HTML resources.frame-src
deprecated. Use child-src
instead.img-src
defines the origins from which images can be loaded.media-src
restricts the origins allowed to deliver video and audio.object-src
allows control over Flash and other plugins.plugin-types
limits the kinds of plugins a page may invoke.report-uri
specifies a URL where a browser will send reports when a content security policy is violated. This directive can’t be used in <meta>
tags.style-src
is script-src
’s counterpart for stylesheets.upgrade-insecure-requests
Instructs user agents to rewrite URL schemes, changing HTTP to HTTPS. This directive is for web sites with large numbers of old URLs that need to be rewritten.By default, directives are wide open. If you don’t set a specific policy for a directive, let’s say font-src
, then that directive behaves by default as though you’d specified *
as the valid source (e.g. you could load fonts from everywhere, without restriction).
You can override this default behavior by specifying a default-src
directive. This directive, as you might suspect, defines the defaults for most directives you leave unspecified. Generally, this applies to any directive that ends with -src
. If default-src
is set to https://example.com
, and you fail to specify a font-src
directive, then you can load fonts from https://example.com
, and nowhere else. We specified only script-src
in our earlier examples, which means that images, fonts, and so on can be loaded from any origin.
The following directives don’t use default-src as a fallback. Remember that failing to set them is the same as allowing anything.
base-uri
form-action
frame-ancestors
plugin-types
report-uri
sandbox
You can use as many or as few of these directives as makes sense for your specific application, simply listing each in the HTTP header, separating directives with semicolons. You’ll want to make sure that you list all required resources of a specific type in a single directive. If wrote something like
script-src https://host1.com; script-src https://host2.com
the second directive would simply be ignored. Something like the following would correctly specify both origins as valid.
script-src https://host1.com https://host2.com
If, for example, you have an application that loads all of its resources from a content delivery network (say, https://cdn.example.net
), and know that you don’t need framed content or any plugins at all, then your policy might look like the following:
Content-Security-Policy: default-src https://cdn.example.net; child-src 'none'; object-src 'none'
You will see X-WebKit-CSP
and X-Content-Security-Policy
headers in various tutorials on the web. Going forward, you can and should ignore these prefixed headers. Modern browsers (with the exception of IE) support the unprefixed Content-Security-Policy
header. That’s the header you should use.
Regardless of the header you use, policy is defined on a page-by-page basis: you’ll need to send the HTTP header along with every response that you’d like to ensure is protected. This provides a lot of flexibility, as you can fine-tune the policy for specific pages based on their specific needs. Perhaps one set of pages in your site has a +1 button, while others don’t: you could allow the button code to be loaded only when necessary.
The source list in each directive is fairly flexible. You can specify sources by scheme (data:
, https:
), or ranging in specificity from hostname-only (example.com
, which matches any origin on that host: any scheme, any port) to a fully qualified URI (https://example.com:443
, which matches only HTTPS, only example.com
, and only port 443). Wildcards are accepted, but only as a scheme, a port, or in the leftmost position of the hostname: *://*.example.com:*
would match all subdomains of example.com
(but not example.com
itself), using any scheme, on any port.
Four keywords are also accepted in the source list:
'none'
, as you might expect, matches nothing.'self'
matches the current origin, but not its subdomains.'unsafe-inline'
allows inline JavaScript and CSS (we’ll touch on this in more detail in a bit).'unsafe-eval'
allows text-to-JavaScript mechanisms like eval
(we’ll get to this too).These keywords require single-quotes. script-src 'self'
(with quotes) authorizes the execution of JavaScript from the current host. script-src self
(no quotes) allows JavaScript from a server named “self
” (and not from the current host), which probably isn’t what you meant.
There’s one more directive worth talking about: sandbox
. It’s a bit different than the others we’ve looked at, as is places restrictions on actions the page can take, rather than on resources that the page can load. If the sandbox
directive is present, the page will be treated as though it was loaded inside of an iframe
with a sandbox
attribute. This can have a wide range of effects on the page: forcing the page into a unique origin, and preventing form submission, among others. It’s a bit beyond the scope of this article, but you can find full details on valid sandboxing attributes in the “sandboxing flag set” section of the HTML5 spec.
CSPs preferred delivery mechanism is an HTTP header. It can be useful, however, to set a policy on a page directly in the markup. Do that using a meta tag with an http-equiv attribute:
<meta http-equiv="Content-Security-Policy" content="default-src https://cdn.example.net; child-src 'none'; object-src 'none'">
This can’t be used for frame-ancestors, report-uri, or sandbox.
It should be clear that CSP is based on whitelisting origins, as that’s an unambiguous way of instructing the browser to treat specific sets of resources as acceptable and to reject the rest. Origin-based whitelisting doesn’t, however, solve the biggest threat posed by XSS attacks: inline script injection. If an attacker can inject a script tag that directly contains some malicious payload (<script>sendMyDataToEvilDotCom();</script>
), the browser has no mechanism by which to distinguish it from a legitimate inline script tag. CSP solves this problem by banning inline script entirely: it’s the only way to be sure.
This ban includes not only scripts embedded directly in script
