For the first two weeks of a course, I leave detailed feedback in the gradebook comment section. If a student didn't meet the discussion expectations, I deduct points and refer them to the discussion guidelines.

The ls command doesn't expand wildcards, it's the shell that does. Do not parse the output of ls, it's practically never needed and often breaks something.

DO NOT PARSE LS.

Do not use xargs without -d when you do not want ' " \ to be handled specially.

The ORCID Researcher Advisory Council (ORAC) is a diverse group of researchers who provide valuable perspectives and advice to ORCID staff and the ORCID Board to ensure that ORCID provides value and utility to researchers and facilitates research and innovation.

alternative credential programming and financialmodels are highly decentralized across an institution – so much so that it may bedifficult for an institution to have a good grasp of its entire portfolio. Adding alternativecredentials to an institution’s strategic priorities will firm up program and business modelplanning and execution

First is the strategic priority within their institution. Ifalternative credentials have been embraced by senior leadership and included in thestrategic plan, they are more likely to have the necessary resources allocated to them

What they say is this is due to is new EU policies about messenger apps. I'm not in the EU. I reckon it's really because there's a new Messenger desktop client for Windows 10, which does have these features. Downloading the app gives FB access to more data from your machine to sell to companies for personalized advertising purposes.

It’s not available to everyone, but a senior leadership who is vocal about lifelong learning can give you greater access to open doors, and people will take it more seriously. Time is never wasted with senior leadership and demonstrating the long-term interest for the institution, communities and companies we serve.

In a journal article or manuscript a sample identified by IGSN SSH000SUA may look like this (tagged IGSN): IGSN:SSH000SUA

Unlike many other persistent identifiers, an IGSN is used not only used by machines but also needs to be handled by humans.

Appropriate identifiers Requirement: PIDs appropriate to the digital object type being persistently identified.

withdrawing content withoutposting a notification (“Tombstone Page”) andupdating the record's URL/metadata with DataCite

When content underlying a DOI is updated, we recommend updating the DOI metadata and, for major changes, assigning a new DOI. For minor content changes, the same DOI may be used with updated metadata. A new DOI is not required. For major content changes, we recommend assigning a new DOI and linking the new DOI to the previous DOI with related identifiers.

To enable easy usability for both humans and machines, a DOI should resolve to a landing page that contains information about the DOI being resolved. It is the responsibility of the entity creating the DOI to provide such a landing page. The following are best practices for creating well-formed DOI landing pages.

there may be infrequent cases where it is not desirable for the item described by a DOI to be available publicly, such as in the case of research retraction. In these cases, it is best practice to still provide a "tombstone page", which is a special type of landing page describing the item that has been removed.

This six-part series tells the ACD story of exploration, innovation, and learning

approaches to align data analytics microcredentials with undergraduate experiences;

WCET

gauge the value of the microcredentials they offer, a step I suspect many have not yet been brave enough to take. That calls for tracking how often learners claim their awarded microcredential and share it to a professional networking site like LinkedIn, and for collecting feedback on why they did or didn’t. Another suggestion from the primer: track the number of microcredential learners who go on to enroll in a degree program

Because the official images are intended to be learning tools for those new to Docker as well as the base images for advanced users to build their production releases, we review each proposed Dockerfile to ensure that it meets a minimum standard for quality and maintainability. While some of that standard is hard to define (due to subjectivity), as much as possible is defined here, while also adhering to the "Best Practices" where appropriate.

try to provide duplicate overlapping examples.

General processes and common best practices learned from other Web Content Management projects do not apply and are in many ways obstructions to move quickly and get the best out of Helix.

memory usage and (lack of) parallelism are concerns

typeof v === "number"

Requirements: Ruby and Bundler should be installed.

Appendix F: Questions Universities Can Ask Certification Bodies to Assess Quality of Certifications

“Public research universities are committed to improving the workforce outcomes of their students and to addressing the workforce needs of local economies. This approach can ensure students that their credentials will have value to the labor market, and it can ensure employers that graduates have the skills required to perform in the workplace.”

t be issued for unevaluated learning accomplishments, such as the mere completion of a series of tasks, attendance at events, or for learning that has not been assessed, as competency and learning accomplishment evaluation is very important.

