Slashdot Mirror

Are we sure passwords are stupid? They're certainly annoying when compared to using certificates or biometrics or whatever. Isn't the problem here more that passwords that are hard to crack are also hard to remember and also that password reuse is bad (m'kay).

I read an excellent article by Dennis Forbes recently who suggested a browser-based mechanism to deal with this. Basically, never send your password to the recipient (whether it's Gawker or your bank). When you type into a HTML password field, hash the password you type in with your username and the domain of the site as a salt and then submit that. That way no-one (including the site owner) has any chance to store or intercept your plaintext password.

Now if you use the same username everywhere, you might want to avoid "12345" as a password, but a single complex password could be used for all your sites without worry. It would be a different hash sent to (and stored by) each site, it would be immune to rainbow table attacks and if you use a good password it would also be secure against brute force attacks.

http://blog.yafla.com/input_typepassword_Needs_To_Grow_Up/

If browser developers were smart, they'd let you generate or enter a complex UID (generate it on your PC browser and then provide it to your iPhone, laptop, work PC and so on...) and salt with that as well. That way your passwords would work across multiple machines (if you used the same browser password) but it would add huge additional complexity to a brute-forcing attempt because now they need the domain (easy), your username (easy), your site password (hard) and your browser password (hard). So an attacker couldn't login to your accounts even if they beat your password out of you unless they were using one of your devices. Conversely, if they stole one of your devices, they'd still need to crack your site password.

I wouldn't have mentioned it if it wasn't pure shit that. 1.5 seconds for a query that should be 3-4 disk blocks at max?

• digg's blog with their schema
• criticism
• more criticism
• and some more criticism

I wouldn't have mentioned it if it wasn't pure shit that. 1.5 seconds for a query that should be 3-4 disk blocks at max?

• digg's blog with their schema
• criticism
• more criticism
• and some more criticism

It should probably be called NoMysql instead of NoSQL...

Here are some good posts. Seems NoSQL is just the new xml. Sure, great for some things, but not really worth the hype...

http://www.yafla.com/dforbes/Responding_to_Joe_Stump_on_the_NoSQL_Debate/
http://www.yafla.com/dforbes/Getting_Real_about_NoSQL_and_the_SQL_Isnt_Scalable_Lie/
http://www.yafla.com/dforbes/Getting_Real_about_NoSQL_and_the_SQL_Performance_Lie/

It should probably be called NoMysql instead of NoSQL...

Here are some good posts. Seems NoSQL is just the new xml. Sure, great for some things, but not really worth the hype...

http://www.yafla.com/dforbes/Responding_to_Joe_Stump_on_the_NoSQL_Debate/
http://www.yafla.com/dforbes/Getting_Real_about_NoSQL_and_the_SQL_Isnt_Scalable_Lie/
http://www.yafla.com/dforbes/Getting_Real_about_NoSQL_and_the_SQL_Performance_Lie/

It should probably be called NoMysql instead of NoSQL...

Here are some good posts. Seems NoSQL is just the new xml. Sure, great for some things, but not really worth the hype...

http://www.yafla.com/dforbes/Responding_to_Joe_Stump_on_the_NoSQL_Debate/
http://www.yafla.com/dforbes/Getting_Real_about_NoSQL_and_the_SQL_Isnt_Scalable_Lie/
http://www.yafla.com/dforbes/Getting_Real_about_NoSQL_and_the_SQL_Performance_Lie/

As several MySQL experts already noted, Digg isn't even using the indexes that provide maximum performance in the query that they present as problematic for MySQL:
http://mysqlha.blogspot.com/2010/03/index-only.html
http://www.yafla.com/dforbes/Getting_Real_about_NoSQL_and_the_SQL_Performance_Lie/

So you are right about the NoSQL fashion trend. Looks like for some companies it's easier to throw a pile of cheap commodity hardware driven by some NoSQL BigTable-wannabie at the problem instead of carefully optimizing queries and indexes for the best performance.

