j0ev

I disagree, it gives the gist of what is in the background. You can easily tell if the layer is over the homescreen or Mail or Safari etc. I like the blur effect because it makes it easier to read text than on just say a 80% opaque layer (and I think it looks cool).

When I call a language fun, I generally mean:

1. It delights me by doing what I want.

2. It makes normally complex programming tasks easy (try metaprogramming in php).

3. It is simpler than I originally imagined.

1 & 2 generally means... it's a "hackable" language (ruby is another good example). 3 is icing.

No, node.js needed to happen. Javascript makes it very easy to write event-driven code, which it turns out is a pretty good model for a web server, especially if you are routing real-time data between clients. It didn't just "go viral", it had solid proven performance stats.

Don't get me wrong, I started with PHP and it is solid, but yech I wouldn't call it fun.

1. node.js happened

2. lots of devs already know the javascript API very well.. a lot of times these same devs write server backends. why not share code between client and server?

3. (maybe just me) it turns out writing in a language as dynamic and flexible as javascript is pretty fun

That's a bad assumption. I could feasibly purchase the appsp0t.com domain, grab an ssl cert for nodecrypt.appsp0t.com, hop onto the LAN and run sslstrip, redirect the user to https://nodecrypt.appsp0t.com and wall-a, green address bar with a close looking address. That would probably fool me.

The "green" indicator is nice but definitely should not be relied upon to protect the user.

note: i used appsp0t as an example, no idea if its really available to be bought.

Edit: it's not letting me reply to the below comment (probably because this is a new account), but afair most browsers have fixed the IDN problem by checking for "suspicious" characters (characters that look similar to roman glyphs) and forcing the URL to be rendered in the full punycode URL.

Using his same attack, it's easy to spoof the js crypto libs to be insecure/have a backdoor, while the site appears unmodified to the user.

Even worse is that the attacker only really needs to spoof the JS assets once, and set an extremely long expiration date in the response cache headers, and then he's poisoned your site until the user forces a reload or kills his cache.

tldr; you owe mox $1000