Earlier quoted context omitted.
> Last year a contractor deleted the president’s account. The fact that they undeleted it is strong evidence that he didn't have discretion in how he performed his job, and thus was actually an employee and not a contractor.
I’m not sure how that follows. Are you suggesting they don’t keep backups or use a “deletion” flag temporarily, e.g. as part of spam account removal?
Twitter urges users to change passwords after computer 'glitch'
401–410 of 490 posts
Re: Twitter urges users to change passwords after computer 'glitch'
#402Earlier quoted context omitted.
I don't really see how unless you've never actually read imperative code before; either way you need to read both sides of the comparison to gauge what is being compared. I'm dyslexic and don't write my comparisons that way and still found it easy enough to read those examples at a glance. But ultimately, even if you do find it harder to parse (for whatever reason(s)) that would only be a training thing. After a few…
Consistency is king. Often when I glance over code to understand what it is doing I don't really care about values. When scanning from left to right it is easier when the left side contains the variable names. Also I just find it unnatural if I read it out loud. It is called Yoda for a reason.
If you've ever spent more than 5 minutes listening to arguments and counterarguments regarding Python whitespace vs C-style braces - or whether the C-style brace should append your statement for sit on its own line - then you'd quickly see that all these arguments about coding styles are really just personal preference based on what that particular developer is most used to (or pure aesthetics on what looks prettiest - that that's just a different angle of the same debate). Ultimately you were trained to read
if (variable == value)
and thus equally you can train yourself to read if (value == variable)
All the reasons in the world you can't or shouldn't are just excuses to avoid retraining yourself. That's not to say I think everyone should write Yoda-style code - that's purely a matter of personal preference. But my point is arguing your preference as some tangible issue about legibility is dishonest to yourself and every other programmer.Re: Twitter urges users to change passwords after computer 'glitch'
#403Earlier quoted context omitted.
Yeah, exactly. This error shouldn't ever happen, period. All modern development tools give big fat warnings when you do this.
People (atleast me) ignore warnings quite often, they aren’t safe haven if you ask me.
Re: Twitter urges users to change passwords after computer 'glitch'
#404Earlier quoted context omitted.
Let's say you log requests and the POST body parameters that are sent along with them. Oops, forgot to explicitly blank out and fields known to contain passwords. Now they're saved in cleartext in the logs every time the user logs in.
We made this mistake - the trick is determining what fields are sensitive, what are sensitive enough that they should be censored but included in the log, and the rest of the crud. It turns out that this is non-trivial - when censoring how do you indicate that something was changed, while keeping the output to a minimum? blank/"null" was rejected because it would mask other problems, and " * THIS FIELD HAS BEEN REDAC…
Re: Twitter urges users to change passwords after computer 'glitch'
#405Re: Twitter urges users to change passwords after computer 'glitch'
#406Actual twitter post: https://blog.twitter.com/official/en_us/topics/company/2018/... "Due to a bug, passwords were written to an internal log before completing the hashing process. We found this error ourselves, removed the passwords, and are implementing plans to prevent this bug from happening again." Exact same thing that github did just recently.
Is it there on the github blog? Any links would be appreciated
Re: Twitter urges users to change passwords after computer 'glitch'
#407Twitter hasn't figured out how to properly handle passwords after over a decade of its existence? No, I'm not changing my password, I'm deleting my Twitter account for good. I'm tired of big shot Internet companies getting away with such bland disregard of basic security and privacy rules.
I've yet to see a company that didn't accidentally log passwords somewhere, some time.
Re: Twitter urges users to change passwords after computer 'glitch'
#408Earlier quoted context omitted.
Not GP, but KeePass user: I store my KeePass database on a small thumb drive (SanDisk Cruzer Fit), together with a copy of the KeePass executable. If I absolutely need to decrypt my password database on someone else's machine I can take the "secure" software from the USB and hope for the best. The USB also stores a copy of Truecrypt and a large Truecrypt container with backups of my encrypted private keys (PGP, SSH).
Key logger + making a cron job that copies everything off your drive = 5 minutes of work? I hope you trust the folks you use this setup on...
No matter what you do if the computer you are using isn't trustworthy you're losing.
Re: Twitter urges users to change passwords after computer 'glitch'
#409Stupid question department: W3c and IETF or other similar clever folks really like security stuff and do lots of clever things to make us safer. So why couldn't we create a http browser/server authentication method that has something closer to a nonce-based challenge/response mechanism? If it were standardized, the browsers could even do some clever hashing of some peer addresses or other things that we think should…
In the end user experience vs security is a straight tradeoff.
Secondly, the digest authentication only supports MD5 anyway.
Re: Twitter urges users to change passwords after computer 'glitch'
#410Earlier quoted context omitted.
Its a mistake , it happens. Software is hard. Change your password.
It would be fine, but people who claim to be pro in software and are being paid premium refuse to learn from mistakes, neither from their own nor from others'. They just mitigate the fallout by saying things "It's was a mistake, sorry about that, it happens, software is hard". Brain surgery is hard. Mistakes happen. But after a few mistakes you probably should stop doing brain surgery altogether. At least the patient…
If you banned every developer the first time they made a mistake their wouldn't be any developers.