Author here: In our case the vendor was very proven, but the tech and their approach to it was not. What actually happened is a bit more complicated than _abandoned_, but those words got the point across without delving into the irrelevant.

Needless to say, I am _very_ leery now of the motives of open-source products that aren't run like open-source projects.

This is a point I was starting to make at the last segment of the piece, but my editor (also my wife) encouraged me to edit that down from 1500 words to what's there and break off the piece about the passionate versus the professional into a follow-up. From the feedback I've been getting, it seems to be something worth exploring.

This is the best thing that has ever been written on techcrunch.

While true, that doesn't really say much.

I'd wager PG is laughing all the way to the bank.

Yep, he once spammed it lot. Another one about Groupon http://rajeshanbiah.blogspot.com/2011/03/groupons-pr-possibl...

we've cleared the old SHA512-salted passwords out of our production database and have upgraded the password hashing to bcrypt, with a cost of 10.

Good call :)

Just in case anyone doesn't know why Bcrypt is so awesome, it's because it actually takes longer to hash (based on the difficulty level you set, and you can bump up the difficulty level as hardware gets more powerful).

For other applications, you want hashing to be fast. But for passwords, you want hashing to be as slow as possible without compromising user experience.

I wanted Lucas to link to Coda Hale's post on bcrypt (found by googling "Coda Hale bcrypt") in the blog post, but he edited that out. So it goes.

Zed Shaw: great troll, or greatest troll?