Wait, Microsoft + Accenture built a piss-poor platform. As you may recall, Accenture is a giant in the consulting business. Their combined efforts failed miserably.

Accenture and the other big consulting companies have a horrendous track record for building failed projects at a very high cost. The moment someone says "let's hire Accenture to build this" is the moment the costs go up dramatically.

MilleniumIT has a proven product in deployment in several exchanges. Their product is not pie-in-the-sky. It works. They've had several big wins in the past decade. They've been collaborating with Intel on optimizing their platform. Their transaction processing times are an order of magnitude better than LSE's current system.

LSE isn't going to run setup.exe (sorry ./setup.so), they're going to have to do some large-scale integration work and customization to make it work with their system, and the "pie in the sky" element is that one of the reasons they decided to acquire this company is because now they have stars in their eyes about the great things they are going to do.

And as far as the trading time, again: Wait until its integrated. Lets revisit this in 6 months.

So, I'm not sure what your angle is... are you trolling? Astroturfing? Or just spouting knee-jerk reactionism without any kind of basis in reality?

Gosh, you got it all covered there. I guess you provided a savage indictment of my post. Or maybe I'm actually a realist, and see a lot of people doing a hilarious happy dance far too prematurely. That's what she said!

While we're giving subjective impressions, I'll go against the grain and say that I think the Wii is grossly overrated.

Many of the games are a mile wide but one inch deep, and most seem more like technology demos than actually games. The Wiimote is interesting and is a good start, but there's a general feeling that it is more accurate and capable than it really is (if you're really trying to do special twists and flares in Wii Bowling, you're significantly over-estimating the device's capabilities). Mariocart is interesting, but only really comes into its own in multiplayer, but there you find that the 480 lines of resolution of the Wii is grossly ill equipped to handle two onscreen players at once.

And for buying a terribly dated bit of hardware, you're still paying a price comparable to or exceeding some of the vastly more capable competitors, which just can't be excused.

Wiis everywhere sit doing nothing, while their owners try to justify it by remembering that hour of fun they had on the first day playing Wii Sports, before putting it away until the next big thing. Now they just need to find somewhere to store that wii Fit board.

Indeed, the page in question actually validates as XHTML Transitional which is something that is remarkably rare and shows a concern for craftsmanship.

I noticed that, too. The CSS however does not validate. Still I take your point. APS.NET is not the tool I would use, but they have done well with the tool of their choice.

for the author to show his superiority to the Internet. None of what he cites really matters.

True enough. Indeed, the page in question actually validates as XHTML Transitional which is something that is remarkably rare and shows a concern for craftsmanship.

Like most PHP sites, the aspx extension is a dead giveaway :-) ASP.NET MVC is url based, just like a good mod_perl app or a rails app.

Many, many ASP.NET sites use URL rewriting. http://www.yafla.com/dforbes/The_Best_And_Worst_of_2008/ goes to an aspx page. http://www.yafla.com/dforbes/Could_Microsoft_be_the_Patron_Saint_of_Firefox/ goes to the same aspx page, albeit with different parameters.

ASP.NET MVC brings a nice model, but it certainly wasn't first to rest-ful URL rewriting.

Like most PHP sites, the aspx extension is a dead giveaway :-) ASP.NET MVC is url based, just like a good mod_perl app or a rails app.

Many, many ASP.NET sites use URL rewriting. http://www.yafla.com/dforbes/The_Best_And_Worst_of_2008/ goes to an aspx page. http://www.yafla.com/dforbes/Could_Microsoft_be_the_Patron_Saint_of_Firefox/ goes to the same aspx page, albeit with different parameters.

ASP.NET MVC brings a nice model, but it certainly wasn't first to rest-ful URL rewriting.

Still pre-beta, but I don't think that optical media will be the hard or the interesting part of HD video delivery much longer.

