101 reputation
2
bio website
location
age
visits member for 3 years, 6 months
seen Apr 8 at 22:23

Mar
9
comment Why almost no webpages hash passwords in the client before submitting (and hashing them again on the server), as to “protect” against password reuse?
It sounds like your plan for protecting yourself against rogue sites is to ask the rogue sites to set up better security. ?
Mar
9
comment Why almost no webpages hash passwords in the client before submitting (and hashing them again on the server), as to “protect” against password reuse?
This is the best answer. You should encrypt at the transport layer. Without doing that, the rest is not secure. Yes, you could write an encryption function... but that function would be visible to the (malicious) end users. Use SSL.
Nov
26
comment Should MVC/REST return a 403 or 404 for resources belonging to other users?
Another aspect to keep in mind is this: how are 404s treated downstream? Is there a CDN or some kind of caching? If you ever want to be able to cache those, then you probably don't want your "user doesn't have permission" 404s to be cached.
Jan
14
comment What kind of innovative non-cash financial benefits do I offer to my developers to retain them along with a competitive salary?
@Paul Wagland It might need to be flagged, but I don't think that needs clarification either.
Oct
22
comment Servicing background tasks on a large site
I'm curious because I have a similar scenario (on a much smaller scale) and I too am just piggy-backing on some random users unlucky connection. I'm not familiar with the best solution, so I'll follow along here. :-)
Oct
22
awarded  Autobiographer
Oct
22
awarded  Supporter