The other commenters are right about the potential solutions. However, it is actually considered a best practice to move the object with the index signature to a nested property.Said differently: No property in the object with the index signature should depart from how the index signature is typed.

You particular circumstances may or may not warrant a way different from what lhunath (and other users) deem "best practices".

hen selecting by text it is best to use the byRole query as it helps enforce accessibility best practices.

When defining accessors in Ruby, there can be a tension between brevity (which we all love) and best practice.

a principle I use is: If you have an accessor, use the accessor rather than the raw variable or mechanism it's hiding. The raw variable is the implementation, the accessor is the interface. Should I ignore the interface because I'm internal to the instance? I wouldn't if it was an attr_accessor.

I have been wrapping instance variables in accessor methods whenever I can though.

Setting an instance variable by going through a setter is good practice, and using two access modifiers is the way to accomplish that for a read-only instance variable

BCP stands for Best Current Practice

As a general rule: You should quote everything (that may be quoted).

Also cross-compatibility with mail clients can be hairy, so you should see what the industry experts are doing.

You should always specify the height and the width of an image if only to help the browser lay the page out even before the image has been downloaded.

The quirky looking printf is necessary to correctly expand the script's arguments in $@ while protecting possibly quoted parts of the command (see example below).

For path names with newlines it is better to quote each pathname.

Your validation functions should also treat undefined and '' as the same. This is not too difficult since both undefined and '' are falsy in javascript. So a "required" validation rule would just be error = value ? undefined : 'Required'.

here is my set of best practices.I review libraries before adding them to my project. This involves skimming the code or reading it in its entirety if short, skimming the list of its dependencies, and making some quality judgements on liveliness, reliability, and maintainability in case I need to fix things myself. Note that length isn't a factor on its own, but may figure into some of these other estimates. I have on occasion pasted short modules directly into my code because I didn't think their recursive dependencies were justified.I then pin the library version and all of its dependencies with npm-shrinkwrap.Periodically, or when I need specific changes, I use npm-check to review updates. Here, I actually do look at all the changes since my pinned version, through a combination of change and commit logs. I make the call on whether the fixes and improvements outweigh the risk of updating; usually the changes are trivial and the answer is yes, so I update, shrinkwrap, skim the diff, done.I prefer not to pull in dependencies at deploy time, since I don't need the headache of github or npm being down when I need to deploy, and production machines may not have external internet access, let alone toolchains for compiling binary modules. Npm-pack followed by npm-install of the tarball is your friend here, and gets you pretty close to 100% reproducible deploys and rollbacks.This list intentionally has lots of judgement calls and few absolute rules. I don't follow all of them for all of my projects, but it is what I would consider a reasonable process for things that matter.

I totally understand that there may be a majority still considering this a bad practice and thus keeping it disabled by default in production seem ok. But there could at least be an option to enable it for people who want to, no?

always use real <label for="correct_input"> elements. Just that alone is a UX consideration all too many forms fail on

step :direct_debit

This connects the failure output to the previous task, which might create an infinity loop and waste your computing time - it is solely here for demonstrational purposes.

Yes, we could and should use Reform or Dry-validation here.

providing best practices for both HTML-rendering controllers and APIs.

Like all best practices, I think the way you will resolve a problem will depend of the application you are doing.

If you're creating an actual, informational web page, stick to frameless HTML, CSS and unobstrusive JavaScripts and keep in mind that the page should still be usable with scripting disabled.

if you want a copy of my consolidated project management Excel workbook, feel free to contact me. It's gratis. I'm all for extending best practices.

For the future, you should: Install LTS (Long-term support) versions as they have an 8-year life span (with Extended Security Maintenance) or 5 years without. The current LTS version is Ubuntu 18.04.1 LTS Bionic Beaver released on July 26, 2018 with an EOL in April 2023. OR Carefully watch the EOL of the interim / development releases and upgrade frequently.

When you use target="_blank" with Links, it is recommended to always set rel="noopener" or rel="noreferrer" when linking to third party content. rel="noopener" prevents the new page from being able to access the window.opener property and ensures it runs in a separate process. Without this, the target page can potentially redirect your page to a malicious URL. rel="noreferrer" has the same effect, but also prevents the Referer header from being sent to the new page. ⚠️ Removing the referrer header will affect analytics.

