themole

I played around with Flash Media Streaming Server a while back it and might be able to do what they need it to:

He could setup the freebie developer's version (at least it used to be free) on his computer. Then you'd need to make a flash player or two that will stream the video and audio back to the server so they can each see and hear the other. Then just stick those players on webpage somewhere, and you're pretty much set. This could be done as an Adobe Air app as well I think...

If they have the computers and webcams (hp mini or eee pc would work!), I'd be happy to see what I could do to help them out: admin (at) hpminiguide . com

(Sorry if this doesn't make a whole lot of sense, I'm super tired and coming down after a few strong drinks)

My last three jobs have been w/o direct or indirect connections:

1. I was working at an ISP help desk and a local computer repair company called in desperately needing help with a *nix box. Went out on my own after a shift and helped the tech out. He emailed me the next day and asked if I was interested in working for them as a repair tech and if so when would be a good time to do a short interview. I eventually moved up to the director of web dev at this job. (Side note: Getting the ISP job was because of a direct referral)

2. I applied for a web dev job at the local newspaper about 4 years later. They offered me the positon about five weeks after applying - two weeks after my second interview. They were notoriously slow for interviewing and hiring people.

3. (current gig) Two years after that I applied for a web dev gig at the state university and was offered the position about 4 hours after my first and only interview. The interview went really well and all my referrals were awesome.

Now between all those jobs (about a 6 year span) I've probably applied for at least 5 other web development jobs and didn't even get interviews for all of them. For some I'm sure the lack of a college degree really made them think twice. In one interview I got burned on some technical questions that I couldn't answer which probably removed me from the pool.

While knowing people can be extremely helpful, I've found being ready when opportunity knocks much more useful. To put it another way, don't stop learning new things.

By continuing to expand your knowledge you prove that you're smart enough to learn and use new things, and that you care enough about your work to make yourself better at it.

They should also be suggesting straight up data validation before sticking anything in the db. No reason to let things get that far if you're expecting a number and they give you garbage.

Yeah, just setup the pop3 account and download it. I think you export your contacts as vcards - even if not most of your contacts should be right there in your email.

I fire up thunderbird everyonce in a while to basically backup my emails because of those horror stories of people losing all their email or even access to the account

It sounds more like a badly designed web app than Alexa doing something it shouldn't. If it really did do harvest passwords and log in with them, we'd hear a lot more about it.

As gojomo said it was probably passing the username and password in the URL (query string). I've been burned by the exact same thing before because of Alexa. I had the little Alexa rank FF extension which told Alexa about a page I really wish it hadn't...

"A better idea would be to set a cookie with the hash of the user id + some secret salt + a timestamp. The secret salt gives us some protection against said script kiddie, while the timestamp will make the hash expire. Neat!"

From those couple sentences, it really doesn't seem like this person knows what they're talking about. The hash won't "expire" just because you have a date in it...and because we're talking about one way hashes there is no realistic way for you to figure out what date was hashed in there. Maybe they meant the date on the cookie...still a big error to make in a field with no room for the tiniest of errors.

Hashing the password in Javascript before sending it over an insecure connection is pretty sweet (but it's not AJAX, just Javascript).

----

Yeah, that post over at matasano.com is great. Really an eye opener and got me thinking about things.

I've being using "stretching" since I read about it on their blog. I basically have this:

function hash_password($password, $salt) { for(i = 0; i < 50000; i++) { $password = sha1($password.$salt); } return $password; }

My salts are all randomly generated using letters, numbers and symbols and are at least 15 characters long. It takes about 1 second to run that on my web server, so it slows down brute force login attempts. It will also take someone forever an a day to use a rainbow table against it since they have to match the hash fifty thousand times. It's not a s secure as something like Blowfish, but it's leagues better than just a single sha1($password.$salt);

it's a flash based chat/instant messenger with video or an online video capture and editing app.