wizardishungry

Here's an openbsd VM with tor and a bunch of web browsers preinstalled. There's packet filter rules so even if the vagrant user gets owned, it cannot transmit traffic on the outboard network interface. https://github.com/WIZARDISHUNGRY/openbsd-hiddenfortress

A little bit of googling makes it seem like auth tokens are not sent it plaintext over HTTPS but are authenticated using challenge response – http://forums.dropbox.com/topic.php?id=47952 The WWW site may differ.

Obviously that would work, but not if you're using Challenge-response authentication. In general, I don't think people bother with now that when using https.

If the number of salts used in the system is equal to the number of users, this could be expensive.

I believe that I used to change drive letters to get around this but it may have eventually remembered the last directory when you changed back.

That seems like a perfectly good solution to me. Storing a hash of each signature is say 256 bytes and supposing an upper limit of 10,000 signatures, the database file is pretty small. (Better hope they sign the signature database though)

A free, integrated photo service would not appease a lot of people.

Except for people who aren't web developers (aka Real Users®)

Holy Libertarian hyperbole:

He convinces the FCC to require right-wing channels to link to left-wing channels, Christian channels to link to Muslim channels, vegetarian channels to link to meat-eating channels. "The [linking] icon itself would not require anyone to read anything," Sunstein writes. "It would merely provide a signal, to the viewer, where a different point of view might be consulted." The FCC approves Sunstein's plan for a "Fairness Doctrine" for the online world, and the FCC sets up a new Bureau of Links to enforce the practice.

ITP is a joke coming from a CS background. It's good for internet fameball self-promoter types and people from an design/art background.

Chrome is a risk? I'd say Chrome is a hedge against risk - allowing Apple, MS, Mozilla, etc. to dictate the terms of browser innovation.

Ruby invented strftime?

Wouldn't installing some arbitrary CA's root certificate open me to someone attacking me with say… a Paypal cert signed by them?

You wouldn't need 4096 if the choice of the salt was non-random; some versions of Unix used the first 2 characters of the username. What's the space requirement for a single rainbow table?

Does anyone have any more specific information on whether they just called crypt(key,salt) or actually used a larger salt with a call to encrypt()? The crypt() function only takes a 12 bit salt which is marginally helpful against rainbow tables.

The hash is md5 not sha

Does anyone have any information on changing all their account passwords at once? I don't use the same password for any sites, but unimportant sites like blogs, etc. I use fairly similar passwords on.

Generally, you're only required to provide changes if you are distributing your modified program. This may have been partially addressed in GPLv3 in the form of an "application service provider" clause, but I don't recall