warbiscuit

12 ms·

61.
by warbiscuit 11y ago
That's beautiful. Had no idea about that option.
62.
by warbiscuit 11y ago
I love PG, and don't plan to ever move away from it. But I'm starting to wish they had in-place upgrades. Application I develop is getting to the point of "too large to make a copy of the whole db whenever I want to upgrade
63.
by warbiscuit 11y ago
If I'm reading this right, the exploit is in the regex compilation stage, not the data matching stage; therefore remote exploitation would require the server setup to compile attacker-provided regexps, not just setup to run attacker da
64.
by warbiscuit 11y ago
Not to mention: having all the data, and comprehending all the rows on an individual level, are two very different things. Doubly so if the data is irregular (I'm currently doing fuzzy matching on really mangled street address data. I
65.
by warbiscuit 12y ago
[Namecoin]( https://namecoin.info/ ) is exactly that - in particular it's .bit domain is an attempt to be a blockchain-based decentralized DNS registrar. I'm not sure of the exact state of Namecoin with respect to D
66.
by warbiscuit 12y ago
Was posting to suggest exactly that, it's also what Python calls it ( https://docs.python.org/2/library/functools.html#functools.p... ), and a "partially evaluted / filled out" function basically
67.
by warbiscuit 12y ago
Among others, there's gitlab.com and bitbucket.com (and also mercurial, as an alternative to git itself -- though the two can push/pull between each other's repos with the right plugin).
68.
by warbiscuit 12y ago
Ah. That's a relief, I was a little worried. But that makes it strange that someone, knowing of this limitation, would choose to start with the xml dump format.
69.
by warbiscuit 12y ago
Hard to believe mysql doesn't include that data in one of it's dump formats.
70.
by warbiscuit 12y ago
Ooh, that looks interesting ... and not just for ROM feature. They've packed a TON of things into there. Even SCRAM support! I'm really intrigued by one of the planned features... "Hash upgrades to higher cost settings with
71.
by warbiscuit 12y ago
Yep... that was roughly my starting approach. Current one I'm playing with uses multiple samples (chosen as a function of the initial hash and the previous samples), to ensure the attacker has to actually take the whole file... other
72.
by warbiscuit 12y ago
It's not necessarily "slow is best", but rather minimizing the ratio between how fast your production server can calculate them multiple hashes while under load, vs how fast your attacker can crack them on dedicated hardware.
73.
by warbiscuit 12y ago
I'd argue that definition is incorrect. To be unique, all something needs is to have a collection of properties which (taken together) are possessed by no other instance within some larger population. Even then, it's still quite p
74.
by warbiscuit 12y ago
Regarding Python C extension compatibility ... A number of projects (e.g. this bcrypt package -- https://pypi.python.org/pypi/bcrypt ) have switched from using CPython's API for C extensions, and switched to the cf
75.
by warbiscuit 12y ago
I think he meant github, and the various features it offers, such as issues, pull requests, and threaded discussions thereof. I'm also not a fan of github's monoculture (or for that matter, of git's -- i rather like mercurial
76.
by warbiscuit 12y ago
Typed too hastily, meant "in-place upgrades".
77.
by warbiscuit 12y ago
Not to mention that Debian consistently supports "in-place" upgrades when moving between releases, minimizing admin time doing the upgrade, and actual server downtime. Whereas Ubuntu... I tried using it on a few servers, their co
78.
by warbiscuit 12y ago
I've been using VirtuaWin ( http://virtuawin.sourceforge.net/ ) for a number of years to get virtual desktops on windows. It's a little of a pain to get installed & configured exactly as I want it, but it (along
79.
by warbiscuit 12y ago
I've had good experiences with name.com, price and service -wise ... the frontpage isn't as slick, but once logged in the UI is nicer. Have yet to see a registrar with an actual good interface though :|
80.
by warbiscuit 14y ago
The most common pepper algorithm I've seen is doing e.g. "bcrypt(hmac_sha512(password, pepper), salt)" instead of "bcrypt(password, salt)". This has a number of advantages over working the pepper into the hash itself: 1) this wrapper can be