ayrx

I think you mean Druid instead of Barbarian :)

I don't disagree with your overall point but in the world of high-end watches Rolex watches _are_ mass produced and leverage economies of scale. I think the latest estimates are around 800,000 watches produced per year by Rolex.

You will be part of the rare minority that uses that configuration which by itself is a fingerprint.

To be more exact, what you want is not a slow password hashing algorithm. What you want is an algorithm that is as efficient for the defender as it is for the attacker. The key is that you do not want an attacker to be able to abuse custom hardware or distributed compute in order to gain an efficiency advantage.

It's a nice sentiment but that's how you end up with abandoned, low quality projects that no one uses. Or even worse - abandoned, low quality projects that half the Internet relies on.

Yeah, it was a pain in the early days but I feel like Blizzard has recognised that and are actively taking steps to improve things.

What incentives would a someone have to invest a considerable amount of time in releasing and maintaining an open source project if they can't even use that to promote themselves?

That's actually untrue for Hearthstone.

You can be perfectly competitive without playing arena or buying packs. I haven't paid a cent for the past 2 years and can play all the competitive decks I want in every meta. Blizzard has been very good with bumping up the rewards you get from playing normally.

If you look at his other comments in this I’m not sure it’s sarcasm.

“we deal with it successfully enough in TLS and SSH all the time”

Not quite. Downgrade attacks has been a huge problem for TLS.

You can audit iOS. Security researchers do it all day long.

WordPress has a history of almost embarrassing security vulnerabilities. To be fair, most PHP applications of that era have similar track records.

The newer versions have been _much_ better.

It very clearly shows the need for education.

This StackExchange answer[0] has a nice overview of what encrypted.google.com does.

[0]: http://security.stackexchange.com/a/32374

His point is absolutely not applicable. Rust is a _very_ new language. The community will eventually converge on specific crates for specific purposes in time.

> This isn’t a question that comes up so often with respect to (say) Python because Python has an effective form of curation – blessing things into the standard library, at which point their alternatives generally disappear. In effect, Python modules are quality-filtered on the taste of the BDFL and the devteam.

I love Python but this statement is absolutely coming from someone who does not write Python on a regular basis. Many stdlib modules are greatly outclassed by third-party alternatives - urllib2 vs requests, datetime vs arrow just to name a few - to the point where no one actually uses the stdlib modules in production.

> AMD it seems won't be able to do that now.

Yes they can, they'll just have to commit resources to keeping up with kernel changes instead of having it done for them upstream. You can't have your cake and eat it as well.

lvh was until very recently an employee at Rackspace and Rackspace provides the hosting for the project.

In my experience a lot of the problems with automatically converting existing Python 2 code to Python 3 code is that the Python 2 code usually makes fundamentally broken assumptions when it comes to unicode and bytes.

And if he doesn't understand that concept should he _really_ be teaching anyone programming?

> Currently you cannot run Python 2 inside the Python 3 virtual machine. Since I cannot, that means Python 3 is not Turing Complete and should not be used by anyone.

I stopped there.

But all things are not equal.

Not quite, Thomas's avatar in many places is that of a bear. He has named a few of his works after bears, in particular his password hashing function Makwa.

This is a very awesome library. I am attempting to integrate it into the test suites of my various projects this past week and the author has been more than helpful, even when I filed bug reports that turns out to be issues in my own code.

RPython is definitely a Python-first thing. PyPy is the only VM written in it that's actually production-ready at the moment. I'm guessing that has more to do with effort invested than any real limitations on RPython's part though. I'll definitely read up more on Truffle. :)

Are you implying that it's impossible to write maintainable code in any dynamic language?