tags, but also inline event handlers and javascript:
URLs. You’ll need to move the content of script
tags into an external file, and replace javascript:
URLs and <a ... onclick="[JAVASCRIPT]">
with appropriate addEventListener
calls. For example, you might rewrite the following from:
<script>
function doAmazingThings() {
alert('YOU AM AMAZING!');
}
</script>
<button onclick='doAmazingThings();'>Am I amazing?</button>
to something more like:
<!-- amazing.html -->
<script src='amazing.js'></script>
<button id='amazing'>Am I amazing?</button>
// amazing.js
function doAmazingThings() {
alert('YOU AM AMAZING!');
}
document.addEventListener('DOMContentReady', function () {
document.getElementById('amazing')
.addEventListener('click', doAmazingThings);
});
The rewritten code has a number of advantages above and beyond working well with CSP; it’s already best practice, regardless of your use of CSP. Inline JavaScript mixes structure and behavior in exactly the way you shouldn’t. External resources are easier for browsers to cache, more understandable for developers, and conducive to compilation and minification. You’ll write better code if you do the work to move code into external resources.
Inline style is treated in the same way: both the style
attribute and style
tags should be consolidated into external stylesheets to protect against a variety of surprisingly clever data exfiltration methods that CSS enables.
If you really, absolutely must have inline script and style, you can enable it by adding 'unsafe-inline'
as an allowed source in a script-src
or style-src
directive. You can also use a nonce or a has (see below). But please don’t.  It’s a little bit of effort up front to ensure that things work correctly after moving all the code out-of-line, but that’s a tradeoff that’s well worth making.
CSP Level 2 offers backward compatibility for inline scripts by allowing you to whitelist specific inline scripts using either a cryptographic nonce (number used once) or a hash. Although this may be cumbersome in practice, it is useful in a pinch.
To use a nonce, give your script tag a nonce attribute. Its value must match one in the list of trusted sources. For example:
<script nonce=EDNnf03nceIOfn39fn3e9h3sdfa>
// Some inline code I can't remove yet, but need to asap.
</script>
Now, add the nonce to your script-src directive appended to the nonce- keyword.
Content-Security-Policy: script-src 'nonce-EDNnf03nceIOfn39fn3e9h3sdfa'
Remember that nonces must be regenerated for every page request and they must be unguessable.
Hashes work in much the same way. Instead of adding code to the script tag, create a SHA hash of the script itself and add it to the script-src directive. For example, let’s say your page contained this:
<script>alert('Hello, world.');</script>
Your policy would contain this:
Content-Security-Policy: script-src 'sha256-qznLcsROx4GACP2dm0UCKCzCG-HiZ1guq6ZZDob_Tng='
There are a few things to note here. The sha*-
prefix specifies the algorithm used to generate the hash. In the example above, sha256- is used. CSP also supports sha384- and sha512-. When generating the hash do not include the <script>
tags. Also capitalization and whitespace matter, including leading or trailing whitespace.
A Google search on generating SHA hashes will lead you to solutions in any number of languages. Using Chrome 40 or later you can open DevTools then reload your page. The Console tab will contain error messages with the correct sha256 hash for each of your inline scripts.
Even when an attacker can’t inject script directly, she might be able to trick your application into converting otherwise inert text into executable JavaScript and executing it on her behalf. eval()
, new Function()
, setTimeout([string], ...)
, and setInterval([string], ...)
are all vectors through which injected text might end up executing something unexpectedly malicious. CSP’s default response to this risk is, unsurprisingly, to block all of these vectors completely.
This has more than a few impacts on the way you build applications:
JSON.parse
, rather than relying on eval
. Native JSON operations are available in every browser since IE8, and they’re completely safe.Rewrite any setTimeout
or setInterval
calls you’re currently making with inline functions rather than strings. For example:
setTimeout("document.querySelector('a').style.display = 'none';", 10);
would be better written as:
setTimeout(function () {
document.querySelector('a').style.display = 'none';
}, 10);
new Function()
liberally to speed up template generation at runtime. It’s a nifty application of dynamic programming, but comes at the risk of evaluating malicious text. Some frameworks support CSP out of the box, falling back to a robust parser in the absence of eval
; AngularJS’s ng-csp directive is a good example of this.You’re even better off, however, if your templating language of choice offers precompilation (Handlebars does, for instance). Precompiling your templates can make the user experience even faster than the fastest runtime implementation, and it’s safer too. Win, win!
If eval and its text-to-JavaScript brethren are completely essential to your application, you can enable them by adding 'unsafe-eval'
as an allowed source in a script-src
directive. But, again, please don’t. Banning the ability to execute strings makes it much more difficult for an attacker to execute unauthorized code on your site.
CSP’s ability to block untrusted resources client-side is a huge win for your users, but it would be quite helpful indeed to get some sort of notification sent back to the server so that you can identify and squash any bugs that allow malicious injection in the first place. To this end, you can instruct the browser to POST
JSON-formatted violation reports to a location specified in a report-uri
directive.
Content-Security-Policy: default-src 'self'; ...; report-uri /my_amazing_csp_report_parser;
Those reports will look something like the following:
{
"csp-report": {
"document-uri": "http://example.org/page.html",
"referrer": "http://evil.example.com/",
"blocked-uri": "http://evil.example.com/evil.js",
"violated-directive": "script-src 'self' https://apis.google.com",
