EnFinlay

I am personally grateful for every blog which does not go out of it's way to follow "standard typographic rules" because so many of them end up looking identical.

I want status pages to show traffic to the status page itself over the last 24 hours (or some time period). A sudden uptick in traffic but green across the board would indicate that there is an issue, but they just haven't updated the page yet.

I don't think the civil comment was directed at you specifically

"Come on we need 23 reasons because of 23 chromosomes! I don't care how stupid the list is, just hit that number"

I am very surprised by the reaction you're getting.

I relate strongly with this.

Someone made a comic that partially captures how it feels: http://www.poorlydrawnlines.com/comic/do-it-turtle/

No, but pre-requisites to bank accounts do, like permanent addresses.

On one hand I agree with you, on the other hand I don't think the space is short on people writing their own tools. The number of DNS enumerators I've seen shared over the past month alone speaks to this.

> Old rules don't apply at all

How did that happen?

Nice write-up!

I think "Software Engineers" can't tell the difference.

Professional engineers do engineering.

Title only engineers work on complex systems.

This distinction has largely been lost and most "Software Engineers" think they are doing PE Engineering when they are not.

I would say that this needs to change on a broader scale within the software development community than just with Facebook.

I couldn't agree more.

Interesting analogy and I see your point. If a car manufacturer's process made it easy to install the brakes wrong they would be held responsible (probably with a recall or damages for lives lost due to faulty brakes).

I guess part of this is that passwords aren't considered that important to many people :(

Also true.

It might be depressing, but I think it's true. What do you think?

You're right, the impact is just as bad. I think people in this thread (including myself) are downplaying it because it's a very easy mistake to make, rather than a terrible design decision.

I disagree that they are both terrible security designs. We expect every company to not use plaintext for auth. We do not expect every company to have infra/ops setup to prevent logging on login requests.

Having (read) access to the hash shouldn't give any access to the account.

Edit: You've made this comment twice in these threads. It's wrong.

Because some developer typed:

> log.info(req.body)

and no one realized that login data would get captured?

Get real.

It's an issue for the same reason storing passwords in plaintext in the database is an issue. Reading the hash != access to the account. Passwords should be private to everyone except the account owner. If devs have access to all user passwords then you have a fucking issue.

It's just such an easy mistake to make. Some new ops guys logs all the traffic through a subsystem and boom - plaintext passwords.

Because there's two types of storing passwords in plain text. There's the "your password is stored in plaintext in the database" way which everyone agrees is 10 different kinds of stupid, and then there's the "we accidentally logged the body of all requests that went through this system, and it turns out login requests came through here" kind. One is a bad security decision (because you must decide how to store passwords in the DB), and the other is a very easy mistake to make which can go unnoticed for a long time (because you can be attempting to log things completely unrelated to logins).

Same same but different.

No one is saying that it would be better if everyone was dirt poor. The main criticism of wealth inequality (as I understand it being a developer and not an economist) is that with the systems currently in place in America (and other nations) rich people are given outsized ability to become wealthier without transferring any of the wealth to other people.

Wealth inequality is bad because it leads to worse wealth inequality. Essentially everyone above a certain line gets richer, and everyone below a certain line gets poorer. This is bad for everyone except the rich. Most of us are on the "poor" side of this line. If something benefits a few at the expense of the many, most moral frameworks would call it bad.

Again. Not an economist. Not an ethicist. Just some dude.

Edit: Typo

Being reincarnated in a cat isn't always great. https://imgur.com/rHm8Nwv

Business/self-improvement books are the worst for having 3 pages of ideas and expanding it to the publishers 200 pages minimum.

I am on HN more, but it hasn't replaced Reddit. HN doesn't move fast enough for hours of dopamine hits like Reddit is. HN is for when I'm at work and I need to give my brain a rest from a tough problem. My time at home no longer has any social media when it used to have WAY too much Reddit.

I pruned my comments about a year prior, so anything useful should still be there.

Likewise, been off for over a month (yay New Years) and my productivity has been significantly increased.

And I agree about HN, it's similar in system, but the content is very different. I'll look at the front page and maybe read 2 articles and their comments in full, and actually feel like I've learned something or it wasn't a complete waste of my time.

Gotta cut those dopamine drips. So many companies make their money figuring out how to hook you.