Agreed with you (just blogged about this today), however like the other poster I have to ask -- is that supposed to be HD? It almost looks like sub-YouTube. Is it scaling back the quality based upon demand?

Sunspider is the standard JS benchmark and it's much broader in scope.

SunSpider isn't a panacea, and it's a bit of a distraction that it's the standard JS benchmark. To whore a bit, I wrote about it here.

This bit of ignorance makes me worry about the whole piece.

You should worry. The whole piece is absolutely ignorant, and is redundant given that it's presenting absolutely nothing that wasn't widely disseminated when Chrome first came out.

Chrome is irrelevant. The irrelevance with Chrome improving JavaScript speed is that it is a single platform, fringe browser -- on the app side no one is now going to do something that much more impressive (wholesale or as an optional feature) given that Chrome does javascript faster. We won't see that until the A-List browsers all improve their speed. To a lesser degree we might see it a bit more once Firefox 3.1 comes out, given that it's actually multi-platform and has enough use that it's worthwhile making a more-functional version that takes advantage of that performance.

True, true. But just be careful that XP isn't silently defaulting to S1.

I'm sure some of the people using Internet Explorer jumped on the FF bandwagon.

It has been several years since there was a justifiable, logical reason to stick with Internet Explorer (this isn't flamebait, oh holy Microsoft defenders, but the truth is that Microsoft just stopped caring about the browser market, and innovation dried up. IE 7 was a groaner, and IE 8 thus far is shaping up to be more of the same), so aside from pushing Firefox into people's awareness via gimmicks like this Guinness Record, it isn't like they just need to add that one last feature for it to be compelling.

If people are still using Internet Explorer, it can only be explained as ignorance or complacency.

While I hate to go there, at this point I think we need to see some apps that require Firefox (which isn't so onerous. Unlike demanding Internet Explorer, which intrinsically also demands Windows, usually at a contemporary version, Firefox runs on just about everything, and installing it doesn't change or screw with a properly running system). Offline app support, the canvas element, alongside numerous other web app bits and pieces, it really is the platform that Marc Andreesson was promising a decade+ prematurely.

Every time you click a button that triggers a server-side transaction, the page needs to explicitly transmit info - a cookie, GET/POST variables, something - back to the server to "remind" it of its current state.

During the week following Warner's announcement -- a period in which the HD-DVD group went into hiding while they regrouped -- FUD went absolutely rampant. Eclipsing the damage of Warner's announcement were rumors from so-called insiders that Paramount and Universal were also jumping ship, along with the standard claims that the adult industry was going blu. If you do a news search on HD-DVD right now you'll continue to find the same FUD, blown into a life of its own by blogger referencing blogger referencing blogger, repeating the same disproven claim.

In this vacuum of information, there's no surprise that HD-DVD sales collapsed, and it isn't because of the loss of Warner's catalog.

Since then the outcome is much less certain, however. Toshiba hasn't just conceded (and they shouldn't -- just prior to Warner's announcement it was 50/50), but instead they've come out swinging, dropping the price of their units by half (obviously it has to be cheap to compete with a format that largely was acquired for "free" as an added value of a game system). This price puts a very capable HD-DVD player with ethernet, HDMI, optical audio, and so on, as cost competitive with a decent upscaling DVD player -- and the Toshiba unit is a very good upscaling player. Add the 7 or more free HD-DVD movies that'll work forever even if HD-DVD dies, and a catalog of 1000 or so HD-DVD movies already on the market, it's a hell of a deal. If someone could hack this baby to be a media head unit it would absolutely own.

Reports are that sales have been absolutely massive, and Toshiba's campaign has been a success. Warner since has extended their HD-DVD support by almost a month, and other very positive rumors have circulated about HD-DVD.

Don't write HD-DVD off quite yet.

