Viewing profile — stepstep

It just overwrites the node symlink. > "This package will install io.js v1.0.0 and npm v2.1.18 into /usr/local/. The binary /usr/local/bin/iojs will also be symlinked as /usr/local…

I've had a totally opposite experience. Stripe has been amazing for us. Clean API, good documentation, a slick dashboard, responsive support team, etc.

Processing credit card transactions is a hard enough problem that it rarely makes sense for any non-payments company to do it themselves. Dropbox and Airbnb use Braintree (a Stripe…

In the future, I imagine almost every site will use HTTPS—maybe browsers will even refuse to connect over plain HTTP. Then this kind of attack won't be possible.

You don't have to memorize them, though. If your master key is "bananas" and it didn't work, try "bananas2", "bananas3", etc. But you don't need to remember them all—because they'r…

2^16 rounds of SHA-256 might not be "ultra slow" but it's certainly not as bad as you make it seem. If you read the analysis in the article, it would take many years to crack a ran…

Just took a look at the SGP FAQ and saw this: > SuperGenPass uses a one-way hash algorithm (base-64 MD5) to generate passwords. Specifically, it concatenates the master password an…

It's true that changing the master key is a pain, but you don't have to do it for every website at once. Though it might be hard during the transition to remember which sites have …

A salt is random bits added to a password. Hashpass prefers to be stateless, so it just asks the user to pick a strong password (possibly by adding random bits like a salt). It put…

Yes, you should not use this unless you are willing to memorize a strong secret key. There are warnings in the article, but perhaps it could have used a few more. This is one of th…

Stanford published a paper that is basically the exact same model: http://crypto.stanford.edu/PwdHash/pwdhash.pdf This is not a new technique. In addition to the Stanford paper, th…

Correct, there is no salt. A dictionary attack will uncover common passwords. It's crucial to pick a strong secret key. That's the price you pay for using a stateless password mana…

I tried to address this in the article: "If a generated password is ever compromised, you don’t need to memorize a whole new secret key and update all of your passwords. For that s…

Really? I've never seen any synchronization code (e.g., locks) in JavaScript. If multiple threads can execute async tasks in parallel, doesn't that mean JavaScript needs synchroniz…

SICP isn't a research publication—it's a pedagogical work. It's been very valuable as a textbook for CS students, but I don't think it contributed any significant ideas to the fiel…

All of these are valid points except 1. Node's async IO is one of its strengths. Contrast with Rails, for example, where the standard practice for concurrency is to spawn multiple …

Just re-read this and realized it's unclear: when I said O(n) time, I meant linear in the length of the URL to be parsed. The point is that with this technique, it doesn't matter h…

That's right. Typical routing regexes will not use backreferences, so that's not really an issue here. However, most routes do have parameters implemented as capture groups (which,…

I've had better experience with Angular, though some of the complaints apply to Angular too (e.g., silent errors in templates). Recently I started using Facebook's React framework,…

> All corporations must have a board of directors It this a legal requirement, or is it just by convention? Has anyone ever experimented with alternate company structures?

What happens if a sidechain network is insecure, and someone creates coins out of nowhere and integrates them back into the main bitcoin blockchain? Do sidechains increase the surf…