4 ms·

Warning: This might ruin your day. Also, don't let tptacek see this or he might get very [angry/existential] (select appropriate).

opless 12y ago
wow. just wow. Then I noticed "PHP" and then I was enlightened.
- sarciszewski 12y ago
  I'm of the opinion that PHP's reputation for being a "bad language" is due to the sheer volume of idiots who can write a script that doesn't parse error.
  - pconner 12y ago
    It has a low barrier to entry. This tends to welcome really bad developers.
  - eli 12y ago
    It's a very popular language. It's got a lot of developers at all levels.
  - opless 12y ago
    I got out of web development in general (I still do it now and then) because there's too many idiots writing bad code, and then clients asking me to fix up bad code ... and then expecting to pay the same rates as the cowboy who wrote the original code.
  - marcosdumay 12y ago
    Nope. The reputation is due to the number of such kind of developers who post at the offical bug-tracking software as official developers, and with sufficient capability to direct the design of the standard library API.
    - sarciszewski 12y ago
      I'm sorry, maybe I need more coffee, but I'm having trouble grokking your intended meaning.
Alupis 12y ago
I'm floored by the amount of people with "fancy" titles from supposed "consulting" companies in the link discussion. The question was "I want to store password[s] in encrypted form." The answer should have been immediately -- "you don't encrypt passwords, you hash passwords using a well known, established, and tested cryptographic hashing algorithm + a salt, damnit!"
- sarciszewski 12y ago
  Yeah, I attempted to do that (politely) with my first post. Though I made a few mistakes (it's password_hash() not hash_password()). As the discussion grew on, I became less nice.
  - Alupis 12y ago
    I saw that -- but then a bunch of "titles" came in and flooded the discussion with the worst possible advice. I mean, seriously, have these guys been living under a rock? This is (well, should be) common sense by now.
    - sarciszewski 12y ago
      Heh. And they all probably get paid a heck of a lot more than I do too. Oi. :]
  - farmdve 12y ago
    Not to mention that encryption means being able to take some input and generate what appears to be a random sequence of characters,numbers etc, but being able to transform it back to plaintext/original format by using the corresponding decryption key. Indeed too many people there failed.
- owenmarshall 12y ago
  > The answer should have been immediately -- "you don't encrypt passwords, you hash passwords using a well known, established, and tested cryptographic hashing algorithm + a salt, damnit!" Your answer is as wrong as anything posted on that discussion. The correct answer is that you don't encrypt passwords. You also don't hash passwords with a salt. Instead, you use a key derivation function such as PBKDF2, bcrypt, or scrypt.

opless 12y ago

wow. just wow. Then I noticed "PHP" and then I was enlightened.

sarciszewski 12y ago
I'm of the opinion that PHP's reputation for being a "bad language" is due to the sheer volume of idiots who can write a script that doesn't parse error.
- pconner 12y ago
  It has a low barrier to entry. This tends to welcome really bad developers.
- eli 12y ago
  It's a very popular language. It's got a lot of developers at all levels.
- opless 12y ago
  I got out of web development in general (I still do it now and then) because there's too many idiots writing bad code, and then clients asking me to fix up bad code ... and then expecting to pay the same rates as the cowboy who wrote the original code.
- marcosdumay 12y ago
  Nope. The reputation is due to the number of such kind of developers who post at the offical bug-tracking software as official developers, and with sufficient capability to direct the design of the standard library API.
  - sarciszewski 12y ago
    I'm sorry, maybe I need more coffee, but I'm having trouble grokking your intended meaning.

Alupis 12y ago

I'm floored by the amount of people with "fancy" titles from supposed "consulting" companies in the link discussion. The question was "I want to store password[s] in encrypted form." The answer should have been immediately -- "you don't encrypt passwords, you hash passwords using a well known, established, and tested cryptographic hashing algorithm + a salt, damnit!"

sarciszewski 12y ago
Yeah, I attempted to do that (politely) with my first post. Though I made a few mistakes (it's password_hash() not hash_password()). As the discussion grew on, I became less nice.
- Alupis 12y ago
  I saw that -- but then a bunch of "titles" came in and flooded the discussion with the worst possible advice. I mean, seriously, have these guys been living under a rock? This is (well, should be) common sense by now.
  - sarciszewski 12y ago
    Heh. And they all probably get paid a heck of a lot more than I do too. Oi. :]
- farmdve 12y ago
  Not to mention that encryption means being able to take some input and generate what appears to be a random sequence of characters,numbers etc, but being able to transform it back to plaintext/original format by using the corresponding decryption key. Indeed too many people there failed.
owenmarshall 12y ago
> The answer should have been immediately -- "you don't encrypt passwords, you hash passwords using a well known, established, and tested cryptographic hashing algorithm + a salt, damnit!" Your answer is as wrong as anything posted on that discussion. The correct answer is that you don't encrypt passwords. You also don't hash passwords with a salt. Instead, you use a key derivation function such as PBKDF2, bcrypt, or scrypt.