Viewing profile — nickbw

Hehe. Sorry, that came across more accusatory than I intended. I totally agree with your overall point. I think Twitter's follower numbers are an example of gamification done right…

> Twitter doesn’t have game mechanics ... > You should totally follow me on Twitter Yuh-huh. I think Twitter is genuinely useful, but I'm pretty sure scoring Big Numbers is the dri…

Ditto. I've always had the impression that, at least on HN, "weekend project" describes a level of "seriousness" rather than absolute time invested. It lets readers know what kind …

Thanks, I hadn't seen that one before. :) Yeah, it's a similar concept, as is http://mlkshk.com/ with their new bookmarklet. I think two things set imagestash apart: 1. The bookmar…

Clickable: http://imagestash.org/

http://imagestash.org/ Kind of like Instapaper for images. While surfing at home one evening I found the perfect desktop background ... for my work machine. I got to pondering the …

I think this is the salient point for startups. Painfully contrived "fun" can be a short-term win. Tech press and early adopters like it ... but only because they like being clever…

Animal Planet shows animal faces. Anything with a recognizable mouth and set of eyes is still pretty engaging to our wetware. (In fact, I just tried "Animal Planet" on Google image…

For brand new/"experimental" projects with both user permissions and a non-trivial set of features, built by a small team, I've always found it easiest to work like this: 1. Build …

Thank you for the insightful comments, and for taking the time to read the code! I really appreciate it. I've added a pseudo-random component to the nonce, and a MAC to the message…

I appreciate your concern, Thomas, but you seem to be telling me that: 1. no one will be able to gauge the integrity of a web app by reviewing the code, and 2. I should fix the sec…

Actually I really appreciate Weis' comments, because they're actual concrete problems and implementable solutions. (A bit-flipping attack is not particularly interesting by itself,…

Most web security systems don't even give you the option. You sends your data off and you trusts your server. You can't read the code at all because it lives on a box you don't hav…

Heehee. Nice!

If you would like to propose improved crypto code, I would love it . Honestly. But "javascript is a messy language" is not inherently an attack. You can obfuscate just about any la…

Your objections seem to boil down to a superstitious distrust of javascript. The web may be a messy platform, but javascript is not a particularly difficult language to read, and (…

It's using millisecond precision time for the nonce, yes. Nonce collisions in a normal volume chat are unlikely. If you'd like to suggest improved counter code, however, I'm all ea…

... and why did you give your chat password to someone who will use it to turn off the crypto? >_>

Transparently? Without anyone being the wiser? The javascript is there for the auditing. The server-side code is not, but you're completely free to analyze the client-side code to …

A couple folks have kindly pointed out that it's wide open to to XSS attacks, since it allows full HTML posting. This is 100% true ... and doesn't matter one bit. The only informat…

That's the point. :) Your password is never sent to the server or stored in any cookies. You have to enter it every time because it only lives in browser memory while you view the …

Yikes, thanks for pointing this out! I fixed a rendering bug in MobileWebkit and wound up breaking Firefox. It should work now. Gotta love web development.

For any HN crypto nerds: I made a little web chat that even the server can't read. Besides boring old SSL, bonchat.org uses a javascript implementation of AES to encrypt chat clien…

What are you basing that on? To gold rush developers, perhaps. I spend most of my iphone time in safari, and I don't think I'm alone. With a bigger screen I'd use it even more. Thi…