4 ms·

You'd be surprised how much "PHP login" tutorial use md5 for password encryption. And then people are surprised these devs dont known better? it's because of al

by camus2 12y ago

You'd be surprised how much "PHP login" tutorial use md5 for password encryption. And then people are surprised these devs dont known better? it's because of all the mis-eductive content the web cant get rid of.

krapp 12y ago
Also, many startups consider security to be a waste of time, since you don't need a secure site to generate revenue (arguably, appearing secure has more value in that sense than actually being secure.) Also I still see people now and then arguing that salted md5 is perfectly secure and that using a slower hash or any hash at all either doesn't add value or actually harms value. So they may not know better, or they may know better and simply not care.
- balls187 12y ago
  > Also, many startups consider security to be a waste of time Do you have evidence to support this? I wouldn't say that security is considered a waste of time. It is, however is a trade-off[1] between money, time, and other resources, things that, generally speaking, start-ups tend to be short on. I worked for a startup that provided multifactor authentication using biometrics (amongst others), and almost all of our business came after publicized (and not publicized) breaches, from both large and small firms. [1]https://www.schneier.com/essay-155.html https://www.schneier.com/essay-155.html
  - krapp 12y ago
    We may be talking about the same phenomenon from different points of view. I have evidence but I really don't want to name names - but anecdotally, I have pointed out massive issues (like not even escaping user-provided variables in inline SQL queries) to clients, and seen it dismissed as less important than just getting live. Maybe my comment was a bit too biased and hyperbolic, but I've certainly encountered that attitude.
voltagex_ 12y ago
I once registered wrongtutorial.com to call out incorrect and dangerous tutorials. I couldn't write enough content to get it off the ground. Do you think it'd still be a good idea?
- nknighthb 12y ago
  A more general form of tutorial review/correction site would be more interesting. Actually, a browser add-on to load commentary/annotations for known tutorials on the fly might be nice. All sorts of practical problems that would have to be overcome, though (like changing content and getting people to use the add-on in the first place).
- aaronem 12y ago
  > I couldn't write enough content to get it off the ground. Poke around w3schools. That should give you more than enough initial grist for your mill.
  - id 12y ago
    http://www.w3fools.com/ http://www.w3fools.com/
- camus2 12y ago
  Definetly! I love this idea!

by camus2 12y ago

krapp 12y ago

Also, many startups consider security to be a waste of time, since you don't need a secure site to generate revenue (arguably, appearing secure has more value in that sense than actually being secure.) Also I still see people now and then arguing that salted md5 is perfectly secure and that using a slower hash or any hash at all either doesn't add value or actually harms value. So they may not know better, or they may know better and simply not care.

balls187 12y ago
> Also, many startups consider security to be a waste of time Do you have evidence to support this? I wouldn't say that security is considered a waste of time. It is, however is a trade-off[1] between money, time, and other resources, things that, generally speaking, start-ups tend to be short on. I worked for a startup that provided multifactor authentication using biometrics (amongst others), and almost all of our business came after publicized (and not publicized) breaches, from both large and small firms. [1]https://www.schneier.com/essay-155.html https://www.schneier.com/essay-155.html
- krapp 12y ago
  We may be talking about the same phenomenon from different points of view. I have evidence but I really don't want to name names - but anecdotally, I have pointed out massive issues (like not even escaping user-provided variables in inline SQL queries) to clients, and seen it dismissed as less important than just getting live. Maybe my comment was a bit too biased and hyperbolic, but I've certainly encountered that attitude.

voltagex_ 12y ago

I once registered wrongtutorial.com to call out incorrect and dangerous tutorials. I couldn't write enough content to get it off the ground. Do you think it'd still be a good idea?

nknighthb 12y ago
A more general form of tutorial review/correction site would be more interesting. Actually, a browser add-on to load commentary/annotations for known tutorials on the fly might be nice. All sorts of practical problems that would have to be overcome, though (like changing content and getting people to use the add-on in the first place).
aaronem 12y ago
> I couldn't write enough content to get it off the ground. Poke around w3schools. That should give you more than enough initial grist for your mill.
- id 12y ago
  http://www.w3fools.com/ http://www.w3fools.com/
camus2 12y ago
Definetly! I love this idea!