"original-policy": "script-src 'self' https://apis.google.com; report-uri http://example.org/my_amazing_csp_report_parser"
}
}
It contains a good chunk of information that will help you track down the specific cause of the violation, including the page on which the violation occurred (document-uri
), that page’s referrer (referrer, note that the key is not misspelled), the resource that violated the page’s policy (blocked-uri
), the specific directive it violated (violated-directive
), and the page’s complete policy (original-policy
).
If you’re just starting out with CSP, it makes sense to evaluate the current state of your application before rolling out a draconian policy to your users. As a stepping stone to a complete deployment, you can ask the browser to monitor a policy, reporting violations, but not enforcing the restrictions. Instead of sending a Content-Security-Policy
header, send a Content-Security-Policy-Report-Only
header.
Content-Security-Policy-Report-Only: default-src 'self'; ...; report-uri /my_amazing_csp_report_parser;
The policy specified in report-only mode won’t block restricted resources, but it will send violation reports to the location you specify. You can even send both headers, enforcing one policy while monitoring another. This is a great way to evaluate the effect of changes to your application’s CSP: turn on reporting for a new policy, monitor the violation reports and fix any bugs that turn up, then start enforcing the new policy once you’re satisfied with its effect.
CSP 1 is quite usable in Chrome, Safari, and Firefox, and has (very) limited support in IE 10. You can view specifics at caniuse.com. CSP Level 2 was available in Chrome with version 40. Massive sites like Twitter and Facebook have deployed the header (Twitter’s case study is worth a read), and the standard is very much ready for you to start deploying on your own sites.
The first step towards crafting a policy for your application is to evaluate the resources you’re actually loading. Once you think you have a handle on how things are put together in your app, set up a policy based on those requirements. Let’s walk through a few common use-cases, and determine how we’d best be able to support them within the protective confines of CSP:
Google’s +1 button includes script from https://apis.google.com
, and embeds an iframe
from https://plusone.google.com
. You’ll need a policy that includes both these origins in order to embed the button. A minimal policy would be script-src https://apis.google.com; child-src https://plusone.google.com
. You’ll also need to ensure that the snippet of JavaScript that Google provides is pulled out into an external JavaScript file. If you had an existing policy using child-src, you would need to change it to child-src.
Facebook’s Like button has a number of implementation options. I’d recommend sticking with the iframe
version, as it’s safely sandboxed from the rest of your site. That would require a child-src https://facebook.com
directive to function properly. Note that, by default, the iframe
code Facebook provides loads a relative URL, //facebook.com
. Please change that to explicitly specify HTTPS: https://facebook.com
. There’s no reason to use HTTP if you don’t have to.
Twitter’s Tweet button relies on access to a script and frame, both hosted at https://platform.twitter.com
(Twitter likewise provides a relative URL by default: please edit the code to specify HTTPS when copy/pasting it locally). You’ll be all set with script-src https://platform.twitter.com; child-src https://platform.twitter.com
, as long as you move the JavaScript snippet Twitter provides out into an external JavaScript file.
Other platforms will have similar requirements, and can be addressed similarly. I’d suggest just setting a default-src
of 'none'
, and watching your console to determine which resources you’ll need to enable to make the widgets work.
Including multiple widgets is straightforward: simply combine the policy directives, remembering to merge all resources of a single type into a single directive. If you wanted all three, the policy would look like:
script-src https://apis.google.com https://platform.twitter.com; child-src https://plusone.google.com https://facebook.com https://platform.twitter.com
Assume for a moment that you run a banking site, and want to make very sure that only those resources you’ve written yourself can be loaded. In this scenario, start with a default policy that blocks absolutely everything (default-src 'none'
), and build up from there.
Let’s say the bank loads all images, style, and script from a CDN at https://cdn.mybank.net
, and connects via XHR to https://api.mybank.com/
to pull various bits of data down. Frames are used, but only for pages local to the site (no third-party origins). There’s no Flash on the site, no fonts, no nothing. The most restrictive CSP header that we could send in this scenario is:
Content-Security-Policy: default-src 'none'; script-src https://cdn.mybank.net; style-src https://cdn.mybank.net; img-src https://cdn.mybank.net; connect-src https://api.mybank.com; child-src 'self'
A wedding-ring discussion forum admin wants to ensure that all resources are only loaded via secure channels, but doesn’t really write much code; rewriting large chunks of the third-party forum software that’s filled to the brim with inline script and style is beyond his abilities. The following policy would be effective:
Content-Security-Policy: default-src https:; script-src https: 'unsafe-inline'; style-src https: 'unsafe-inline'
Even though https:
was specified in default-src
, the script and style directives don’t automatically inherit that source. Each directive overwrites the default completely for that specific type of resource.
Content Security Policy Level 2 is a Candidate Recommendation. The W3Cs Web Application Security Working Group isn’t lounging around, patting itself on the back; work has already begun on the specifications next iteration. The next version is already under active development.
If you’re interested in the discussion around these upcoming features, skim the public-webappsec@ mailing list archives, or join in yourself.
{% endblock %}


