Don't log usernames for bad logins
This used to be widely understood around Unix, but it's evidentlyslipped from common knowledge over time:
It's a mistake to log nonexistent usernames on bad logins .
(Corollary: it is an especially bad mistake to log them by default.)
To illustrate why I say this, let me tell you what happened tome recently. I normally leave myself logged in to my officeworkstation with the screen locked and blanked. This weekend, my officeworkstation crashed and rebooted because of some ongoing issues ; as
是日金句090224
A core principle of error and warning messages
Here is a core principle of how and when programs should show error andwarning messages of all sorts:
Error messages should only go to the people who can do somethingabout them.
This goes double for warning messages.
(Sometimes you don't have a choice, at least in theory; if your programsuffers a fatal error and you have nowhere else to log it, dumping it onthe user does some moderate amount of good. Maybe.)
There's two reasons to be careful where your error messages
無題
人為什麼要進入那個幻境裡面，如果，他
非常準的測驗
【困局型】 對於感情的渴望讓理性的頭腦陷入了困局之中。
打蛇
這是一部我想像不到的核突電影，故事講80年三名非法入境者偷渡到香港時，被“打蛇集團”所捕，原來“打蛇”的
A problem with microtransactions
One corollary of Internet scale security is topoint out a lurking issue with microtransactions (one of the perennialInternet enthusiasms in some quarters). The problem is how you handleauthorizing microtransactions.
If you prompt the user every time they spend a cent, I think it's verylike that people will rapidly find this far too annoying and stop usingmicrotransactions at all. If you do not require the user to authorizetransactions you open yourself (and the user) up to attacks wherethe user's browser or other