ErikD

That uses mostly data collected clientside using javascript and flash. HTTP headers alone are no way enough.

With and option to disable this behavior from the HTML websites could chose to disable it on forms which might contain sensitive data. Browsers could even disable it by default and let the websites enable using an attribute.

Anyone else ending up on a "UPVC Doors and Windows" site when going to http://jsunittest.com/ ?

I think anothermachine meant it should be default behavior in browsers. I agree, with the attribute to disable or enable this from the html it would be a nice feature for browsers to implement.

I would suggest using userData [1] for IE 6 and 7.

[1] http://msdn.microsoft.com/en-us/library/ms533007%28v=vs.85%2...

That's what https is for. It should prevent them from doing anything useful with the packets.

In Chrome it's 3300 [1]

[1] http://src.chromium.org/chrome/trunk/src/net/cookies/cookie_... search for kMaxCookies

What apps do you have installed? This is interesting to know since the data might be from a popular app instead of Apple.

Does it really matter that the hacker doesn't know which hash belongs to the user? He will still be able to do a dictionary attack using the same method you use to login.

Wouldn't this just make dictionary attacks easier? Now the hacker doesn't have to find one exact password but has the option to match any of his dictionary passwords to any of the password hashes.

I know that there are hardly any collisions and that in practise this wouldn't really change a thing. But in theory the dictionary attack would be faster this way.

You don't: http://en.wikipedia.org/wiki/Halting_problem

Using mk-slave-delay you can do this with Mysql as well. We always have a slave running behind a day. You can fast forward the slave using the 'START SLAVE UNTIL' command.

Once Chrome and *JS support SourceMap it shouldn't be that hard to debug.

Opa means Grandpa in Dutch.

Keep in mind that serving already properly minimized png, jpg and gif images with gzip can actually increase their size.

It's not faster in all cases. You can construct mazes on which bi-directional is a lot slower.

He means using the auto-complete in your address bar, not actually searching with it.

Since the code in question was run server side using nodejs you can just enable it. Using it for client side javascript is another case indeed.

People should realize that by using this service, all sensitive data posted to your website will be readable by google.

Yes. Here is a link to the linkedin blog: http://blog.linkedin.com/2011/07/24/apply-with-linkedin/

That's very much possible using images:

  .someIcon {
  padding: 0 0 0 20px;
  background: url(someIcon.png) left center no-repeat;
  }

It probably has that many points because there are some interesting discussions going on in the comments.

I use http://www.dispostable.com/ for my throwaway mails.

In the Netherlands we have DigiD [1] which is used by most government sites.

[1] http://www.digid.nl/english/

Android phones support flash these days [1]. I have been told it works pretty good.

1: http://googleblog.blogspot.com/2010/05/android-froyo-with-so...