Great article. I do agree with it, while I'd add this conclusion (personal opinion):
- Usefulness of visualizing the codebase, interconnections, memory layouts - all of these are attempts of an overview of the things that aren't immediately clear. It's an attempt for an outside-of-the-box view, which becomes necessary in larger codebases/environments/companies. This is very useful for, say, an architect of a system (or systems), and even for individual contributors that are not comfortable in the current view (they may be struggling, or they may achieve better performance, of either the app or themselves with the insight gained from these visualizations).
- Actual visual programming only offers "boxes" of functionality and makes you frame everything the way it was initially imagined. It's limiting expressiveness and makes your mental model adopt the framework's way of thinking. Everyone I know has abandoned any visual programming only because they feel it is limiting them ("It's a nice toy, but it's too difficult for me to create something more complex" is a common thing I hear).
I'm amazed by the fact this had actually gone through several levels of approval, and yet nobody noticed anything wrong with a request to snap a photo of your CC and post it online.
I am well aware of that, and agree with you. There had to be some seriously bad decisions made here, and it certainly doesn't look like someone from a big company would make such mistake.
Yet, those kind of bad decisions are made every day, by people all around the world. I wouldn't give benefit of the doubt to anyone these days.
This actually just sounds like a really bad implementation. Some front-end dev wasn't sure what's a good timeout to fire the password to the server on, so he or she just put it on keypress.
And then he included the email too, so the backend could look up the user and make a custom password blacklist for this specific case (eg: no personal details allowed).
I actually don't disagree with doing a POST of a password to check password strength server-side. It might be "cheaper" a bit in some cases.
But sending on every keypress and including the email - that's just silly.
That's what I thought, thanks. I'm a newish Mac user, so I was a bit confused by the whole situation, since other Mac I know told me not to install anything of that kind.
I have a MacKeeper related question: are apps such as this (cleaners, antivirus etc.) necessary for Mac computers? Judging by the number of users affected by this, there are a lot of people thinking they do need it, I guess.
This makes me wonder if we are just children of some of the earlier species. If not, did life spontaneously come to existence here, on our lump of rock in space?
In any way, as someone already had said, we're a bit late for the show now.
I have a cheap internet connection (16Mbit, ~$13/month), and I'm not a minority. In my country, having an internet connection that's speedy enough for video streaming is not a luxury. And yet, I can't even buy anything off iTunes, Google Play Store, not to mention Netflix and other similar services. In fact, we even got PayPal only in mid 2013 (and not even the full service - we can only send money and can't receive anything), that's how "open" the internet is to our market.
Also, my country is in southern Europe, not part of the EU yet.
> The vast majority of people will be using this to watch movies they don't feel like paying for.
I think this is highly biased towards your own ideas of how someone could use such service. You are, in fact, projecting[0] your own probable scenarios to large group of people you have never met, living in countries you've only heard of in the news. That, sir, is unfair. You should not stick with generalized opinions and prejudice, mkay?
Perhaps the cracker is actually employed at PayPal for real? :) This thought amuses me, since it's a scenario with no leaks outside the circle of PayPal employees, yet it gives the opportunity to the bad guy to gain the info necessary for the deed.
The thing that made me think this way is that they claim everything's in order on their end, but they still only sent me the bare package, without the extra controler I've ordered. In a customer service ticket reply, they, however, claim they had to send the console without the extra controler in order to send at least something, and that I'll get the controler in a future shipment.
Bottom line - they can be pissed all they want. They still didn't deliver on their promises.
Actually, the only thing the hacker didn't do is ask the dude politely to give him (or her) the money. This wasn't a 0day bug, no XSS. The dude gave the hacker permission to run any code on his machine, therefore it's completely his own fault, and has nothing to do with MtGox.
- Usefulness of visualizing the codebase, interconnections, memory layouts - all of these are attempts of an overview of the things that aren't immediately clear. It's an attempt for an outside-of-the-box view, which becomes necessary in larger codebases/environments/companies. This is very useful for, say, an architect of a system (or systems), and even for individual contributors that are not comfortable in the current view (they may be struggling, or they may achieve better performance, of either the app or themselves with the insight gained from these visualizations).
- Actual visual programming only offers "boxes" of functionality and makes you frame everything the way it was initially imagined. It's limiting expressiveness and makes your mental model adopt the framework's way of thinking. Everyone I know has abandoned any visual programming only because they feel it is limiting them ("It's a nice toy, but it's too difficult for me to create something more complex" is a common thing I hear).