yomamma

Probably who he had in mind when he said: much blog writing is vapid self-promotion.

I wonder if this would be considered a "movie plot threat".

http://news.ycombinator.com/item?id=815264

These are the geek versions of "movie plot threats": increasingly unlikely contrivances of a combination of poor choices and brilliant evil genius which can only be addressed by the fact that the hero studied ballet back in high school which we know because he was razzed about it in scene two.

Bull.

Back in real life:...

Well, in my real life, I've never "rainbowed" a table, or even know what that is after 12 years in IT, but I sure can open a sql file in a text editor and figure out which field is the password.

It's a layer of defense and widely accepted as the minimum and so easy to implement it's ridiculous to argue against it, especially as a "movie plot threat".

Quick, somebody make a movie out of this:

http://www.webhostingtalk.com/showthread.php?t=729362

and what about:

1) That database dump of the users table that someone put on a usb drive and lost.

2) A brute-force attack via a misconfiguration which allows remote logins to mysql. No "rails stack" access, but the passwords are now compromised.

3) The non-application backup server with DB dumps.

4) S3 access is compromised and unencrypted dumps to S3 are downloaded.

I guess I could keep going, with the attacks getting more outrageous, but I can assure you that stranger things have happened.

Kudos for being open and honest. These guys are the poster child for PR.

Hyperbole may sell, but we don’t want to sell it.

Well, you sold it for a long time.

The clear text passwords thing is incomprehensible. These guys have move knowledge about rails in their toe jam than 99% of the "rails experts" out there and they can't implement hashed/salted passwords? Come on. How is this not a show stopper?