Skip to main content
22 events
when toggle format what by license comment
Mar 20, 2017 at 9:34 history edited CommunityBot
replaced http://meta.stackoverflow.com/ with https://meta.stackoverflow.com/
Feb 15, 2017 at 0:17 comment added user4639281 You're trying to compare apples to oranges, and that is an unfair comparison which makes no sense.
Feb 15, 2017 at 0:15 comment added user4639281 You're wrong because a gun can't reliably put a nail in the wall. I mean, you could put a nail in the gun, and it could propel the nail through the wall, but you're not going to end up with a nail in a wall. You can use md5 to hash a password though, and if you don't have access to bcrypt then it is a perfectly viable alternative. There are some downfalls and security concerns associated with this, but you will end up with a hashed password. Just like using a hammer and nail instead of a nail gun. It would be much better to use a nail gun, but a hammer also works.
Feb 14, 2017 at 22:25 comment added Braiam @TinyGiant analogies are for a thing: making the point across for the uninitiated. Like a gun is the wrong tool to put a nail in the wall, likewise is using md5 as password hashing, with the plus that both are dangerous. The analogy is trying to explain that you don't enable others to use the wrong tool for the job, less when the use of such tool is dangerous to others. A cryptographically secure password hashing is made for hashing password, like a hammer is made to put nails in the wall.
Feb 14, 2017 at 22:01 comment added user4639281 Again, using a gun has nothing to do with using a hammer, not even in the same castle unless the gun is a nail gun. What if the asker does not have access to bcrypt and can only utilize md5? Would you deny them an answer and in turn force them to break all of their fingers because you couldn't be bothered to tell them that they should probably use pliers to hold the nail?
Feb 14, 2017 at 21:58 comment added Braiam @TinyGiant well, at least you are using the right tool for the job. It's like forcing bcrypt to use a small string as salt. We are talking about things that the most naive way to do it will result in tragedy. You hitting your fingers with a hammer is you not being careful. Using a gun is plenty reckless.
Feb 14, 2017 at 16:20 comment added user4639281 There is definitely a danger in breaking your fingers if you hit one of them instead of the nail. That danger would be assessed in the analogy I offered, and there is no correlation between a hammer and nail and an ak47
Feb 14, 2017 at 16:05 history edited Braiam CC BY-SA 3.0
added 4 characters in body
Feb 14, 2017 at 16:00 comment added Braiam @TinyGiant that analogy misses the point: there isn't danger in doing it either way. In the example OP uses, there's a very palpable danger that something goes seriously wrong! That's why gun/pistol/ak-47, something that in many situations can cause harm to others and yourself when used in situations that isn't needed should be mentioned, the danger involving the tool has to assessed.
Feb 14, 2017 at 15:53 comment added user4639281 A more apt analogy would be that of someone asking how to use a hammer and nail to build something when it would really be better if they used a nail gun. The hammer is still going to work, but it will take a long time and there is more of a chance that you're going to hammer one of their fingers instead of a nail at some point. If they want to use a hammer, or don't have a cess to a nail gun, using a hammer is up to them, just explain why it's better to use a nail gun, then tell them how to use the hammer.
Feb 14, 2017 at 13:33 comment added Braiam @SanzeebAryal but at least give the gun unloaded and with the safety in place ;)
Feb 14, 2017 at 13:25 comment added Sanzeeb Aryal We can still say, we can do it with hammer choose gun if you wish to.
Feb 14, 2017 at 11:46 comment added Braiam @hyde a guy ask you for a gun, so he can put a nail to the wall, would you provide a gun? Or you will tell him "a gun is a bad tool to do that because <reasons>, use a hammer instead this way"? Which of the two is preferable?
Feb 14, 2017 at 11:38 comment added hyde Well, you wrtie "I do not answer a question and dissuade anyone from doing so if it is a known attack vector"... And going with gun metaphor, a properly loaded gun in the hands of the care-free foot-shooter is still safer, than letting them load it themselves and blow their head of instead of their foot, if they insist on shooting with it even after warnings.
Feb 14, 2017 at 10:59 comment added Braiam @hyde Where in the world you arrive to those conclusions based on my answer? If anything my answer says that if OP wants to shoot itself in the foot we shouldn't provide a gun loaded so he can shoot us all!
Feb 14, 2017 at 6:17 comment added hyde Security by obscurity is not security, seems to apply here too even if a bit differently... Also, SO is not a forum where you should answer with a non-answer "don't do it". The right way is to answer (perhaps very briefly), but explain the problems carefully. Only way to increase overall security is helping all developers to understand the issues. Bad / uncaring developers will create security vulnerabilities, whether you answer their questions or not, and answering them gives an opportunity to educate all readers, not just the OP.
Feb 13, 2017 at 23:49 comment added Braiam @ninjalj ok, that was awesome.
Feb 13, 2017 at 23:37 comment added ninjalj My favourite example of this: stackoverflow.com/questions/9079298/…
Feb 13, 2017 at 22:48 comment added Félix Adriyel Gagnon-Grenier Yes, this, a thousand times.
Feb 12, 2017 at 20:40 history edited honk CC BY-SA 3.0
fixed typo, small improvements
Feb 12, 2017 at 16:31 history edited Braiam CC BY-SA 3.0
added 72 characters in body
Feb 12, 2017 at 12:42 history answered Braiam CC BY-SA 3.0