Tom Moertel

> > It's possible to implement anything correctly with dynamic types but the point is static typing makes it easier to do so

> This is where the argument became circular and we can basically stop.

I think any appeal to "easier" is inherently subjective. I've certainly tried to avoid making any such claims. Instead, I've mostly tried to argue that static types can forbid certain programs from ever running, and we can use that to forbid things like vulnerable SQL queries.

> > It's possible to implement anything correctly with dynamic types

> but apparently chriswarbo does not.

I never said any such thing; besides which, it's trivially the case that anything implemented with static types could also be implemented with dynamic types, since static types only exist at compile time (they are "erased" during compilation), and hence every running program is dynamically typed.

In fact, I don't think I've said anything about correct implementations at all. My point is that static types can forbid incorrect implementations. When it comes to security, that is much more important; i.e. I would much rather bang my head against a screen filled with compiler errors, than expose some insecure program to the harsh reality of the Internet.

> The parent claim (by chriswarbo) was that, for example, SQL injection attacks were, in fact, incontrovertible proof that SQL injection attacks "are classic type errors".

I've not claimed that (in fact, I'm stuggling to parse what that sentence might…

It is one of your primary duties to safeguard the best interest of your organization. Incontrovertibly, the best interest is not served by storing passwords in plaintext as this can result in grave harm to your organization.

Accordingly, while I would not share any details with the outside world, I would advise you to strongly push the issue internally, from the position of an educator.

Here are four articles that may assist you in composing a stronger series of arguments:

https://www.owasp.org/index.php/Broken_Authentication_and_Session_Management

http://cwe.mitre.org/data/definitions/256.html

http://blog.moertel.com/articles/2006/12/15/never-store-passwords-in-a-database

http://marknelson.us/2011/02/06/gawker-considered-stupid-criminally-stupid/

You will want to further notate that the effort of implementing non-plaintext authentication really isn't terribly significant.

What troubles me is this "most senior" programmer of yours. If storing passwords in plaintext is OK with him/her, meaning that he/she has a weak background in security engineering, I can't imagine that there aren't many additional severe security issues (SQL injection, XSS, CSRF, etc...). Most concerning of all though is that this "most senior" programmer seems disinterested in due diligence and is instead actively arguing against widely known best practices.

If, after your strong push, management still is not motivated, personally, I would resign. I would not want to be professionally affiliated…

That would be right assuming passwords were always encrypted - and we know that unfortunately even some of the biggest sites have been bitten by not encrypting passwords in their database[1] - but that's not actually the case I was thinking of when I said "brute forced".

Here's one possible scenario: let's say that I happened to be a member of a website that unfortunately allows an attacker to hit their login form as many times as they like and as fast as they like with various username/password combinations, and by brute forcing this login page in this way, they manage to determine what my username/password actually is. Now the attacker does know my username/password for one website I belong to and - if they're smart and determined - it may occur to them that now they know one of my usernames/passwords they might use these details as a starting point in trying to brute force other accounts that I may have on other websites.

I used to run these kinds of brute force attacks against websites back in the day when I had nothing better to do and before I had to work for a living. Often I was quite successful, but I wasn't targeting specific users and even back then I could tell that websites were getting more savvy in terms of detecting and defeating such attacks. So no doubt it would be harder to pull this kind of thing off now and it would probably depend a lot on which website(s) you targeted. But surely it wouldn't be impossible.

[1]…

> Sorry, but this is bull. If you take any information, even if it's an email and password, data security is either tops on your list or you're abusing your users (even "only a hundred"; one is too many!). There is literally zero middle ground on this: you do it or you shouldn't be building web applications

http://blog.moertel.com/articles/2006/12/15/never-store-passwords-in-a-database

Needless to say, almost 5 years have passed and they're still around :) their traffic probably a couple of orders of magnitude higher. I was there when it happened, and yes, probably some Russian hacker or whatnot has my password from there, but that's not such a big deal because reddit doesn't know my name, doesn't have my CC number or any details related to my life.

Now, were this to happen to a company that has a lot more information available about each and every one of us stored in one central place (think Google or FB), then things could get really nasty. And I'm not talking about stupid mistakes like the one from above, I'm talking about MITM attacks orchestrated by (vicious) Governments, or cyber-warfare, or just plain old NSA not having to bother to collect information from a myriad of places anymore, when they can just go directly to the source.

I follow the guidelines quoted below. I use an old electric kettle: not very fancy, you just plug it in and it boils the water. There's no temperature control settings, but there's no need: the water comes out about 92C, which is just right. Note that 175F=80C is not hot enough, it's "supposed" to be over 90C. But try it for yourself a couple of times and see if you can tell the difference.

I use a plastic pour-over filter and a manual burr grinder by Kyocera, which costs around U$25. I use coffee ground in the same day or in the previous day. In my experience this is what makes the biggest difference.

I usually buy beans at an import shop that has good turnout, so I know the beans are fresh. But last time I ended up buying at Starbucks and it was... awesome. Really.

If you follow these three guidelines and do nothing
more, you will enjoy coffee better than you can find
in most specialty coffee shops:

1. Buy only whole-bean coffee roasted within the last
few days.
2. Grind it fresh, just before brewing.
3. Brew it in a French press or a pour-over filter using
fresh water, off the boil.

http://blog.moertel.com/pages/coders-guide-to-coffee

http://blog.moertel.com/ does a decent job of explaining some practical aspects for de-recursivying, but I'll give you a basic explanation of that plus a more theoretical answer showing that any computatble function can be written using only while loops and a stack.

Practical:
If we right all of are programs and tail-recursive (returning a recursive call or constant at the end of the prgram) programs they are easy to transform into simple while loops with no stack. The idea is instead of calling another function just restart the current one with the updated arguments.

EX:

f(n,x)=f(n-1,x+1)
f(0,x)=x

goes to

while(n > 0){
n--;
x++
}

Other techniques such as trampolining and continuation passing style also help translate recursive functions into iterative ones.

Theorectical:
Think about Brainfuck or Turing machines, these computing frameworks can compute any computable function using only what amounts to while loops and infinite memory.

Given then that we can produce arbitrary control flow using only while loops, we can reproduce how recursive calls are computed in computers with stack frames (provided by our stack).