Engineering Team
Grace
Manager
Id: 1
Email:
<EMAIL_ADDRESS>Office Number: 112233
Caleb
Engineer
Id: 2
Email:
<EMAIL_ADDRESS>Github
Lian
Intern
Id: 5
Email:
<EMAIL_ADDRESS>School: UoA


meteoric124:meteoric is a fork from meteoric:ionic. Considering that it had a huge user base, it made sense that a migration guide is to be made.
meteoric124:meteoric
meteoric:ionic


--- layout: default title: Contact slug: contact lead: We want your feedback! ---
Please choose a communication method that better suits your needs.
#zealdocs
on
Libera Chat. Also available through
web interface. Please, take into consideration
possible time zone differences.


{% extends "fancypages/layout.html" %} {% load i18n %} {% block content %} {% if form.errors %}
Your username and password didn't match. Please try again.


Lab Scenario 2 - Scope to nowhere
- You
won a contract from the Alaska state government to build a website to market:
Alaska’s ”Bridge
to nowhere” (look it up)
- This site was originally
built in Grav because you thought it was a one
off, but now the client is mad because they heard a word other than “WordPress” (snark but happens
) and are instantly concerned
about having to support
two different
applications
.
- You need to build a website and QUICK to convince them to stay with you, either as a new WordPress site or get them to use the existing one. This
website needs turned around in 1 week (shocking
).
- Pick a theme
for a brochure style website
and show them what a site in
WordPress would feel like relative to Grav
Deliverable
-
Create
a WordPress site on reclaim hosting
- Select plugins to improve
SEO, help
ensure accessibility, and
simplify content editing beyond the
default editor (enable classic
editor
)
- Pick a nice theme and customize it with a few links to make the site look like a real brochure style website
(typical parks and rec site has History, News, Hours, Location, Reviews, etc).
- Modify the
homepage
,
be as snarky as you like, this is a
real bridge project so meme it up. Under
History make a
Pros and Cons list of WordPress vs Grav
. Make sure to list at least 3
advantages and disadvantages
of each platform (links can help prove these).
- Record a video demonstrating some of the similarities
and differences
between Grav and WordPress in
order
to
allay their concern
Solving the scenario
- The
client is in favor of WordPress
because of other projects. You
like making money but want to cover your butt. Make arguments for why you
agree they should migrate from
Grav
to WordPress
. After all, this is a government contract and once your in maybe you can get more by making them happy.
OR
- You sell
Grav
over WordPres
s; if you are going to get paid, might as well do it based on work
you’ve already
done rather then need to scrap it all
and build them a new website. This might
seem more difficult but remember.. Governments
LOVE
security
and
WP is hacked.. a lot.
Play on that fear relative to how Grav works.
Note: You don’t have to build a new Grav site, you can point to features in
the existing one you made but you are welcome to make a new one if you so
desire


