udoprog

It is not far fetched given that "big boobs" is interpreted in a societal context which is dominated by male gaze. That is, big boobs is "artsy" and "funny" for a man, since he is the target audience of the joke. Someone at the other end of the joke might take offense. Especially if you experience similar events on a daily basis within your professional environment. Just because something could qualify as art, doesn't mean that you are not allowed to scrutinize it.

I suggest that you employ a bit of empathy instead of drawing assumptions about the persona of the other party.

Putting up twenty links to Wulff & Morgenthaler (epic comics) and using it as an educational/critical source without context only dilutes what you are trying to say, i.e. people should more relaxed.

That being said, being able to figure out how to spell anything sensible using 8 sixteen-digit letters is an accomplishment.

No, the main point is to show how simple client verification actually is. This implementation is one step up on the application stack into a comfort zone which seems to be more acceptable by devs.

I believe in design in depth, and by allowing the most basic of techniques (form submission + cli tool stack) to handle something that is generally perceived as difficult and letting people "get" the manual process, the automation might not seem as daunting.

I did not intend to create a standard, just to provoke more discussion. I would however by gladly surprised if I woke up tomorrow and twitter allowed me to sign in by solving a challenge instead of a password : ).

Not so different in theory. This just displays how little fuzz client certification can be on a higher level which is more easily approachable by web developers.

Side note: Firefox extensions aren't native code, they're written in JS.

EDIT: I do however agree that chrome is more well designed. Firefox has been through a lot of iterations through the years.

This is an epic introduction into virtual machines for the brave C coder. Very neat and clean, thank you.

I haven't perceived that people think C is significantly scary (or evil). There are however many compelling reasons not too choose C in the present RAD/Web/Cloud/Solution Business world.

Got it.

I wouldn't however say that the complexities of C is it's syntax (unless you're playing around with macros : ) ). But I guess the concept can be applied broadly, like remembering functions, headers and other language specifics.

Moving from Python to C is a very good move. It allows you to go from programming to inner workings, everyone should have a solid knowledge of C since it give you the tools to identify and correlate aspects of other languages to reality.

I don't understand what "practicing the syntax" means (language barrier?), but I'm not suggesting that I've stopped learning, which I never will.

Indeed, I currently get turned off by most books I pick up, simply because they start out on a too basic general level.

If you however dig a little deeper you can usually find stuff that isn't too tutorialish. Like http://www.c-faq.com/top.html which has been an extremely solid resource for me.

It seems like the real solution would be to introduce low level guarantees and memory access (similar to Java) and the option to disable the GIL and C API extensions in CPython (until a new API is introduced?).

Also, give the developers access to some real synchronization primitives, that would be sweet.

I'm not a CPython developer, but the last points of the points on the desired list[0] seems very unfeasible to me. Not even STM solves the "Speed" requirement, but PyPy gives away with native extensions so it's halfway there!

[0] http://wiki.python.org/moin/GlobalInterpreterLock

I voted for displaying comment points, but I do agree that they might create something of an echo chamber where the "highest rated" comment is the one that decided where the topic is going. If this _was_ the case prior to removing comment points another solution is necessary, but more information would be appreciated.

Added "Java Portlet" to specify, thanks for the heads up.

"Awesome! Do you have any stats on how many people have installed Chrome Frame?"

I found this question interesting, does anyone know of any viable source for this kind statistics? Is the user-agent for chrome frame distinguishable?

Edit: Found the user-agent from the dev docs; "GCF reports that it is available by extending the host's User-Agent header with the string chromeframe"

Yes it does, however it doesn't provide granularity for multiple users of the same server, and unless you go for vanilla could be troublesome to customize through something like pam. I simply commented on the non-issue with creating private repositories.

A service like this is nice if you don't have the ability or time to setup your own environments, but in my opinion could be risking a very slim user scenario.

Which in turn, incidentally leads back to DDG : ).

Crazy good stuff has been going on with DDG the latest couple of months, I'm just glad I've finally found a search provider who takes these issues seriously!

I currently store all my passwords in a KeePass[0] database distributed using SpiderOak[1] (hassling, but only once for each device).

  [0] http://www.keepassx.org/
  [1] https://spideroak.com/

My Fx settings involve flushing all cache and sessions on closing.

Apparently when setting the Fx master password, the local database appears to be using 3DES encryption in CBC mode[0] (nice and slow) which is insanely secure with long and keys. The only password I have to remember is the KeePass database, which in turn is as complicated as I can remember. The when booting up firefox, just paste the master password.

  [0] http://luxsci.com/blog/master-password-encryption-in-firefox-and-thunderbird.html

This means that the only password that is stored in my head is for the KeePass db, but I'm planning on replacing it with a key file (perhaps on USB), once I've figured out a usable scheme for it.

