marcinw

Tipfy looks to be as well:

http://code.google.com/p/tipfy/source/browse/tipfyext/wtform...

That's great until the person you're selling to immediately jumps on that. At this point, you are left wondering, "Gee, was my offer that good? Was it too low? I wonder what he was expecting to pay. Damn, I could have made 20% more had he made the first offer." Same goes the other way around. The trick is to have both people negotiating to leave feeling as if they won. In your case, you will leave feeling as if you lost.

Many would also argue that the majority of people that hang out here are not "hackers" but instead "developers that (mostly) know how to get shit done."

In their eyes, hacking is exploiting a weakness in a system to do something the system was not originally intended or designed to do.

But in the end, nobody cares.

Unfortunately, for a lot of us working in locked down environments, this code makes use of the py-bcrypt module which uses the bcrypt C implementation. If you're running on GAE, you're out of luck. I keep telling myself to port to pure Python, but haven't had time. Anyone interested?

Sorry for the confusion, I meant "non-idempotent". I had two separate thoughts in my head at once and munged the two, leaving out the "non-".

Being a software developer and being an exploit developer are two entirely different things. Professional exploit developers DO NOT ship unless it's perfect. Malware authors will ship even if it's not perfect, because the target is not technically advanced and can get away with it. If you're targeting a nation-state, you best not compromise your intent, how you broke in, nor how long you've been there for.

In addition to tzs' comment above, POST parameters do not get logged by the web server either (default Apache logging, etc), unless you're using a module like mod_security to log POST data.

Besides, don't use GET for non-idempotent requests (those which change state). That's just webapp development 101.

Edited for clarity.

We did this on VCR tapes too. Little electrical tap over the broken tab, and bam -- you've got re-writable media!

It was funny, but not that funny...

"Perhaps it's worth noting that my kids generally prefer prepackaged foods over our cooking. So maybe it's a cyclical thing, in some subset of each generation. But I'm hoping that teaching them to cook will change that."

Trust me, as they each grow older, they will appreciate your cooking more and more. I myself was a hamburgers, hotdogs, chicken nuggets and macaroni and cheese kid growing up, but going home to my parents to eat Mom's cooking is priceless now.

We have several positions available in New York City AND London. If you have an interest in breaking stuff, can code in C, Java, C#, Python, or whatever, come talk to us! Send me an email at <my yc username> @ gdssecurity.com

http://www.gdssecurity.com/g/ca.php

Cute, but damn onmouseover on the iPad.... :(

There's a saying that goes, "Abs are made in the kitchen, NOT the gym." I can't stress enough how much portion control (eating less) plays an important in your dieting. Don't believe me? Look at the serving size on the nutrition facts label of some food product you plan on eating, and then look at how many calories are in one serving. It's very easy to "double-up" on serving sizes (oh yah, it feels soo good) and then before you know it, what was supposed to be only 1500 calories just turned into 3000 calories for the day. Do this every day during every meal, and I can bet you sure as hell won't be losing any weight. At best, you'll be maintaining the weight if you're going to the gym regularly (3-5 times a week).

By the way... I see people all too often misunderstand "cheat days". On a cheat day, you don't get to pig out on junk food. You get to pig out on good, healthy food (i.e., double-up on serving sizes), or have just a serving of less-than healthy food (such as pizza, etc).

Right, and the people who are running malicious Tor exit nodes won't tell you that either. Good luck with that.

What about "..%2F..%2F" or "..\..\" or "..%5C..%5C"? In Java, you also need watch out for NULL (%00) in the path as well since java.io.File disregards anything after the null (most just test to see if filename ends with "ext" where ext is considered "safe", which is a huge error).

Don't ever allow the client to specify a filename; use an indirect reference such as a uuid. If you must, always perform path normalization and/or only allow alphanumeric characters.

That's okay, leaves more to surprise :)

It's actually a very common practice for companies to do this. Just whois xcompanysucks.com

In a traditional for loop fashion:

  def known_edits2(word):
    L = []
    
    for e1 in edits1(word):
      for e2 in edits1(e1):
        if e2 in NWORDS:
          L.append(e2)
    
    return set(L)

Sorry for not explaining, maybe the following will convince you. When an application generates a password, about how long/secure are these passwords? (on average, and remember, we're staying user friendly...) Probably about 8-10 characters, alphanumeric, MAYBE a special character.

Now let's say you had to only create a link as I proposed. The length of the "secure" token can be as long as you want! Because the URL is not entered manually, you don't have to worry about being so "user-friendly" (as long as your url doesn't break in mail clients..)

If you fed a secure PRNG to an HMAC-SHA256/512 hash or a UUID... These values would be much, MUCH harder to guess than any password you could generate for your user. As a result, the following is not true:

> They could "guess" the reset key just as easy as they could "guess" the new generated password.

You bring up a good point about the password delivery over cleartext (though HN doesn't use SSL anyway, I didn't consider it at the time of posting). On a side note, does HN even have account lockout?

At any moment, you can have two valid passwords used to access your account. Do all the A/B testing you want, this is NOT how you handle password resets.*

* Note that even my proposed solution is not the best way to handle password resets. Trust me on this, I've seen way too many applications do this wrong which have resulted in ability to compromise arbitrary users' accounts.

This approach would introduce more complexity than it's worth, in addition to being less secure. Instead of just one password that can be used to login to your account, you now have two valid passwords.

A better way for Hacker News to handle password resets is to send the original email address associated with the account an email containing a one-time, expiring link allowing the user to change their password from. Otherwise, your password would remain unchanged.

  import bcrypt
  hashed = bcrypt.hashpw(password, bcrypt.gensalt(log_rounds=13))

Increasing log_rounds by one increases the work factor exponentially (2 * * log_rounds).

We're all wondering what he used to visualize his data set.

A bunch of "script kiddies" can make any website unavailable for some period of time.

edit: The only difference is in how fast you manage to recover.

Nice job editing your comment without saying so (" -- although not impossible --" and your last paragraph).

Anyway, your nginx/lighttpd server is more likely to be exploited and compromised via an actual vulnerability rather than your Apache server via a slowloris-style attack. It's akin to putting a wide receiver in front of your runningbacks...

Right, because nginx and lighttpd aren't easier to exploit. /sarcasm

I'd say disclosure of classified information presents a greater risk than distributing copyrighted materials. I really don't think "copyright" is the issue at all here.

When I was younger, I had aspirations of getting into the X-Games for freestyle bmx and dirt jumping. Those dreams ended when I broke my leg doing something very mundane.

I was grinding down a box with a decline which was about 3.5 feet off the ground. I had lost my balance, and instead of putting my right foot down on top of the box, I put my left foot down, 3.5 feet, onto the sloping decline. After recovering from my fall, I twisted my foot 180 degrees back into the "normal" position. Not thinking clearly at the time, I didn't even realize what had just happened. I got up, walked over to my bike and got back on, only to fall off within a few moments. At that moment, I felt my leg (which still was in my shin guard) and I felt it wobble/seasaw up and down in the middle. Right then, I knew something was wrong.

I broke my tibia, fibula and ankle all in one go. After surgery, I ended up with 2 pins in my ankle, a plate and 5 screws in my tibia and was on crutches for 4 months (these were removed a year after). To this day haven't ridden BMX, though I can ride mountain bikes and snowboard better than I had before. I cringe with agony anytime I see someone take a gnarly spill, remembering the pain I had once experienced.

You'd be hardpressed to find a vulnerability in IIS7 or SQL Server these days...