LammyL

To be fair, most of those deprecated technologies are 10 to 20 years old and use paradigms that wouldn't cut it with how we build software today.

Is the search interest attributed to people wanting to see how low rap genius is ranked now on google, or people who actually want to visit the rap genius site? I suspect it is the former.

It seems like the media is trying to turn this into a bigger problem by quoting the 9100 foot minimum runway length for maximum takeoff weight and a 6100 foot runway.

We can't tell if this is a real problem or not because we don't know if it has any cargo on board. The plane only needs to fly a few miles to the Air Force base, so draining the fuel tanks may be all that is required to lower the minimum takeoff distance to below the runway length at this airport.

I would think geolocation would only get better as more people go mobile and their IP address (wifi or 3G) gets pinned to gps coordinates using location aware apps.

Think about how much info google, apple, and others can collect with this, and build a database to sell.

It is nice and all that Microsoft is pushing TLS 1.2 and AES-GCM, but they still don't have support in schannel (used by IIS and IE??) for ECDHE_RSA_AES_GCM cipher suites.

States are already half way there at eliminating the electoral college with the National Popular Vote Interstate Compact.

Why would xamarin want to sell? What advantage would it bring them?

Does anyone know why most of these apps are released in only some countries? What is holding back developers from just releasing globally?

Only the long-form census is voluntary. The short-form census is still mandatory, and not completing it could land you in court, like what happened here.

I don't know why people are getting so upset about this.

Canada has had a very similar law for decades and it only really gets used when people want to legally duplicate architectural drawings and land surveys where the original person who drew it is out of business or dead.

I hardly see this as opening the flood gates to mass legal copying of photos from the Internet. People who are going to copy and repost photos without regard for copyright are already doing it today. This law won't change that, and I doubt they will go though the hassle of following these proposed rules.

Ageism aside, the nice thing about "under X years" lists is that it keeps it fresh so that we don't end up with the same repetitive churn of names that we have all seen a million times.

I didn't recognize any names on this list, which was refreshingly nice.

Does anyone know if the crowd sourcing of suspects on 4chan the other day picked out the same suspects the FBI announced today?

Why not just turn on the emoji keyboard and use unicode symbols instead of regular characters the standard keyboard.

An emoji password like happyface heart pizza devil hospital trafficlight cow moon is probably going to be more secure than any word/number combination that could be dictionary attacked.

This obviously assumes the site properly encodes Unicode, but also somewhat limits use for most people to devices with the keyboard.

It says they are only doing 1000 (or 2000) hash iterations to derive the key, and it seems like it is too few iterations to be much of a brute force deterrent these days. I would have expected something like 100000 iterations, or 1 second or more of calculation time on a modern CPU.

Isn't the normal attitude with contracts like this is do as little work as possible to satisfy the requirements checklist and get paid as soon as possible? And then charge even more to come back and fix it later when it doesn't work as originally envisioned?

Hashing the access token with bcrypt isn't really a good idea. Bcrypt is designed to be slow, and hashing the submitted token on EVERY request would really affect performance. Bcrypt is great for password hashing which only happens once per session. You are probably better off securing access tokens using a fast hash (sha) and compensating for security with a long and random access token.

The idea of hashing the server side token is still a good idea, just incase the db of valid tokens is ever stolen, they would be useless. But I don't really see the need of hashing the server side token+the encrypted password, since, as you said, just invalidate all tokens on password reset.