brokenwren

15 ms·

91.
by brokenwren 10y ago
My son plays Roblox and this is definitely a big issue. I basically had to turn off his filter so he could play the game. Otherwise, the chat looks like this: Player1: "Can you promote me?" Player1: "Did you see that?" P
92.
by brokenwren 10y ago
Simple passwords are mitigated by salting and slat modification. The guide covers both of these and hashing. This should be sufficient even against thousands of GPUs.
93.
by brokenwren 10y ago
I've had a lengthy debate and discussion about this with a number of cryptographers. Here's the math we came up with that appears to allow for SHA and other hashes (blog post will be coming eventually). Please correct me if anythi
94.
by brokenwren 10y ago
You are correct. I missed read that question. If you select an easy passphrase for your key, it's similar to selecting a weak password for your bank account when your bank doesn't enforce password constraints. Buyer beware. An ide
95.
by brokenwren 10y ago
Thank god the scripts are open source. You can actually read them and figure out what they do. Shocking!
96.
by brokenwren 10y ago
The libpam-cracklib does it for you. It's a PAM module that is invoked whenever the user changes their password. You can configure it to enforce various password constraints and rules. Check out section 4.4 for a detailed overview of C
97.
by brokenwren 10y ago
If you disable passwords, then you need to use password-less sudo. That's usually not a great idea. Users still need passwords, they just need to be secure. For SSH, yes, keys should always be used and the guide covers disabling passwo
98.
by brokenwren 10y ago
I agree that pulling does appear to be more secure, but if someone breaches any of your servers undetected, you're pretty much hosed regardless. Plus, the Inversoft guide specifically states that backups must be encrypted. I could put
99.
by brokenwren 10y ago
BCrypt works fine, but I wouldn't say it is "2016-era security practices". It was written in 1999 and hasn't had as much scrutiny as SHA or Blowfish (although it is based on Blowfish). Regardless, using a salted, multi-p
100.
by brokenwren 10y ago
HTML version now has a TOC as well!
101.
by brokenwren 10y ago
The hackthis application that is referenced in the guide is also in Github here: https://github.com/inversoft/passport-js-example It uses Ember, Node.js, Express, Sequelize, MySQL and Passport User Database ( https:&#x
102.
by brokenwren 10y ago
I love the fail2ban part of your guide! I totally need to try that.
103.
by brokenwren 10y ago
This one is pretty decent but if you want the ultimate guide check out this one: https://www.inversoft.com/guides/2016-guide-to-user-data-sec... It covers 10x what all the other guides cover in terms of server and appl
104.
by brokenwren 10y ago
More affordable than free? Not sure I get this. Is CI really so hard that we need to pay someone else to do this? I have a perfectly good server doing nothing and I installed TeamCity on that. Works great and is essentially free.
105.
by brokenwren 10y ago
I don't see this as belittling customers or incoherent at all. I'm pretty sure every engineer has thought about these issues before and we've all seen spectacular crashes from load. I think the idea of the article is that use
106.
by brokenwren 10y ago
Passport is free for up to 50 users. This is enough for most developers to get started and into production (depending on the use case). Plus, you don't have to pay more for internal versus external users. Everything is based on the tot
107.
by brokenwren 10y ago
Haha. I wish! That would be awesome, but getting to 100M users is probably 10% planning/process and 90% luck.
108.
by brokenwren 10y ago
During registration, you need to handle things like assigning roles to the user for your application, verifying the users email, setting up two-factor authentication (if they want) and storing metrics. The metrics are helpful for tracking r
109.
by brokenwren 10y ago
Ouch. Looks like we need to do some serious blog tuning. :)
110.
by brokenwren 10y ago
The registration and login parts are usually the simple features to implement. Its the localization, emailing, password encryption, disciplining, rewards, two-factor authentication, OAuth, login reporting, registration reporting, daily acti
111.
by brokenwren 10y ago
This is 400 _registrations_ per second not logins. On the test hardware, Passport can handle 1,000 logins per second. Remember that the server this test was run on is 10 years old and has crap hardware. Running these tests on a modern box w
112.
by brokenwren 10y ago
True, but the post is about scaling Passport, not really scaling Wordpress. I haven't seen the site crash, so I seems like its just taking the server a while to server up the static content.
113.
by brokenwren 10y ago
That's what happens when 10,000 people hit your website all at once. :) I think it's probably Wordpress that is sucking here though.
114.
by brokenwren 11y ago
Haha. Or don't let your AI out without parental supervision.
115.
by brokenwren 11y ago
Inversoft - Onsite in Denver, CO (full-time) - Senior Software Engineers - $100k-$120k plus equity Inversoft is hiring skilled software engineers to work on our 3 products - Passport, CleanSpeak and Gather. All of our products are focused a
116.
Passport User Management Tool Named #1 API by DeveloperWeek(inversoft.com)
8 points by brokenwren 11y ago|0 comments
117.
by brokenwren 11y ago
I did a SAML implementation with Ping Identity for a "large kids brand" and it was horrible. Getting permissions and roles out of LDAP, passed through SAML and translating them to our application was so brutal it was laughable. Gu
118.
Death to SAML and LDAP – Introducing Passport(inversoft.com)
16 points by brokenwren 11y ago|2 comments
119.
Full Stack Java developer Denver Colorado – $90k-$120k plus equity
1 points by brokenwren 12y ago|0 comments