This is content in the header.
This is some information within the section.
The event takes place this upcoming Saturday, and over 3,000 people have already registered.
-------------------- The i tag represents text in an “alternate voice” or “mood” Some example uses for the i tag: ๏ Ship name in Western texts ๏ A thought ๏ Transliteration ๏ Idiomatic phrase from another language ๏ Technical term ๏ Taxonomic designation EXAMPLEI hope this works, he thought.
In HTML5, the em and strong tags have new meanings: ๏ The strong tag now means “strong importance” ๏ The em tag now means “stress emphasis” EMs EXAMPLEMake sure to sign up before the day of the event, September 16, 2013.
BOLD EXAMPLEMake sure to sign up before the day of the event, September 16, 2013.


What is Informatics?
Informatics became a thing when we started collecting lots of data, and it was hard:
- Our data is too large to comprehend: need to visualize it better
- Our data is too large to work on alone: need to collaborate
More specifically, D3.js
- stands for Data Driven Documents
- A JavaScript library for manipulating HTML based on data
- There are many beautiful examples
- I like this network diagram
But, its hard
- The examples aren't very reusable
- Not plug and play like ggplot, matplotlib
What about D3-based libraries?
These libraries are great to start
- I usually need to tweak them
-
The goal is to learn the basic concepts
-
Start with an interactive bar plot
Browser Basics:
- HTML: the content
- CSS: the style
- JS: the interaction
Open the CodePen to get started


I am Prathyusha
A Data Science Enthusiast
A Data Science Enthusiast
I am a Sophomore from SRM University, AP who always dreams of travelling the world
Ever since I joined college, I was always extremely passionate about Data Science and have worked on some very interesting projects!
Sometimes data gets boring, that is when design looks interesting.
Don't hesitate even if it's just a hello
I would love to collaborate if you have any projects in your mind.
CONTACT ME


[§431:10H-103] Short title. This article may be known and cited as the "Long-Term Care Insurance Act". [L 1999, c 93, pt of §2]


Home
App
Info
About me & Contact
Your Mental Health hub.
About
I'm Andrei Munteanu, your Microsoft Certified web developer.
Mentally Healthy is a platform where you can find many useful resources for your Mental health, presented in a beautiful web page.
This has been created as the project for the
Helloo World Hackathon
Resources used:
-Logo:
Namecheap Logo maker
-Navbar:
Eric Terwan via codepen.io
-Footer:
Material Design for bottstrap
-Resources Carousel:
CSS Tricks Website
-Icons:
Fontawesome.com
-Mental Health Resources:
Mental Health Forever Database
by
Magnify Wellness


By @cburgdorf and @PascalPrecht
Otto Developer Meet-up - June 13, 2014
Sofa is an SDK that makes building e-commerce web apps for the CouchCommerce platform a breeze.
couchService
.getProducts('category')
.then(function (products) {
// do something with products
});
var item = basketService
.addItem(product, 1, variant);
basketService.increase(item, 5);
basketService.decrease(item, 5);
basketService.exists(product, variant);
basketService.find(predicate);
basketService.getSummary();
✓ automagically persistence
searchService
.search(searchTerm, options)
.then(function (result) {
// do something with result
});
✓ configurable throttleing
✓ no out of order responses
checkoutService
.getSupportedCheckoutMethods(...)
.then(function (methods) {
// do something with methods
});
checkoutService
.checkoutWithCouchCommerce(...)
.then(function (token) {
// do something with token
});


Add details to your account
-
"Here are all the legal requirements that would put a normal person to sleep but which we expect you to have to suffer through reading if you want to proceed.
-
"Here are all the legal requirements that would put a normal person to sleep but which we expect you to have to suffer through reading if you want to proceed.