As an aside, one thing that really pisses me off about this war are claims that the end of the format war would be good for consumers. This is as logical as saying that Windows and IE should be universal -- good for consumers. Worse, Blu-ray has so many consumer-unfriendly facets (cost, no combo discs, a standard that's still in flux, early adopters getting screwed, the nebulous DRM of BD+) that it winning can never be perceived as a consumer win. Yeah, I'm biased because I didn't choose a format to win based upon a game unit I happened to buy.

I suspect they know the format was doomed and didn't want any of their IP to get dragged down with it.

but if Microsoft had known that they'd be enabling a general-purpose platform for application delivery -- one that doesn't require Win32, or even a full desktop computer at all -- they'd have found another way or not done it at all

I wrote about the power consumption of S1 versus S3 sleep, and as you mentioned dumppo.exe was the enabling-tool that let me take advantage of this great bit of functionality.

The biggest downside of S3 sleep is that about 1 out of every 200 recovers or thereabouts it completely fails to come back, thought that's probably a mainboard issue more than an OS or technology issue.

Oh, and a great little helper app if you use S3 is WakeUpOnStandBy. It allows you to configure a machine to "come alive" at scheduled times, even from an S3 sleep (apparently the BIOS supports configured wake-up times, and this app knows to tell it to wake up accordingly just as going to sleep). Very helpful little app -- I have my PC set to come alive in the morning when I know I'll be remoting in.

Oh, and rather than waking up on all network traffic, as the article recommends, it's far better to wake up on WakeOnLan packets. There are lots of resources out there for that.

Come on, 4% market share and you are surprised when a computer does not run OSX?
The last number I saw was that Macs now counted for 6% of new PC sales. 6% is huge from a historical perspective, especially given the bulk of new PC purchases are businesses that usually lag the trend.

And I think his point was just that among innovators and edge pushers, Windows is rare -- would anyone really argue with that? While I don't think OS X owns that arena (Linux obviously being another major choice), I don't think you're going to find many installs of Vista.

While I disagree with some of Paul's points, ultimately I think he is absolutely right -- Microsoft's initiatives over the past couple of years have almost entirely been duds. No one really cares what Microsoft is doing, except when they know that it's going to be forced on them (Vista), which is remarkably different than how it has historically been. What do you know -- I just wrote about this.

The world is getting to be a much better place when Microsoft is freed to compete on actual merit, and not just one division hobbling another based upon the belief that they were their only real competition.

XP/Windows 2003 supports S3 as well, it just often misidentifies whether the PC is S3 capable, however you can override that.

Cars and trucks account for less than 1/4 of CO2 emissions, or "slightly" less than "greatly to blame".

While Hummers and pickup trucks a convenient easy target, electric power generation is by far the #1 culprit (especially coal burning, however even nuclear power plants have a tremendous carbon cost). And while transportation is getting much better, electricity consumption has only been getting worse.

computations will be done with water [mit.edu], not electricity

The very cool thing about CTEs in SQL 2005 is you CAN reference the query name inside the query that defines the subquery. It references itself; it automatically recurses when it is executed.

Like this: (shamelessly ripped from http://www.yafla.com/papers/sqlhierarchies/sqlhier archies.htm)

WITH CTE_Example (EmployeeID, FullName, BossID, Depth)
AS
(
        SELECT EmployeeID, FullName, BossID, 0 AS Depth
        FROM Employees WHERE EmployeeID = @boss_id
        UNION ALL
        SELECT Employees.EmployeeID, Employees.FullName, Employees.BossID, CTE_Example.Depth + 1 AS Depth FROM Employees
        JOIN CTE_Example ON Employees.BossID = CTE_Example.EmployeeID
)

SELECT * FROM CTE_Example

I'm not going to argue that for the majority of /. readers this article offers absolutely nothing they don't already know. But the fact is, once you leave the cozy confines of the IT world, your average business-person doesn't have a clue what a Wiki is or why anyone would use one.

