On: Why the password "this is fun" is 10 times more se...

[asharp]

Not particularly. An attack that leaves the attacker with password hashes is rare, as opposed to regular "brute force" attacks of various flavours.

[queensnake → asharp]

(Couldn't a hacker have 500 connections and, though trying each only every 5 secs as permitted, still get 100/s overall?)

[asharp → queensnake]

Only in the case of a very badly configured server.