#musicbrainz-devel

yay, we have a nice distributed bcrypt hasher now

now if only we had an ec2 account and hundreds of machines to distribute it over :P

heh

running it in one script would take about 8 hours with the current cost I'm using, so instead I stick all the usernames in a pgq and the script iterates that queue

how much work are we requiring? (assuming this is for the plaintext password bit)

cost factor is 8 atm

we can ramp that up later if we need

8 hashes about 3 passwords/second on my laptop

oof

and also nearly melts it

we'll probably want that higher then IMO, but it'll do for the first pass

I don't think we want it much higher than that

understanding the "we're not a bank" caveat, the recommendation for really really good security is for it to do more like 1/2 a hash per second

omfg a new pope. they like the white smoke out of the sistine chapel.

haha

haha

*let

ianmcorvidae: you want users to wait two seconds to login?

i mean, i get the tradeoff, but essentially you move password security to a new DoS attack point :P

haha

I guess my point is also that your laptop is not as beefy as our servers, either

note that we might want basic authentication in the future, which means you make the WS take 2 seconds for authenticated calls

ah, true, hm

my laptop is 3GHz and seeing as this is almost entirely cpu bound it's not that much out

I guess that makes oauth look better for people, but obviously that's not the point here ;)

okay, okay

I really wouldn't go higher than 8. a cost of 2 is really enough to make me happy, and 8 shows we have really done due diligence :)

but i still have more work to do anyway, but proof of concept is looking good

whoo :)

plan is to fire up the hashing worker which will hash into a `bcrypt` column in editor, along with triggers to catch editors who change their password in the meantime. then at upgrade time, we can flip the columns and almost atomically roll this out

I have some more schema change work ready to share, but I still can't push to bitbucket because it won't accept my key

if support don't reply tomorrow i'll make a temporary new key

ruaok, warp: http://i.imgur.com/87lEfme.png

lol

haha

hah

ocharles: pm!

in the post.

haha

:(

lol

man, I don't remember the last time I received a cheque

heh

I was paid by cheque when I was doing translation

It sucks :(

I prefer it to paypal, for sure

direct deposit is best, but

Heh, yeah

Once they wrote my name wrong

On the envelope

And the thing sat there because the post office refused to give it to me :p

I don't think cheques exist anymore here.

Luckily I didn't need the money fast...

I remember "Eurocheques" being popular when I was a teenager, but those have not been issued since 2002.

ianmcorvidae: bitcoins!

i'm not sure i'm ready to be paid my living wages in bitcoins just yet :)

haha

ocharles: likewise.

I'd probably be okay with it with a very quick dump to USD (coinbase has a setting for daily payouts)

but daily might not be quite fast enough given how volatile bitcoin can be

Maybe not the living wages, but a percentage might be interesting :p

I recently read this thread about the block size being reached or something

ah, the 0.7-incompatible block?

... there are still some technical issues they need to solve

yeah

ianmcorvidae: the thread consisted mostly about people complaining that SatoshiDice is spamming the blockchain and people claiming that if we cannot even take that little amount of spamming bitcoin is not ready for mainstream.

for those following along who don't read things about bitcoin on hacker news or such: 0.8 changed the DB format, which allowed blocks to be bigger than before, which meant some miner or another found a block that was too big to work with 0.7, which means there's now two block chains

haha

warp: it's a fair critiscm I think

I think that my take on bitcoin for payment would be

it's nice that it can handle it, but should it have happened in the first place?

I'd be perfectly happy to be paid in bitcoin for as much as metabrainz foundation actually *gets* in bitcoin (once I implement that)

which is presumably less than $10/month, so :P

i'd take a share of them too, up to a limit

yeah

certainly not entire paychecks though :)

:)

ocharles: which side is fair criticism?

warp: it doesn't sound like sides from what you say? You can certainly complain about spamming *and* think it should be dealt with better at the same time :p

warp: that if it can easily be derailed by another blockchain, it might not be ready for prime time

ocharles: the SatoshiDice stuff is not about another blockchain, it is just that one .. agent? is responsible for a relatively large chunk of the total transactions per time unit.

oh, i guess i'm not familiar with that then

reosarevok: ping

ruaok, pong

so, wanna move the blog over?

Do we have a style now?

oh, right.

damn.

heh

lets look for a simple theme we can just very minor tweaks to.

well we did that last time, we need to package it up properly - i think that's the main pain point

the theme we have is just a tweaked vanilla wordpress theme

I hate picking themes. :(

heh

navap, do you have any time to look into this? :)

fwiw i am also against gravatar strongly

and wishi could totally turn it off, just not only on my own

/not see others etc

New post: blog: Server update, 2013-02-11 and an important notice regarding edits <http://blog.musicbrainz.org/?p=1784>;

heh

not really

just fixed it, it had said 03-11 :P

Uhm...

Oh.

Silly February.

yup :)

Having the same date-weekday mapping as March. :|

warp: read your email.

ruaok: if you're referring to ian' code review mail, then I already did \o/

(but I'm giving it some thought before replying)

Could someone give some answers to this Turkish woman who posted to -devel yesterday?

I have no idea what to answer. Since she mentioned Python, maybe Freso wants to look at it?

I'll try and cook up something.

reosarevok: Sending now.

Freso: awesome, thanks!

I wonder if it would make sense to publish some blog posts pretty much like that email

cool!

I've been wanting soemthing like shiva for ages.

"So you want to do MB-related stuff with language X! Here you have options"

shouldn't that basically be on the wiki in the "how to contribute" section?

ruaok: Not so cool that they didn't think they should incorporate MB from the get-go, instead of Last.fm. :|

Well, all tools are mentioned in the wiki, but not "sorted by language"

yeah :/

fetch by mbid is the KILLER feature.

esp if you can aggregate collections.

ianmcorvidae: that was my original idea, it's just that it seems like it would be more easily found in the blog

maybe we could make a wiki page that doesn't suck, and then write a blog post based on it.