You are fabricating straw men. They do not need "an answer that can be implemented in an hour." They have been in business for 4 years, and this particular string of DDoS attacks has been going on for several days now. This is both a a planning failure and an incident response failure.
Your comment about iptables is odd. I don't know why iptables would be relevant here; I suspect we are talking about implementations several orders of magnitude different in size. Certainly one would drop traffic at the edges and not do filtering on end nodes.
The error in your reasoning is that all these things do have external effects, but the connection between an external effect and the source is not always apparent. To specifically use the example of fraud, a great number of business operations are under forced reporting requirements for specifically this reason. Your answer to this point is flatly incorrect, as fraud cannot and is not effectively detected in this manner today.
Regarding murder, you suggest "if someone is missing, start an investigation." Of course, the error in your logic is that we do have evidence of drug crime -- and plenty of it. There is no question that Alameda county is full of grow-ops, which produce drugs for the surrounding region. I know, because I live here. There are many, many busts every year. Mountains of evidence.
The reason to limit this sort of investigation is found in the 4th amendment, and it is more than adequate when applied here. Kyllo v. United States is very clear on this point.
Github can easily afford to use someone like Prolexic. And they should.
When you say things like "And it's all dependent on attackers not getting the IP of your actual servers" this makes me wonder how much you understand the subject matter. There are many, many options.
If a murder happens in my home and no one notices, is it not a crime?
If fraud occurs at my business and is undetected, is it not a crime?
Politically, I am against drug prohibition. Legalize it all, and demand warrants for non-visible spectrum imagery of homes. But the idea that a crime isn't a crime if no one notices just doesn't make any sense whatsoever.
It's a classic false dichotomy. Specifically, a person can care about both issues simultaniously.
The problem is that we're not producing the radiation in the air -- it's already there. Radiation shielding is heavy and infeasible for use in current airplane technology. It's a very, very hard problem.
BackScatter scanners, in contrast, are optional. They are completely and utterly unnecessary. It's very easy to get rid of them; indeed it would have been easiest and cheapest to never have forced them upon an an unwilling community of travelers.
Funding the expensive regulatory process (which includes clinical trials and all the rest) is very easy to legislate. For example, grant a company some limited exclusive rights for commerce/sale of a drug they have funded through clinical trials.
A commercial restriction on the sale of a drug would be far less onerous and legally problematic than the current patent system.
It is not circular. Interest and authority are two very different things. For example, the Federal government has the authority to wage war -- this has no bearing on a discussion as to whether they are philosophically correct in doing so.
The suggestion that policy is justified merely because it subsists upon formal authority is nonsense.
Actually it is a reflection of the law. The US government had the authority to prohibit export of crypto (at the time), but did not have the authority to limit it domestically.
If they had been given that authority things may have been different.
I can't get it for you because I have a single laptop at my disposal. However, any meagerly funded criminal enterprise which can front a few tens of thousands of dollars could tell you the answer quite easily.
It is not reliable cryptography, and if you provide an incentive to reverse that hash (rather than merely challenging people who have better things to do) then it will be reversed. When it comes to the type of enterprise which cracks systems for profit, it is as good as plaintext.
masklinn was very clear about the difference between an ivory tower example (yours) and the reality of user passwords. It appears you have missed his point.
It's because I have nothing to say about the database stuff. Why are you so adversarial? I'm not here to cross swords with you; I don't have an opinion on the matter.
But I did notice your rudeness, and you're now being rude to me. Totally uncalled for.
"On your home page you imply that you can automatically OCR arbitrary handwritten receipts into an analyzable format.
No one can do that. That is your problem"
Jeez, lay off the confrontational tone. He doesn't say anything about OCR. Maybe he's using humans to do data entry? In any event, it's completely irrelevant to the topic of databases.
Frankly, your lack of belief is likely due to a lack of experience with user submitted forms with email addresses. It's VERY common for users to simply type the wrong data into a particular textarea. If you do no validation you will get things like the person's name, street address, or other confused mixups.
Anyone who deals with forms of this nature will have seen this firsthand, and with enough frequency to cause trouble with mail relay as the person above has described. It's a real problem.
Which MTAs do you suspect wouldn't deliver it? I've used internal zones of that form extensively without issue on all the common OSS MTAs (postfix, sendmail, exim).
I'm unaware of any common MTA software which wouldn't handle it.
The issue you refer to is in a poorly formed, ad-hoc serialization format. It has nothing to do with representation of variables at runtime. It has nothing to do with the language.
It is a programming error, not an inherent flaw in the language.