jwarkentin

Being aware of exploits and protecting against them comes with the territory. Luckily there are things like owasp.org to help developers keep up on web security. However, security is hard and it can't be done absent mindedly. There is no getting around that.

"If this was such a beneficial mutation, why isn’t it more common?"

Based on natural selection it would only necessarily be more common if it affected reproduction. It may begin to affect reproduction now that people are sleeping less and those that don't cope well (like those that don't have the gene) may die before they reproduce; but until recently when sleep deprivation has become a larger issue, I doubt it ever affected reproduction enough for natural selection to do its job.

I don't know the history but if that were the case then the non-compete should be between the owner and buyer, not employer and employee. It makes no sense to go after the employees to prevent former owner competition.

Haha, indeed. Who would ever have thought to put a picture on a white background? Gotta protect that IP!

You're correct about the forward secrecy. That's what I get for commenting at 2am. I was thinking about TLS where there can be a frequently rotating asymmetric key pair. The symmetric key in TLS isn't used for PFS, only for performance. In practice those keys don't actually get rotated almost ever though.

If you're not bothering with the HTTP protocol then you don't even need a certificate at all. You just need to have something like SSH's 'known_hosts' file. All you need to know when initiating communication over a secure channel is that the key the server sent you is in fact the key for the server. In fact, if you're including something with the app, just include the servers public key directly. Forget the whole key exchange process. Then use the server's public key to send a symmetric key generated by the app itself (sort of like TLS does) for the duration of the connection. This provides forward secrecy as well. Simple. Elegant. Secure.

The only catch is that if you change the server's key it will break all clients. However, you could always hard code a second public key that isn't even contained on your servers that is used as a fallback for catastrophic incidents where your private key gets exposed. Once you fix your security hole you swap out your key to your fallback and clients are secure again.

It's not necessarily "advanced", but it is unexpected behavior I think. I've run into this same sort of issue myself. It didn't take ages to figure out, but it was annoying. It's one of those things that separates an experienced JavaScript dev from the rest.

I never stated whether I believe in a creator being or not, nor will I since it is not relevant to this conversation. The belief that a creator is orchestrating things is what's known in science as a theory. The point I was making is that neither theory is mutually exclusive. It does not follow that if one is true, then the other is not.

Also, if you are indeed scientifically minded then you must be open minded to all theories that explain the state of things unless there is sufficient evidence to the contrary. It is not enough to say that there isn't sufficient evidence. Remember, the absence of evidence is not the evidence of absence. To rule out a theory that could explain our observations without evidence is not scientifically minded at all.

To have a productive conversation, if you believe that the two theories are mutually exclusive then please explain what about one of them being true, means the other cannot be. If you don't believe they are mutually exclusive then my original point stands that the statement by 'spiritplumber' is a non sequitur.

See, this is what bothers me. Too many people seem to think that there is a conflict between evolution and creationism. The thing is, both can in fact be true. Who's to say that there isn't a creator orchestrating processes? Such a being wouldn't work by magic, but by a profound understanding of natural processes. How would this be any different from us discovering how life was created and then using that understanding to create it ourselves? The whole back and forth over evolution between religious and non-religious folk is ridiculous. Neither side will ever get anywhere because the whole premise of the debate is a non sequitur.

So if I believe I have the right to drive really fast and I think the laws need to be changed; but you believe I shouldn't have the right to go fast, does that mean that you believe I'm a second class citizen for believing I shouldn't have a right that I believe I should? Seems a bit like a logical fallacy and a strawman. Regardless of where you or anyone stands, let's at least frame the debate right. No one thinks that LGBT people are second-class citizens. To frame the debate like that is an appeal to emotion (also a logical fallacy) and ultimately fruitless, as it avoids the real debate.