2,671 reputation
2718
bio website github.com/CodesInChaos
location Frankfurt, Germany
age
visits member for 4 years, 2 months
seen 25 mins ago

Dec
6
comment How deterministic are SessionIDs from SHA'd GUIDs?
I still recommend a proper CSPRNG over Hash(secret+counter). Counters can roll back when restoring from backup, secrets might not leak once... A proper CSPRNG is forward secret, recovers from compromise, doesn't require persistent state,... If you use the hashing approach, at least include a CSPRNG output in the hash inputs in addition to secret and counter.
Dec
6
comment How deterministic are SessionIDs from SHA'd GUIDs?
UUIDs don't necessarily contain fully random bits. V4 GUIDs are mostly random (apart from 6 bits) as you said. But V1 GUIDs are highly structured, and it sounds like the OP's API still uses V1 GUIDs.
Dec
5
comment Is it ethical or even legal to track user data/metrics using IP
Storing full email addresses is already slightly problematic in Germany.
Dec
5
revised Sorting an array of numbers with decimal places
deleted 16 characters in body
Dec
4
revised Sorting an array of numbers with decimal places
added 34 characters in body
Dec
4
answered Sorting an array of numbers with decimal places
Dec
2
comment New to TDD. Should I avoid private methods now?
or internal in .net.
Nov
29
comment Should a class know about its subclasses?
What works in many languages is adding some form of abstract internal member.
Nov
28
comment How do I comply to GPL in case of Appliance?
1) Depends a lot on how closely those different software parts are linked. 2) Which version of the GPL? GPLv3 has some extra requirements, related to customers being able to install their own version of the GPLed software.
Nov
27
comment Validating time-limited HMACs
For the larger problem: Why not simply throw SSL at the problem?
Nov
27
comment Validating time-limited HMACs
Just add the timestamp in clear to the token. Something like timestamp || HMAC(key, timestamp)
Nov
27
comment Which of these old criticisms of common lisp still apply today?
Floating-point is hard to get right. Some languages specify a strict model and suffer performance wise, others use a loose model and are hard to reason about. For example reasoning about even simple floating point programs in C# is too hard for me. So I tend to side with language designers who are strict with floating point, even if it costs performance.
Nov
27
awarded  Yearling
Nov
26
comment Should a class know about its subclasses?
Usually no, but in special cases it's useful.
Nov
25
comment Alternative to Singleton when D.I. is not an option
@Snagulus Even configuration like data that doesn't change over the runtime is problematic in a classical singleton. For example you can't run different configurations in one process that way and isolating that configuration in tests is annoying as well. But assuming drupal is a singleton by itself, one more singleton won't add much additional trouble.
Nov
25
comment Alternative to Singleton when D.I. is not an option
@Snagulus Since the singleton accesses external mutable state (a database), a classical singleton is a bad solution. Still it might be the best available solution in this context. Sometimes one has to choose the smallest evil, which might be a singleton here.
Nov
24
comment Are frameworks used for “big” websites?
There are two kinds of "big". Having many features and having many users. For sites with many users, performance often trumps development effort.
Nov
24
comment C++ for C# Developers
@DPD But C# and Java lack the cool parts of C++. For example proper value-type support + RAII and C++ templates are far more powerful than .net generics
Nov
24
comment C++ for C# Developers
C# Delegates and c function pointers are quite different. A delegate is closer to a functor in C++ than to a function pointer.
Nov
24
comment C++ for C# Developers
Just read Stroustrup: The C++ Programming Language and a couple of FAQs(+FQA)