| Name | Stang, Julian Dwain |
| Address | Adunistraße 15, 81369 Munich, Germany |
|<EMAIL_ADDRESS>| |
| Mobile | +49<PHONE_NUMBER> |
| Nationality | German |
| Date of Birth | 13 December 1996 |
| 10/2019 - today | Student Assistant at the Chair of Vibro-Acoustics of Vehicles and Machines, Technical University of Munich (TUM) |
| Tutor for Engineering Mechanics 3, Dynamics (until 03/2020) | |
| Programming of vibro-acoustic applications (until 06/2020) | |
| Development of physics-informed neural networks (since 07/2020) | |
| 10/2019 - 02/2020 | Working Student at OHB System AG |
| Python programming for optical simulation of space instruments | |
| Implementation of unit tests and automatic generation of software documentation | |
| Agile software-development (GitLab & Jira) | |
| 05/2019 - 08/2019 | Student Assistant at the Chair of Aerodynamics and Fluid Mechanics, Technical University of Munich (TUM) |
| Tutor for Fluidmechanics 1 | |
| 09/2018 - 02/2019 | Working Student at Siemens eAircraft in Sales & Business Development (Siemens AG, now Rolls Royce Electrical) |
| Supporting of sales executives in Business Development | |
| 01/2018 - 03/2018 | Student Assistant at the Chair of Thermodynamics, Technical University of Munich (TUM) |
| Maintaining the chair’s library |
>p>p< 10/2020 - today & Master of Science (M.Sc.) Development, Production, and
Management in Mechanical Engineering at the Technical University of Munich
10/2019 - today & Master of Science (M.Sc.) Aerospace at the Technical University of Munich (TUM)
Term Paper & Embedding the Helmholtz Equation in Neural Networks, Local Grade: 1.0
10/2016 - 09/2019 & Bachelor of Science (B.Sc.) Mechanical Engineering at the Technical University of Munich
(TUM), Local Grade: 2.6
Bachelor’s Thesis & Deep Learning in Vibroacoustic Design Processes, Local Grade: 1.3
09/2007 - 06/2015 & High School Diploma, Christoph-Probst-Gymnasium Gilching, Local Grade: 2.1
| 02/2020 - 02/2025 | Basis Certificate Project Management (Level D), Issued by the German Society for Project Management (GPM) |
| 07/2018 | First Place in "Film ab!", a student competition at the Department of Mechanical Engineering of the Technical University of Munich (TUM) |
| 06/2015 | Special Award for Outstanding Achievements in Physics during A-Level Examinations, Issued by the German Physical Society (DPG) |
| German | Native |
| English | Fluent |
| French | Basic (Delf A1) |
| Spanish | Basic |
| Japanese | Basic |
| 04/2019 | Baseline Competence Teaching, Education in University Teaching at the Center of Key Competencies of the Technical University of Munich (TUM) |
| 04/2018 - 07/2018 | Additive Manufacturing Project at the Chair of Machine Elements (FZG) and the Chair of Micro Technology and Medical Device Technology of the Technical University of Munich (TUM) |
| 10/2016 - 07/2017 | Participation at the Tutorsystem during Undergraduate Studies at the Department of Mechanical Engineering of the Technical University of Munich (TUM) |
| Programming Languages | Python, C/C++, Matlab, Julia |
| Python Frameworks | Numpy, Scipy, Pandas, TensorFlow, PyTorch, Matplotlib, Selenium, Sphinx |
| High Performance Computing | CUDA, OpenACC |
| Other | Microsoft Office, Latex, Git, Jira, COMSOL, Autodesk Inventor |


Gas pipeline blast kills 7, injured 25 in Bangladesh
Death toll may rise as some injured in explosion are in critical condition, say police.
At least seven people were killed and 25 injured in a gas pipeline blast in Bangladesh's port city of Chottogram on Sunday morning (0330GMT), according to local media reports and police.
"So far we have confirmed about seven dead bodies, including one child, four males, and two females who were severely burned on the spot," Bijoy Boshak, deputy commissioner of the Chottogram Metropolitan Police (North), told Anadolu Agency.
The seven burn victims were rushed to the hospital where doctors declared them dead on arrival, Boshak said, adding that all the injured have been admitted to the hospital, including some in critical condition. The death toll may rise.
He said local police and firefighters are still continuing rescue operations. "We primarily came to know that due to the gas pipeline blast, a part of a building collapsed," he added.
Citing eyewitnesses, local media reports say the walls of the building were blown off in the explosion while the gate of a nearby building and a minibus in its garage were also damaged.
Among the injured, one suffered burns while the remainder were wounded by the building collapse, local private channel Shomoy TV reported, citing local sources.