[Catalyst] Re: Outcome of the Security issue with hashed passwords in C:P:A:Password?

2010-04-09 Thread Daniel Pittman
Andrew Rodland and...@cleverdomain.org writes: On Thursday 08 April 2010 08:12:24 pm Toby Corkindale wrote: On 08/04/10 22:49, Daniel Pittman wrote: ...but your lost database *also* exposed user account/password pairs, which can now be tried against other services, since people usually use

[Catalyst] More Application or More Controllers

2010-04-09 Thread Amit Jha
Hi, Can any body help me on finding out a best way: I am planning to build an application on catalyst. I have 3 different module 1. Admin Utility. 2. Search Utility. 3. Index List Utility. All modules have lots of jobs to perform. My question is to create a separate catalyst app for each and

Re: [Catalyst] Distributing and updating Cat apps

2010-04-09 Thread Bill Moseley
On Thu, Apr 1, 2010 at 12:51 AM, Toby Corkindale toby.corkind...@strategicdata.com.au wrote: We package things up into Debian-style packages, and then upload those to a local repository of packages. Then servers can just be updated using the standard system tools (apt). Hi Toby, This is

Re: [Catalyst] Outcome of the Security issue with hashed passwords in C:P:A:Password?

2010-04-09 Thread Mark Blackman
On 9 Apr 2010, at 02:58, Evan Carroll wrote: I already patched this with a fix, it is on github and I've linked to it and posted it on rt. Janus told me he would give me maintenance to post it on CPAN, and he hasn't followed through yet. It fixes the problem by permitting you to pull in a

Re: [Catalyst] Outcome of the Security issue with hashed passwords in C:P:A:Password?

2010-04-09 Thread Evan Carroll
As far as I can tell, the whole point of this patch is aimed at the 'hashed' password case only (rather than 'salted_hash'). The vulnerability was never against salted_hash. I've since learned what Crypt::SaltedHash is I just don't believe I have a reason to use it. Why would I want to use

Re: [Catalyst] Outcome of the Security issue with hashed passwords in C:P:A:Password?

2010-04-09 Thread J. Shirley
On Fri, Apr 9, 2010 at 12:53 AM, Tomas Doran bobtf...@bobtfish.net wrote: On 9 Apr 2010, at 03:05, Evan Carroll wrote: http://github.com/EvanCarroll/Catalyst-Plugin-Authentication Anyway, that's the repo -- Find the commits here:

Re: [Catalyst] Outcome of the Security issue with hashed passwords in C:P:A:Password?

2010-04-09 Thread Evan Carroll
This is actually a very unhelpful way to supply patches, as it makes the maintainer have to do a whole chunk of work to get as your patch. As such, given limited time, I haven't looked.. Here is the patch range for review:

Re: [Catalyst] Outcome of the Security issue with hashed passwords in C:P:A:Password?

2010-04-09 Thread J. Shirley
On Fri, Apr 9, 2010 at 8:51 AM, Evan Carroll li...@evancarroll.com wrote: Without any unnecessary commentary, here is the implementation of the password_(pre|post)_salt_field, without other features that should be patched separately. http://codepeek.com/paste/4bbf456c0ae3049443a742a2 I

Re: [Catalyst] Distributing and updating Cat apps

2010-04-09 Thread Bogdan Lucaciu
On Fri, Apr 9, 2010 at 4:11 PM, Bill Moseley mose...@hank.org wrote: On Thu, Apr 1, 2010 at 12:51 AM, Toby Corkindale toby.corkind...@strategicdata.com.au wrote: We package things up into Debian-style packages, and then upload those to a local repository of packages. Then servers can just

Re: [Catalyst] Distributing and updating Cat apps

2010-04-09 Thread Peter Karman
Bogdan Lucaciu wrote on 4/9/10 2:10 PM: To properly include the templates I would just use something like: View::TT INCLUDE_PATH = __path_to(root)__ ... or similar. The static content lives in /usr/share/perl5/Dist/Name/root/static, if you use a caching reverse proxy (like