The issue the other person seems to have isn't that this article exists, but rather that it was posted here (which you agreed to in the next paragraph). This is quite simply a bizarre article for Slashdot -- it's superficial, there are a million Wiki guides that are more comprehensive and more readable, and it's preaching to the choir.

BTW: Here's my wiki guide for setting up MediaWiki on Windows. At least it has some uniqueness and value to someone.

You know... if Microsoft integrated a spell checker that shows squiggly lines in Internet Explorer, the main reason I've seen for wanting to use word to blog goes away.

Right on the money. The archaic limitations of the basic controls is bizarre. Hack jobs using DHTML and server side spell checking are usually ugly, unintuitive, and inefficient.

http://www.yafla.com/dennisforbes/Spelling-Matters /Spelling-Matters.html - great article on the whole topic, that covers integrated spell checkers. Would be a great improvement in browsers.

http://www.yafla.com/dforbes/categories/personal/2 006/01/18.html

Includes scans of some 80s magazines, including Compute! (which, along with "Family Computing" was the predominate "type-in" magazine).

I should correct what I said a bit: BitLocker does work without the supporting hardware -- the disk manager asks for a key on startup, and uses it for software encryption of whole volumes. Again it's abstracted from the filesystem.

Here's some pertinent info.

How secure is your data?

http://www.yafla.com/dennisforbes/Why-Internet-Exp lorer-7-Shouldn-t-Matter/Why-Internet-Explorer-7-S houldn-t-Matter.html

Right on the money.

I may be wrong here, but I the thing that makes this asyncronous is the XMLHttpRequest object, which needs to have the returning data be well-formed XML.

You are right that the object used is XMLHttpRequest. It does not, however, require grabbed data to be in XML format, and it's actually a quirk of development that HTTP get functionality even exists within its namespace.

The reality is that the majority of so-called AJAX implementations don't use XML in any way, apart from the irrelevant naming of the object that does the GET.

But it has TAGS! They're like meta keywords but they're totally Web 2.0ified with scriptaculity!

So true.

Speaking of tags, is it just me, or are tags on Slashdot stories just a complete indictment of the whole idea? They're like a craptacular subset of the actual story (the words in tags almost always exist in the story), harkening back to the days when we weren't capable of properly searching data, so we had to rely upon terrible tags.

Right.... perhaps you missed this? http://www.yafla.com/dforbes/2006/03/29.html

Or do you think recent dot coms have devolved to misspelling names (digg, Flickr, Syndic8) because they're cute?

Or perhaps you've never visited a site like Sedo? http://www.sedo.com/main.php3?language=us&partneri d=14030

Go there and type in a word like energy (2374 matching domains) or success (1364 matching domains). Hey! You can get energyaustralia.com for just $10,000.

... why the existing domain registration process doesn't work.
Although it seems just as likely that European companies would scam the system as American ones.

Sooner or later some kind of crisis will happen that will bring about changes to the way that domain names are handled. As noted, three and four letter TLD names are already completely gone, with any reasonable new domain name likely already registered to a legitimate user, or to one of those idiot companies that "hold" names waiting for the highest bidder.

Changes are coming folks.

Why do I have to tell this to /. readers?

Most /. readers already know this. In fact it's pretty humorous that the submitter mentions MySpace, given that MySpace is very much Web 1.0.

More and more people are using the internet for more and more things. Woot. More like Web 1.1 than Web 2.0. The term rightly gets derision because it deserves it: the continual growth and continual technology evolution is suddenly noticed by some that are unaware, and they decree that they've witnessed a revolution rather than an evolution.

Any application that is developed that does not leverage the Registry properly i.e.utilize all user specific settings in HKEY_Current_User and Machine specific in HKEY_Local_Machine would not pass.

And all of those apps that foolishly stuck to the Windows developer guidelines, even where it went against common sense, are finding their methodology to be deprecated. The programmatic, non-system use of the registry was one of the worst mistakes of the Windows platform.

This might just provide laptops with enough power to run Aero Glass. That is presuming that battery life and testicle health don't matter.

