MySpace security FAIL

Friday 29th May, 2009

MySpace store users original passwords in clear-text, and return them by email on request. Enough said really. FAIL.

For reference purposes, there are better ways to do this:

One step better: don’t return the original password (potentially revealing additional information to an attacker), just create a generated one or a one-off link that allows a new one to be created by the user.

Two steps better: don’t store the original password at all, store a one-way hash instead, that way even an attacker who compromises the DB can’t see it (assuming you do it right).

Open Source Search Social

Thursday 28th May, 2009

Following on from the undeniably interesting Search/Lucene social in London last month we’re organising another one… this time broadening the scope a little to other OS search projects and related geekery… Solr, Hadoop, Mahout, etc.

We’re meeting up on Monday the 15th of June, at The Pelican pub (nearest tube Westbourne Park).

If you’re working in the search field and fancy an informal chat then come along. Please sign up on Upcoming or drop me a line if you fancy coming along.

Update 28th May, 16:19:- Added Upcoming link

Tenuous link between economics and technology, via sociology

Monday 18th May, 2009

flatironThis morning I read yet another article about why people failed to predict the recent economic turbulence. What baffles me most about it is that I, and many others, knew exactly what was going to happen long before it did. I think the real reason most people failed to predict the crash was that they were blinded by the false security of the herd.

All the classic signs of a bubble were in place:

  • Rapidly increasing asset values
  • Commercial purchases based on future asset gains rather than realistic inc0me (i.e. rent was not increasing along with house prices)
  • The inability of intelligent people to comprehend prices going down (it sounds nuts now, but I heard this opinion so many times my skepticism gland was bled dry and red raw)

The last point is particularly pertinent I think. When participants in a market cannot accept that market prices go both up and down then you know that you’re looking at hysteria at work. All of this is described quite clearly in many books on the subject including Bubbles and How to Survive Them, by John Calverley (Chief Economist & Strategist at American Express) which described the problem long before it happened.

The tenuous tech link

Sometimes it’s hard to go against the grain, like the fund managers fired from their jobs during the Dot Com boom because they sensibly realised that tech stocks were overvalued and pulled their clients out (it’s ironic that “Cassandra” is used to put down those that predict disasters, since Cassandra’s predictions were spot-on).

In the same vein I think it’s sometimes hard to speak out against current trends in terms of development processes, or common wisdom. There are some development teams where criticism of Agile or Scrum would earn you a slow death, bound with CAT45 cable and locked in a server cage. I’ve been at the receiving end of group-think like this myself; I was once reprimanded and sidelined for being generally a bit too quick to suggest open source tools to Microsoft-centric developers. The spread of knowledge is sometimes uncomfortable.

It’s an uphill struggle but for technologists, just as for economists, we have to try and push back against our instinct for the herd-mentality.

Refine by colour and price on Empora

Wednesday 13th May, 2009

New YorkLast week we launched a new feature on Empora, the ability to refine a search by various factors. You can now search through our retailers’ products by colour and price, as well as what came before.

This brings Empora much more closely into line with what people expect from a modern shopping site; the ability for users to define and refine the parameters of their search.

Faceted search, or faceted navigation like this is really now the established standard for enterprise search, and seems to keep threatening to break into the mainstream search market in the guise of clustered or “semantic” search engines. Even Google is starting to tread into the mainstream faceting, as you can see from this search for cheese reviews in the past 24 hours.

Faceted search seems like it’s here to stay.