Quote from: MemCiD on September 18, 2014, 05:28:09 PM

Quote from: NuShrike on September 18, 2014, 05:25:57 PM

Quote from: suchmoon on September 18, 2014, 03:56:05 PM

And how about those security issues alluded to in the announcement yesterday. I hope they just dumbed it down for PR, but it sounded like the solution was to reduce the session timeout. I don't see how that fixes anything, because it looked like it was allowing access to accounts without validating the session/auth cookie on the server side. Either way it doesn't speak well for their development and QA practices not to mention deposit security (#6 in the OP).

Agreed. It should've involved more than just session-timeouts. Changing IP should've broken the trust-chain as well as a number of other factors. Transferring ownership should've reset "all" session-cookies ...

Best practices -- they're all out there, but greed prevents the necessary on-going research.

They have $9,000,000 to throw around but can't fix a site that gives you the illusion of mining?
They probably don't want to pay for real coders as the coders will realize that they're running something illegal.

Notch made $500.000.000 out of Minecraft (before the sale of Mojang) and it's still a buggy piece of shit, I wouldn't accept that as a valid argument.