This is great, though. With the new Core Duo laptops and killer mobile chipsets, I'm finally seriously consider getting a laptop and dumping the desktop (more like deskunder, but whatever) all together.

This is one of the few cases where "security through obscurity" kinda works...the security of Google's page rankings depends on the secrecy of the algorithm itself. They have no obligation to reveal their algorithm to Kinderstart or anyone else.

Google's PageRank is no more protected by security through obscurity than anything else -- The exact same problem applies: While it superficially stops the casual exploiter from gaming the system, it's hardly rocket science to setup cases of various scenarios and derive exactly what they're doing behind the scenes (which is exactly what SEOs do). Furthermore you can be sure that there are current and former Google employees/interns that have sold the big secret. Something like that is impossible to keep secret.

For all we know Google could add a 50% bonus to sites that host AdSense ads.

This proves that you don't understand what ActiveX really is. Flash in IE? ActiveX. Java in IE? ActiveX. ActiveX is nothing more than IE's plug-in system, so to say that it's "close to non-existent" on the public Internet is completely fallacious.

ActiveX isn't "IE's plug-in system", it's used as IE's plug-in system. There's a huge difference.

Whether IE uses ActiveX, .NET, or VBScript to implement platform specific object handlers is irrelevant -- it is a platform implementation detail, and the same instantiation code works across platforms.

What I was obviously talking about is ActiveX specific or only functionality, which is non-existant. To use your own examples - Flash, Java, and so on all happily instantiate on Firefox on Linux as well.

I was being sarcastic.

Because Fuji ISO-100 35mm film yields negatives of the same informational quality regardless of camera.

Image optics vary dramatically between amateur and professional lenses, not to mention that without bright (expensive) lenses one often needed to use faster film, accepting the compromise of visible grain. Alternately they could accept motion blue (which was more prevalent), or they had to accept the terrible compromise that is flash photography.

If you spent the money in the 35mm space, there were a lot of things you could do to vastly improve the quality of your work. Even simply buying better film, and then getting better (more expensive) processing hugely altered the quality.

With digital cameras, however, no matter how much work the amateur is willing to do, he cannot make a 3 megapixel camera take 10 megapixel pictures. Other things being equal, a 10 megapixel picture is simply superior to a 3 megapixel picture.

Take a look through Flickr's interesting picture catalog, paying attention to the camera used to take the pictures. More often than not it's an almost disposable low-end camera, not an ultra-expensive pro camera. It really is eye opening that the equipment isn't as important as some people imagine it to be.

I found your linked article in need of more depth; should we believe that spelling matters simpley to whore page-rank?

I found your linked article in need of more depth; should we believe that spelling matters simpley to whore page-rank?

Now let us talk about one of my secondary concerns: spelling and grammar. Let me be clear. As you are probably well aware, I don't think these are as important as the things I mentioned above. I want a Slashdot story to be focused, directing your attention to the URL in question. It needs to be not to long, not to short. Links should be clear. Spelling and Grammar are secondary issues.

Slashdot posts, what, maybe two dozen "stories" a day? To support this Slashdot has a crew of paid, therefore professional, "editors". Is it really that much to ask that rudimentary spelling and grammar rules are obeyed?

This story is completely bullshit, and it's amazing that anyone falls for it.

http://www.yafla.com/dforbes/2005/12/23.html#a225

Interestingly this entry was inspired by the DVR/commercials story earlier, but it also applies as to how people end up with PHP and MySQL as the backbone of their infrastructure.

Thankfully the Flash fad died down in general, though many sites still make use of it when they want rich content. It certainly hasn't disappeared.

I talked about a bit of industry gossip that I heard from who I consider a trustworthy, connected source. If true, that sort of leadership by a respected, open company could definitely lead things in a direction very quickly. Just look at how quickly the web community fell over themselves to implement AJAX (a 7 year old technology) once they saw Microsoft do it.