Headed to RailsConf

Just a general ping: I’m headed to RailsConf on Wednesday.

I look like this:

If I’ve had coffee, my eyes’ll be a bit wider, and I’ll be yelling things about rails-core and patches. If I’m sleepy, uh, I’ll squint and grumble. Here’s my day-time ticket.

So yeah, yell at me, or buy me a drink or something.

bcrypt-ruby 2.0.0 is out

Just a quick note, I just released bcrypt-ruby 2.0.0, featuring some refactored goodness.

http://bcrypt-ruby.rubyforge.org

sfearthquakes = Twitter + Earthquakes

So, we’ve had some earthquakes in the SF Bay Area recently. Nothing big, but certainly big enough to prompt hundreds of Twitter users to chip in about the last earthquake.

So what did I do?

I went and wrote a Twitter bot to scrape the USGS website and post the results to Twitter.

Voila: sfearthquakes.

The best part? It’s hosted in Texas, so when the big one hits, it’ll still be able to chip in.

bcrypt-ruby: Secure Password Hashing

The Problem

So you remember how Reddit got a backup copy of their database stolen? Do you also remember how, since they stored users’ passwords as plain text, the hacker also got a big list of people’s email addresses and their passwords?

That’s bad. How can you avoid that?

Using bcrypt-ruby

Check out my new gem: bcrypt-ruby.

To install:

sudo gem install bcrypt-ruby

(make sure you have a C compiler and OpenSSL)

To use:

require 'bcrypt'

my_password = BCrypt::Password.create("my password") #=> "$2a$10$vI8aWBnW3fID.ZQ4/zo1G.q1lRps.9cGLcZEiGDMVr5yUP1KUOYTa"

my_password.version              #=> "2a"
my_password.cost                 #=> 10
my_password == "my password"     #=> true
my_password == "not my password" #=> false

my_password = BCrypt::Password.new("$2a$10$vI8aWBnW3fID.ZQ4/zo1G.q1lRps.9cGLcZEiGDMVr5yUP1KUOYTa")
my_password == "my password"     #=> true
my_password == "not my password" #=> false

What’s bcrypt?

bcrypt() is the password hashing algorithm used by OpenBSD.

It’s awesome because:

• Developed by The OpenBSD Project specifically for hashing passwords. They don’t screw around with security.
• Salts are automatically generated and managed for you.
• It’s orders of magnitude harder to crack than MD5, SHA2, and other standard hash algorithms.
• It has a cost parameter which allows you to ratchet up the computational expense of checking a password — it can be low for low security situations or high for high security situations.

So don’t get caught with your pants down — be professional.

WE DONE LAUNCHED

Guess who’s live?

Take control of your money, find the best values in your area, and reach your financial goals by joining the Wesabe community.