Guidelines do very little. Developer discipline is not a reliable method of encouraging best practices, they have to be enforced to be reliable.

Props and state can change, and components should handle those changes whenever they happen.

Even if a component is rendered just once, your design will improve if rendering twice doesn’t break it.

Teaching Tolerance offers some clear practices that can help establish connectedness:

Currently, the documentation of :global() is very poor, IMO styling best practices deserve a separate section in the docs.

With Svelte, components and files have a one-to-one relationship. Every file is a component, and files can't have more than one component. This is generally a "best practice" when using most component frameworks.

On April 24, the U.S. National Security Agency published an advisory document on the security of popular messaging and video conferencing platforms. The NSA document “provides a snapshot of best practices,” it says, “coordinated with the Department of Homeland Security.” The NSA goes on to say that it “provides simple, actionable, considerations for individual government users—allowing its workforce to operate remotely using personal devices when deemed to be in the best interests of the health and welfare of its workforce and the nation.” Again somewhat awkwardly, the NSA awarded top marks to WhatsApp, Wickr and Signal, the three platforms that are the strongest advocates of end-to-end message encryption. Just to emphasize the point, the first criteria against which NSA marked the various platforms was, you guessed it, end-to-end encryption.

These massive dumps of free passwords lower the cost of an attack dramatically. Password reuse or password guessing attacks are script kiddie stuff. Defending your organization against such threats is basic due diligence.

it reminds me of IT security best practices. Based on experience and the lessons we have learned in the history of IT security, we have come up with some basic rules that, when followed, go a long way to preventing serious problems later.

The fact is that it doesn’t matter if you can see the threat or not, and it doesn’t matter if the flaw ever leads to a vulnerability. You just always follow the core rules and everything else seems to fall into place.

One suggestion is to check user's passwords when they log in and you have the plain text password to hand. That way you can also take them through a reset password flow as they log in if their password has been pwned.

In 2017 NIST (National Institute of Standards and Technology) as part of their digital identity guidelines recommended that user passwords are checked against existing public breaches of data. The idea is that if a password has appeared in a data breach before then it is deemed compromised and should not be used. Of course, the recommendations include the use of two factor authentication to protect user accounts too.

When processing requests to establish and change memorized secrets, verifiers SHALL compare the prospective secrets against a list that contains values known to be commonly-used, expected, or compromised.

NIST isn't mincing words here, in fact they're quite clearly saying that you shouldn't be allowing people to use a password that's been breached before, among other types of passwords they shouldn't be using.

Do Browse like a user wouldTake natural pauses that users would take to consume page contentFocus on the most common use cases, rather than all the possible use casesTake note of pages where forms/logins occur, you will likely need to complete some scripting there

It's a good practice to create respond_to_missing? if you are overriding method_missing. That way, the class will tell you the method you are calling exists, even though it's not explicitly declared.

Yes, absolutely, no two projects are alike. This step is moving towards a direction where we have a set of best practices for webpack isolated in a bundled package and can be maintained in isolation without impacting upgrades or end-user experience. If you have seen next.js or create-react-app they sort of do they same thing for ease and maintainability. Rails is a great example for this - there are some built-in best practices, opinionated defaults and gems that are hidden behind the scene plus power to do advance things where needed.

Two commonly used change strategies are clearly not effective: developing and testing “best practice” curricular materials and then making these materials available to other faculty and “top‐down” policy‐making meant to influence instructional practices.

(It's usually a mistake to pass back the concrete type of an error rather than error, for reasons discussed in the Go FAQ, but it's the right thing to do here because ServeHTTP is the only place that sees the value and uses its contents.)

Component classes should be lean. They don't fetch data from the server, validate user input, or log directly to the console. They delegate such tasks to services.

For example, imagine you are annotating the second page of a New York Times article. You probably want to see your annotation when you are looking at the article later as a single page, right? Or perhaps you've annotated the HTML for a PLOS ONE article. Wouldn't you like to see those annotations when you are looking at the PDF version of the same article? If annotations were only associated with the URL you happened to be looking at in your browser then the scenarios above would not work, because the documents being annotated all have different URLs.