[woah]

Amazing how many developers, even from very prestigious schools, write really horrific code. As a self taught programmer getting into the industry over the past few years, I have been shocked. Oh well, I guess it's "fuck it, ship it".

[krapp]

Whenever someone posts an article here about some exploit relating to a startup, or that it turns out they were never doing anything but storing passwords in plaintext, you'll get a small army of posters pointing out that it would be insane for them to focus on anything besides getting the product out the door working just well enough to start taking people's money as fast as possible.

So yeah, "fuck it, ship it" seems to be more or less the standard.

[wellboy]

No one expects from a non-funded startup with 1 engineer on board to have all the security figured out.

However, if you are VC funded with 10 engineers on the team, this is inexcusable.

[krapp]

I would argue that first startup needs to spend the extra time or hire another developer if the end result otherwise is something as egregious as what QuizUp appears to be doing.

But I agree, there's a huge difference between just not being able to implement security and not considering it relevant. To me, this is clearly a sign of the latter.

[joshfraser]

People don't realize how easy it is to see the secret API's behind their mobile apps. There's no obvious view-source on my phone and a lot of devs lack a full picture of how all the pieces fit together.

[pnathan]

hey man - I'm putting together an unfunded product on the side by myself, and my passwords are using scrypt, and they have a salt, and the salt is per-user, and the system rejects weak passwords based on popular entries, bad entropy, and easy guessability. It honestly wasn't more than 8 hours of foolery to get all that working. Is it ready for the credit card industry? no. But it's going to stop derps who get their hands on the DB.

[anaphor]

Yeah but you didn't learn everything you know from poorly written PHP tutorial websites and W3Schools. The words "Key-Derivation Function" are nowhere to be found in the lexicon of these people.

[girvo]

I did, originally. And it's certainly in my vocab, and in my applications where applicable.

[acchow]

> and the salt is per-user

The only kind of salt...

[yourad_io]

You're forgetting table salt.

[ars_technician]

Consider that you are just practicing cargo-cult security though. You just piled a bunch of password security recommendations parroted all over the Internet to the detriment of your users.

If you are using scrypt with a reasonable difficulty and a per-user salt, there is no reason to put the entropy restrictions, weak password restrictions, etc on your end-users. It is painful to interact with sites that enforce ridiculous password requirements.

You can get away with a 4 character password on Netflix. There is a reason for that. Security is much more subtle that password complexity.

[pnathan]

> Consider that you are just practicing cargo-cult security though.

No, I really am not. But as I didn't describe my reasons, you don't have the context to understand them.

Frankly, if Netflix has 4-character passwords, I would expect it to be relatively easy to compromise their accounts live with a carefully put together campaign. If Netflix gets their username/pw database dumped, I expect we'll see their policy change as the passwords are trivially cracked.

Not only that, putting together a safe & sane password retry system isn't the easiest thing every, and doing careful fraud detection based on geolocation/ip etc isn't the easist thing ever either. Particularly when I don't have someone working full-time on security.

Further, what you also didn't know is that the password strength functions as written have knobs I can adjust if things are too onerous.

So having harder passwords goes a long way towards 'better security' on the account side for little effort.

I would advise you to be more cautious about making unsubstantiated statements based on ignorance in the future.

[abraininavat]

Just curious if you know what class of people you're making fun of when you use the term "derp".

[fphhotchips]

You piqued my curiosity, so I went looking. According to Know Your Meme, that most prestigious and reliable of sources, "derp" originated from Trey Parker and Matt Stone. First it was in a movie (where they were sniffing underwear), and then in South Park. Now, having not seen the episode, I can't really comment on its contents, but I assume that the character that first used the term in South Park was either simply stupid, or suffered from some form of disability. Either way, the term has since devolved into making fun of stupid people - which I believe the grandparent was also doing.

[pnathan]

Question: why would school prestige correlate with quality of code?

[nitrogen]

Why shouldn't it? Prestige presumably had to be earned at some point. If prestigious schools are producing sub-par developers at a rate equal to other schools, what is the value of that prestige?

[pnathan]

Not all prestige is equal, for one thing. Your fine institution might attract world leaders as speakers for its econ, foreign policy, and poly sci departments, but its CS department might be weak. For another thing, the academe and what it teaches is, as a general rule, not really focused on what the business world teaches. So excellence in the academe does not per se translate immediately to excellence in the business world. While an adaptable learner would be excellent potential and long-term capability, I would expect them to have a learning curve for the different pressures and knowledge needed to succeed in business.

[anaphor]

Presumably someone who graduates from Stanford or MIT in CS will be preferred over someone graduating from Princeton or Yale in CS (Personally Indiana or NEU would be my first choices).

[ars_technician]

Precisely. Princeton is prestigious, but I don't want formal models. I want someone that can at least pass the fizzbuzz test.

[droz]

More often than note prestige is something someone is born into rather than earned.

[cema]

Because the quality of code correlates with the school prestige -- which, in turn, is built on the quality of education (or, at least, the quality of the graduates, may not be the same thing, if the quality of the applicants is also different).

[phillmv]

That's easy.

We don't really know what it means to write good code. We can't measure it. We can barely talk about it meaningfully. It's rarely taught except via osmosis: you pair with someone more experienced and you read cargo cult blog posts.

[woah]

I know it when I see it!

[djKianoosh]

seems, anecdotally speaking of course, that most of the people I know who are self taught create way better (for some nebulous definition of better) software than the purely school-taught folks. maybe we just enjoy it more who knows...

btw, combination of both is probably better

[woah]

Well, if you went to Stanford and are able to bang together some spaghetti that only runs by pure coincidence, you're a rockstar.

If the only diploma you hold is from some backwoods high school, you've got a bit more to prove.

[krapp]

as a self-taught coder who's taking a CS course I can certainly appreciate the value of each.