codahale.com٭blog

Headed to RailsConf

Just a general ping: I’m headed to RailsConf on Wednesday.

I look like this:

If I’ve had coffee, my eyes’ll be a bit wider, and I’ll be yelling things about rails-core and patches. If I’m sleepy, uh, I’ll squint and grumble. Here’s my day-time ticket.

So yeah, yell at me, or buy me a drink or something.

bcrypt-ruby 2.0.0 is out

Just a quick note, I just released bcrypt-ruby 2.0.0, featuring some refactored goodness.

http://bcrypt-ruby.rubyforge.org

sfearthquakes = Twitter + Earthquakes

So, we’ve had some earthquakes in the SF Bay Area recently. Nothing big, but certainly big enough to prompt hundreds of Twitter users to chip in about the last earthquake.

So what did I do?

I went and wrote a Twitter bot to scrape the USGS website and post the results to Twitter.

Voila: sfearthquakes.

The best part? It’s hosted in Texas, so when the big one hits, it’ll still be able to chip in.

bcrypt-ruby: Secure Password Hashing

The Problem

So you remember how Reddit got a backup copy of their database stolen? Do you also remember how, since they stored users’ passwords as plain text, the hacker also got a big list of people’s email addresses and their passwords?

That’s bad. How can you avoid that?

Using bcrypt-ruby

Check out my new gem: bcrypt-ruby.

To install:

sudo gem install bcrypt-ruby

(make sure you have a C compiler and OpenSSL)

To use:

require 'bcrypt'

my_password = BCrypt::Password.create("my password") #=> "$2a$10$vI8aWBnW3fID.ZQ4/zo1G.q1lRps.9cGLcZEiGDMVr5yUP1KUOYTa"

my_password.version              #=> "2a"
my_password.cost                 #=> 10
my_password == "my password"     #=> true
my_password == "not my password" #=> false

my_password = BCrypt::Password.new("$2a$10$vI8aWBnW3fID.ZQ4/zo1G.q1lRps.9cGLcZEiGDMVr5yUP1KUOYTa")
my_password == "my password"     #=> true
my_password == "not my password" #=> false

What’s bcrypt?

bcrypt() is the password hashing algorithm used by OpenBSD.

It’s awesome because:

• Developed by The OpenBSD Project specifically for hashing passwords. They don’t screw around with security.
• Salts are automatically generated and managed for you.
• It’s orders of magnitude harder to crack than MD5, SHA2, and other standard hash algorithms.
• It has a cost parameter which allows you to ratchet up the computational expense of checking a password — it can be low for low security situations or high for high security situations.

So don’t get caught with your pants down — be professional.

Send As IM = Adium + Quicksilver

I am now officially in the process of making everything I do Quicksilver-friendly. This round: Adium. The Adium plugin for Quicksilver has been dead since ß36, which means we have to click on things to send IMs. Until now.

The upshot? Cmd+Space, period, “Contact name: Message”, tab, S, enter.

First, The Script

using terms from application "Quicksilver"
  on process text im_text
    repeat with im_delimiter_position from 1 to (length of im_text)
      if character im_delimiter_position of im_text = ":" then exit repeat
    end repeat
    set im_contact_name to characters 1 thru (im_delimiter_position - 1) of im_text as string
    set im_message to characters (im_delimiter_position + 2) thru (length of im_text) of im_text as string
    tell application "Adium"
      send (first contact whose (online is true and (display name starts with im_contact_name or UID starts with im_contact_name))) message im_message
    end tell
    return nothing
  end process text
end using terms from

Second, Installing It

Paste the script into Script Editor and save it in ~/Library/Application Support/Quicksilver/Actions as Send As IM.scpt.

Restart Quicksilver (Cmd+Ctrl+Q).

Third, Using It

Open up Quicksilver (either Ctrl+Space or Cmd+Space), and hit period. Type your message in the following format: “Contact name: message body.” (e.g., “Bob: Hey man, what’s up?”). Hit tab when you’re done. Type out as much of “Send As IM” as you need to select the Send As IM action. Hit enter. Done!

Send As IM finds the first online contact on your buddy list whose display name or screen name starts with what you entered as the contact name. If you’re not already chatting with them, it’ll open up a new chat window and send your message. If you’re already chatting with them, it’ll use the existing window.

Ok… now what else do I use the mouse for?