Digitalxero

they have a "I am an idiot and forgot my password" button so people forgetting their passwords is no additional support, and if they allow longer password it actually makes them easier for people to remember and harder to crack, win win.

So I went to update my password for my World of Warcraft account after I saw this.

And guess what I discovered, my current password is more secure than their current password policy will allow. So I filled out a support ticket with the following question (which all Blizzard account holders should ask them)

I was wondering why even after you discovered a security breach you have not updated your password policy to actually allow secure passwords. Your current password policy only allows password that will take a day or two to brute force crack. see http://xkcd.com/936/

These two rules totally nullify any security of your passwords

"Your password must be between 8–16 characters in length. Your password may only contain alphabetic characters (A–Z), numeric characters (0–9), and punctuation."

In fact my current password is better since I apparently created it before your policy changed to not allow non alpha-numeric characters.

The only reason to have those two rules is because you are storing the password in plain text so anyone who gets access to the database can read them freely. Please update your password policy to

"Your password must be at least 20 characters long."

That is it, let me make a 400 character password if I want, let me use cyrillic, chinese, or whatever other unicode characters I want to use. If you truly care about security you will fix your broken password policy!

Part of it is to get experience in understanding diverse code bases quickly, but also to see lots of diverse code bases and styles to see what we like and dis-like about each.

We are not working on this full time, so I expect round one will take two to three months, round two will take about the same. Round 3+ will likely take one to two months.

The reason we picked lots of projects is to narrow it down to 5 we might be willing to actually spend our free time working on, thus actually fixing lots of bugs in our favorite 5. I expect the top 5 will not fluctuate much over the rounds, as our first 20 are seeded with projects we already know / work on.

Good point about languages. Since my brother and I have used very few languages we focused on the desire to expand on that. But for those that have used every language under the sun feel free to pick a languages you have not used in a while :).

Existing (Open Source) tools at first for sure. Capture the audience, then extend and provide customized solutions / tools. I like zbruhnke idea as an initial project / mastermind group any one can join to get their feet wet if they dont already know a project or have one of their own they want to work on. But initially to get things started I think it would be best to use existing (open source) tools.

Once the choice of existing or new is made then the choice of technology / tools needs to be made. There are alot more existing solutions that meet the working spec needs in alot of differing technologies. So once the new/existing choice is made you really need to focus on tech (.Net, Python, Ruby, Java, etc) as this choice will help inform the number of potential contributers.

<ThoughsOnConcept> I see this working best kind of how Google did in the early days and how I hear facebook currently works. Developers post project pitches to try and gather other people (Devs, PMs Marketing, etc) to their idea, then working together to make it happen. All members of SG would be under a blanked NDA for pitch ideas and each project once started could have their own. </ThoughsOnConcept>