I'm just dying for the day when web services can be integrated into a proper keychain, that would spell an end to this bull.

I don't get it, why is setting up a private git repository on your own server a hassle?

Assuming you have ssh access (compacted for clarity):

  ssh server "git init --bare repo/project.git"
  git clone server:repo/project.git

EDIT: mkdir superfluous

otoh, this also leads to more peer review, which in turn could contribute to all of parents points.

There are so many instances where non-mathematical variables play an important role in authoring security conscious code. Yes, most security issues arise from not checking edge cases, but you have to know what they are. Mathematics will surely adapt you into thinking about this practically, but it will never teach this.

The last modified file is from 2008-07-17 02:14 (config.xml)

This seem to be a copy of an svn tag from tech.scedev.net/source/scedev_source/tags/20080616-33/scedev

It appears to be a snapshot of a smarty installation, so the most interesting stuff is actually in the database.

EDIT: Also, they seem to piggyback on HTTP authentication, and there is a snippet suggesting that they are using unsalted md5 passwords. Ouch.

Just had to have a look, love the following tidbit from FILE.C

    char cryptkey[]={'M'-4,'i'-8,'n'-12,'d'-16,'y'-20,0};

    LONG Encrypt(char far *data,char *key)
    {
      LONG i=0,keypos=0;

      while(data[i]!=0){
        data[i++]^=key[keypos++];
        if(key[keypos]==0) keypos=0;
      }
      return i;
    }

"The simple-XOR algorithm is really an embarrassment; it’s nothing more than a Vigenère polyalphabetic cipher. It’s here only because of its prevalence in commercial software packages, at least those in the MS-DOS and Macintosh worlds [1502,1387]."

The point is being up front and to the point, in spirit with "don't ask to ask, just ask". Most of these meta-answers are founded in the belief that the asker doesn't know what they are asking. And by supplying another set of questions instead of just bluntly stating what you think, you are feebly trying to guard yourself from being wrong - which is something people hate to admit on IRC.

The better being that you explain that "X and Y is a bad idea" and getting a quick "No" in response (assuming the asker knows what he/shes asking), instead of having the asker having to going in to more (often unnecessary) detail.

I personally loath meta answers like "why are you doing X and asking Y" instead of wasting the equivalent typing of explaining why X and Y is a bad idea.

With that said, I usually find the most serious experts just quietly ignoring silly questions or trying to pry out the root of the problem through a constructive dialog. Why superior douchebags get satisfaction of showing of their superiority by bashing beginners has always been beyond me.

That said you really need a tough skin on IRC on some channels, and always take the topic to the letter. That usually indicates what type of people hang there and what type of messages are accepted.

i gathered the opposite from the conclusion, unless it somehow leaves a window for another patch

The hackers solution. A media server running mpd or XMMS2, with the proper metadata organizing utility for your medialib. Plus running mplayer and possibly some ffmpeg tweaking for when you're out in the deep end. Plays anything, anywhere, and leaves the rest up to your imagination.

I guess Miro is great, but any complete solution will always be inferior to the proper tools for the right jobs.

people need to stop attaching themselves to what they do, this way its easier to both have fun just doing, no matter skill level or adherence. I've seen bizarre cases of very skilled people tearing themselves up just because whatever they do is not perfect in any given respect, be it technical or artful. They end up miserable.

I don't design. I could, but I know that the time I would spend designing would be twice the amount compared to a skilled designer. Instead I ask someone who loves design. collaborate with them to create something awesome. We bash and we chastise, but always realize that its about the work, not the person or his/her skill level.

This does not translate well to corporate, but for the better it really should.

This is the kind of stuff that Gimp needs instead of playing catch-up with PS.

Also, as the guide mentions, it's possible to mount the partitions with different options. As the following (all mentioned in the HowTo, excerpts from "man mount"):

  noexec Do not allow direct execution of any binaries on the mounted filesystem.  (Until recently it was possible to run binaries  anyway using a command like /lib/ld*.so /mnt/binary. This trick fails since Linux 2.4.25 / 2.6.0.)

  nosuid Do not allow set-user-identifier or set-group-identifier bits to take effect. (This seems safe, but is in fact rather unsafe ifyou have suidperl(1) installed.)

  nodev  Do not interpret character or block special devices on the file system.

Edit: fixed pre and clarification

Except that this specific document comes with good advice and rationale. There is nothing here that indicates a secret agenda. It's not as if the document is telling you to install a backdoor for them.

Sadly the revered secret is usually stored as safely as the password in plain text on the compromised server. I would any day recommend someone to use 40 character random passwords locked down on the client, available through pasting, than have them fumble around with improper key exchanging.