The Whiteboard

« first day (2091 days earlier) ← previous day next day → last day (2890 days later) »

12:06 AM

Programmers is still necessary. Here's why: Stack Overflow is overwhelmed with "fix my broken code" questions. There needs to be a bucket for questions that are not merely "fix my broken code," so that people have a place to go to ask such questions where they can live alongside similar questions. Yes, you can still ask them on Stack Overflow, but Programmers (ahem, "Software Engineering") should be the preferred port of call now. — Robert Harvey 1 min ago

Duga

12:50 AM

@joegrom5 there are multiple questions that this would be a duplicate of on Programmers: I recommend searching over there for some good info. — Snowman 56 secs ago

user114359

1:01 AM

@Ixrec I did my part to clean up job-definition

Quaxton Hale

2:17 AM

Hello

6 hours later…

Duga

8:14 AM

Maybe I am wrong, but I think this questions suits better in Programmers SE than in SO — Pablo just now

3 hours later…

Ixrec

10:53 AM

I have no idea why i was down voted .... I am truly offended — aviv yesterday

Why am I always being down voted ? - I am leaving this site. Instead of helping people enjoy down voting. — aviv 18 mins ago

some useful examples when discussing our new user experience on meta; both questions are objectively off-topic but OP has no idea why

1 hour later…

Duga

12:19 PM

@gnat Definitely I don't understand Programmers scope, event after reading your link. This question's quality is poor, but as it requests concept definition more than pure code (see the tags), I think it would fit there :S — Pablo just now

@Pablo You're both right. This question is on-topic at Programmers, but it's far too low quality to migrate there. If SO votes to migrate it'll just get closed and downvoted on two different sites. — Ixrec 51 secs ago

Duga

12:51 PM

I honestly don't know whether this could be on-topic for Stack Overflow, or not (as such I'm not voting up, down or 'to-close'); but the nature of the question asked leads me to suggest that Programmers might be a better fit. — David Thomas just now

@DavidThomas We usually close "list of languages" questions like this on Programmers. — Ixrec 51 secs ago

Duga

1:45 PM

I think this link will answer your question: programmers.stackexchange.com/questions/142065/… — Ulric 7 secs ago

Duga

2:00 PM

Good question, but perhaps better suited for Programmers.StackExchange (that site handles architecture questions, S/O is for specific code problems) — jdl134679 1 min ago

Thomas Owens

2:33 PM

Can anyone explain why you don't need to protect the salt used for a password? If a malicious user knows the salt and the hash algorithm, how is that any different than them knowing the hash algorithm for an unsalted password?

Ixrec

It's not.

But the salt is not about protecting any individual password

the sole purpose of the salt is to protect against attacks that go after all of the passwords at once

computing a "rainbow table" for just one hash makes it very fast to try breaking tons of passwords at the same time if they all use that same hash, but if they all use slightly different hash algorithms then that's no longer an optimization

Thomas Owens

Martin Fowler says that a salt should be unique per user and that it doesn't require any "special protection like encryption or obfuscation".

Ixrec

that is correct

the whole point of the salt is to effectively make it so every user gets a different password hashing algorithm

and as usual, your hash algorithm should not (need to) be a secret

Thomas Owens

So if I had a password store of salts and hashed passwords, I would be able to break each individual password in the same length of time, but I would need to rinse and repeat for every password rather than a bulk cracking of everything.

Ixrec

exactly

Thomas Owens

2:38 PM

Isn't there some advantage to also protecting the salts, though?

Ixrec

other than generic obfuscation, not that I'm aware of

Thomas Owens

For example, there's usually more than two things in the user entry: a user name, an email address, an ID, etc. If one of those is actually the salt, then the attacker needs to know more about the system. Yes, it's close to security by obscurity, but it will help slow down an attack over something that screams "hey! I'm the salt!"

Ixrec

that would be an example of a bad implementation =P

Thomas Owens

How so?

Ixrec

ideally you'd use guids for salts to guarantee no collisions and no predictable patterns

if you're using user input as your salts, you get a lot of the usual problems with bad password selection weakening the effectiveness of the salting

Thomas Owens

2:41 PM

A GUID also makes for a good unique key in a database.

