is there an authentication scheme where the password never leaves the client (e.g. browser) and only ever exist outside the client hashed or encrypted?
@JohnZhau TBH I don't understand scram really well. But I think the server only ever has access to a hash of the password, never the password itself. Better double check this though, since I'm not a reliable source.
@MechMK1 There was a message in my site's chatroom that I was sure was spam and validated flags for, but on further inspection seemed potentially like it could be on-topic here and just extremely off-topic in my room rather than necessarily being spam.
I just joined here to check it out; no reason really otherwise.
Ah, I see. Well specifically here, I wasn't sure if the user's request was a legitimate thing that could go here or actually just spam, so I unsuspended the user and referred them to this room to see if it would be relevant here, but I don't think they decided to reiterate their request here, so IDK what's really up with what they were asking about.
Ah, okay. I haven't a clue about either what they were asking for or what this chat room is about but I will keep that in mind, thanks. Another user recommended that this might be an appropriate place so I checked it out and it didn't seem immediately wrong.
A developer, let's call him 'Dave', insists on using home-brew scripts for password security. See Dave's proposal below.
His team spent months adopting an industry standard protocol using Bcrypt. The software and methods in that protocol are not new, and are based on tried and tested implementa...
I work at a large, modern, company, but I've still run into some **CRAZY** stuff because someone was sure that:
1. The fact that it is our own implementation means it is more secure. Public things mean that anyone can find the weaknesses after all! 2. I know enough to do this right
So the Novice barely understands anything he does, and mostly learns by imitation. The typical "I copied this code - no idea what it does, but it seems to work"
As the "Advanced Beginner", you still have no idea about the bigger picture, but you're starting to be able to solve some problems on your own.
The typical "programmer challenges" are aimed at advanced beginners
Once someone is Competent, they begin to see the bigger picture, and begin to understand the rules they have been presented with. Exceptions to rules start to make sense.
The proficient user begins to develop an intuition on how to solve a problem. they're embracing the bigger picture, and can quite often tell when something is wrong, just by "feel"
The Expert completely abandons prior rules and relies almost solely on intuition, which is 99.9% correct
So...the expert beginner...where do we start
As you see, it's a branch from the advanced beginner, slightly above, but below competent
The Expert Beginner doesn't see the bigger picture, and has nowhere left to go. They believed to be experts, believe that there is nothing left to learn, and use their expertise to justify not learning anything
"I know everything that is worth knowing. What I don't know is thus not worth being known."
@MechMK1 From my perspective, it's crazy how much this is actually an accurate description of a common occurrence, rather than just an oversimplification of a complicated problem (which is what I would normally say to things like this)
@JourneymanGeek That's the stage that comes after Expert. It's called "Existential Crisis" and comes when you realize just how complicated everything is and the fact that the world doesn't spontaneously light on fire is an unexplainable miracle.
Just hear the hottest take that the presumption of innocence until guilt was proven in a court of law is just a tool made by the patriarchy to protect white male rapists
I remember a time where an accusation of a crime was enough to lead to execution. The primary victims were women.
Jesus fucking christ I have to stop listening to insane leftists spouting insanity
No you didn't remain ambiguous, because the capital N means you weren't referring to me. Hence you must have meant 'nobody' in the plain sense of the word.
TIL if you set swappiness=0 on Linux, OOM killer will have a nice chat with your processes and headshot them when you run out of memory even if you have a petabyte of swap available...
this changed on kernel 3.5 and probably was backported to older versions as well... I learned this when a large Oracle database for a very large customer got a kill -9 because something went wrong and memory was exhausted, even if swap wasn't even touched...
and as Murphy is in charge of setting downtime, this happened when most people were trying to use the services, which makes sense because a busy database uses more memory than an idle database... and a database hard crash isn't pretty to recover
fortunately this time we got back in less than an hour... but I've seem a 56 hour database recovery once, and that's not my idea of fun. the only info you have if "database is restoring logs", without any indication of progress, any ETA of any time, and the only hint you have that the database is doing anything at all is the iostat showing writing activities on the disk.
and you staring at the screen not knowing if the start will finish in 2 minutes or 2 days...
My days as a DBA are largely behind me, but I never got into managing gigantic databases and never ran into any severe problems, so I can't really claim that much expertise
Apparently I have just enough expertise to not be an "Expert Novice" :)
it is... specially when the direct manager called his manager, that got a call from his manager and the VP of tech is on site siting besides you asking how long it will take to be back online
and in a room of 30 people, 20 are from management: PR, HR, tech, lawyers...
but this incident from yesterday wasn't bad at all: remote, no manager calling, up in less than an hour