by Bozho | Sep 22, 2012 | Aggregated, Opinions
There are a lot of cool companies with products on the web that millions of people are using. I’ll wondered whether I should labeled them “web 2.0″, “silicon valley”, “cool startups”, or something else, but I think it’s clear which ones I’m writing about. The assumption is that these companies attract the best technical talent. And even despite my criticism of their interview process, I still used to think that indeed the best developers and software engineers go to these popular web companies. But due to a couple of observations, I’m no longer certain. These companies have been making junior-developer mistakes in many areas and I can’t imagine that a “top talent” could allow this to happen. What raised my concerns is security. And it’s not computer-science heavy-cryptography-algorithm-design type of security. It’s the simple web security that every developer out there should actually know – how to store passwords. I was astonished to learn that Yahoo, LinkedIn, and recently Pandora were revealed not to be hashing and salting the passwords, which lead to password leaks. (Note: the case with Pandora is a bit less trivial as noted in the HN comments). It’s the bare minimum thing you should do, and any sane developer who sees that the company stores passwords in plaintext, or uses MD5 hashes, or doesn’t add salt, should just go and fix that (with management approval, yes). “Legacy” is not an issue here – you can hash&salt plaintext passwords, and you can add salt to a hash the next time a user logs in (by getting his actual password on login in order to generate a...
by Bozho | Sep 15, 2012 | Aggregated, Opinions
Programmers are people who create computer programs. (I’ll skip the discussion whether it should be “programmer”, “developer”, “engineer”, “coder” or whatever. You know what I’m talking about). What makes programming different than most professions is that it’s way more diverse – you can do new things every day, because new technologies emerge all the time. Not only that, but programming is actually a creative job – given a couple of rules and foundations you can build whatever you like – something nobody else has built. Just like the poet starts with words, metric and rhyme rules and comes up with a poem. Or the compose starts with notes and the rules of harmony and comes up with a song. The good thing about programming is that there are always new things to start with and different rules to adhere to. So, programming is a well-paid, creative profession that gives you the opportunity to do a lot of different things. Not exactly. Programming has another feature – it has to be practical, to serve a business purpose. That’s why many programmers tend to do the same thing over and over again – website after website, ERP customization after ERP customization. Then they change jobs to do a very similar task. Partly because they are already experienced with a given technology or process and other companies want them because of that experience, partly because most companies do the same – they build websites for clients, they build or customize ERPs, or they have their own online service that has to be supported/created, but which is essentially the same as what you...
by Bozho | Aug 23, 2012 | Aggregated, Developer tips, Opinions
The other day I read this Arstechnica article and realized how tragic the situation is. And it is not this bad because of the evil hackers. It’s bad because few people know how to handle one very common thing: authentication (signup and login). But it seems even cool companies like LinkedIn and Yahoo do it wrong (tons of passwords have leaked recently) Most of the problems described in the article is solved with bcrypt. And using salt is a must. Other options are also acceptable – PBKDF2 and probably SHA-512. Note that bcrypt is not a hash function, it’s an algorithm that is specifically designed for password storage. It has its own salt generation built-in. Here are two stack exchange questions on the topic: this and this. Jeff Atwood has also written on the topic some time ago. What is salt? It’s a random string (series of bits, to be precise, but for the purpose of password storage, let’s view it as string) that is appended to each password before it is hashed. So “mypassword” may become “543abc7d9fab773fb2a0mypassword”. You then add the salt every time you need to check if the password is correct (i.e. salt+password should generate the same hash that is stored in the database). How does this help? First, rainbow tables (tables of precomputed hashes for character combinations) can’t be used. Rainbow tables are generated for shorter passwords, and a big salt makes the password huge. Bruteforce is still possible, as the attacker knows your salt, so he can just bruteforce salt+(set of attempted passwords). Bcrypt, however, addresses bruteforce, because it is intentionally “slow”. So, use...
by Bozho | Aug 16, 2012 | Aggregated, Opinions
Remember when we used to download and install software? We do that rarely these days. Every tool that we need has also a web version, which is cooler and doesn’t have “virus alert” written all over it. However, for many small businesses, it is still an inconvenience (more of a psychological one) to use a service hosted elsewhere. “They have my data!!”. And these people can’t install and manage the whole stack needed for running a small software locally. On the other hand writing desktop software is tedious (especially in Java). People want to build cool web apps, because that’s where innovation happens. All desktop applications have got in the past decade is a fancier default theme from the OS. Fortunately, the innovation in the web front has now allowed us to build desktop applications as web pages. Sounds odd, I know, but I have already seen some tools (primarily monitoring and development tools, but it’s a start) that are purely html5 and javascript, and run in a browser. So instead of installing an exe file (“I swear, no viruses, checked by 3 companies you’ve never heard of, and it also might change your registry but don’t worry”), people can download an html file and double-click it. It will open in a browser, which is something they are familiar with. And it will do everything a regular application can do. Also, this type of software can be used as client to some UI-less services providing just APIs. I am not talking about OS utilities, or low-level stuff here – just applications for personal finance, small business inventory, notebook, etc....
by Bozho | Jul 30, 2012 | Aggregated, Opinions
You wanna be in the cloud? You have plenty of options. I’ve evaluated or used many of them, so here are a few words about each. (I will include some Java-related comments, as I’m using Java, but most of the things apply to all (supported) languages). But before I go into a bit more details for each service, let me summarize what “the cloud” actually means when it comes to hosting your applications: auto-scaling – if there is an increased demand, you automatically get more resources (more virtual machines in most cases) to handle the requests. For the regular application this is rarely useful, but it’s nice to have it and be sure that your service never dies because the load is too high pay what you use – simply put, this is in fact the option to choose small servers when you are small, and bigger servers when you are big. The “cloudy” thing here is that you can do that easily, rather than reconfiguring some remote machines cloud infrastructure – this is fancy talk for “we deploy these services and take care that they are working”. So instead of installing and configuring a message queue on your machines, you hook up to an already installed and managed message queue. Or database, email service, or cache. management tools – you get consoles, command-line tools and web UIs for handling your installations. This is both a plus (the tools are higher level than working with native commands), and a minus (there’s a learning curve) load balancers – all services offer these, and you rarely care what’s the software and...
Recent Comments