At the cost of generation time and space.

I do see what you're saying about user inputs, though.

Ixrec

hence "ideally", often some other form of randomness is fine

but it should always be at least random even if unique is too expensive

Thomas Owens

I still think that something that screams "hey, I'm clearly the salt" is...not good.

ratchet freak

it can be random and unique if the salt is (sequential) ID + random.next()

Ixrec

isn't that how guids normally work?

ratchet freak

no guids are fully random and have enough bits to not collide in the lifetime of the universe

Thomas Owens

2:46 PM

> Assuming uniform probability for simplicity, the probability of one duplicate would be about 50% if every person on earth as of 2014 owned 600 million GUIDs.

TZHX

3:00 PM

sql server has "sequential guids", designed to reduce the amount of fragmentation when using them as an ordering factor in storing data to disk. guid is just a format; whether it's gerated randomly or not is up to the person writing the bits.

ratchet freak

I can't help but think that guids should not the storage sorting factor

that you create an index for it fine but don't keep it sorted by it

2 hours later…

Kit Z. Fox

5:31 PM

Why bother doing it the right way?

This is the lesson I learned today.

Steven Burnap

There is no right and wrong, there is only better and worse.

MetaFight

6:19 PM

Love me some Lippert:

To speed up your program you should (1) set meaningful goals, (2) test to see if you've met your goals, (3) if you haven't, use a profiling tool to find the slowest thing, and (4) optimize the slowest thing. — Eric Lippert Jun 8 '09 at 23:42

Kit Z. Fox

6:38 PM

@Ashley!

user15026

@KitZ.Fox Kit!

Kit Z. Fox

I was just going to go look for you.

user15026

I liked your latest video! It was delightfully tingly and creepy.

Kit Z. Fox

Oh, thanks!

I was going to ask you what you'd like me to do next.

user15026

Good question. :) I've been liking stuff you've done so far - the Lovecraft was almost too much creepy for me but I was also watching it at like midnight in my bed in the dark, so....

Kit Z. Fox

6:41 PM

Did you like the hand movements?

And the clinky drinking?

Do you like eating sounds, like eating toast?

Adam Zuckerman

@KitZ.Fox are you recording audio drama type stuff?

Kit Z. Fox

@AdamZuckerman No, ASMR videos.

Although I'm not sure the last one was particularly tingle-inducing. I read Pickman's Model.

Adam Zuckerman

Never heard of that before. Is the sensation produced by the sounds or the mind-body connection?

Kit Z. Fox

I don't know.

Sounds and vision both work for me.

user15026

@KitZ.Fox This I really liked. And the hands. Not a big fan of food sounds, personally, but like...other crunchy and crinkly sounds work well :)

Kit Z. Fox

6:48 PM

I was thinking that I could read Mercy Watson. It's a funny story, and she likes hot buttered toast.

So I could eat that.

user15026

oooh that would work well actually I think

user15026

because my brain likes when the things tie together, that makes for more happy tingle feels

Kit Z. Fox

OK. I'll give it a shot.

user15026

Yay!

gnat

8:20 PM

Q: Make Stack Exchange more friendly to first-timers

I come from lands afar, also known as Hardware Recommendations Stack Exchange. Over there, we have a serious problem with first-time Stack Exchange users coming along and asking off-topic questions - to the extent that 50% of incoming questions are closed. We've had a few attempts at solving this...

^^^ highly recommended reading. Look inside a mind of an inexperienced poster who dumps their off-topic stuff. Site that has to close 50% questions, but not Programmers. Oh, and there's even a funny bit about hot questions, "one of the most confusing features..."

user15026

I just saw that post. It does highlight some stuff I've noticed on Gaming etc. as well

Kit Z. Fox

8:41 PM

I think Stack Exchange should be less friendly to first-timers.

But not really though. That was a joke.

Or was it?

Duga

9:23 PM

Your question might get closed here as opinion based. It's probably more suited to another stackexchange site programmers.stackexchange.com — Tone 1 min ago

« first day (2091 days earlier) ← previous day next day → last day (2890 days later) »

all rooms