dual_sport_dork 🐧🗡️

Progenitor of the Weird Knife Wednesday feature column. Is “column” the right word? Anyway, apparently I also coined the Very Specific Object nomenclature now sporadically used in the 3D printing community. Yeah, that was me. This must be how Cory Doctorow feels all the time these days.

  • 162 Posts
  • 2.17K Comments
Joined 1 year ago
cake
Cake day: July 20th, 2023

help-circle

  • And TigerDirect also obtained the rights to the CompUSA name. That didn’t last long in the retail space either.

    In my town, TigerDirect resurrected the actual physical defunct CompUSA location and reopened it, and then that location tanked again shortly thereafter.

    Apropos of nothing, our long-abandoned Circuit City building is apparently finally being revamped into… An Aldi. For fuck’s sake.




  • You should probably have some safeguard to prevent jokers from uploading 14.2 gigabytes of absolute nonsense into your system’s password field just to see if they can make it crash. But I think limiting it to, like, 8 kB ought to be quite lenient for anything with a modern internet connection.

    As others have noticed, various hashing functions have an upperbound input length limit anyway. But I don’t see any pressing reason to limit your field length to exactly that, even if only not to reveal anything about what you might be feeding that value into behind the scenes.








  • That works great until some dickhole implements the old, “New password cannot contain any sequence from your previous (5) passwords.”

    This also of course necessitates storing (multiple successive!) passwords in plain text or with a reversible cipher, which is another stupid move. You’d think we’d have gotten all of this out of our collective system as a society by now, and yet I still see it all the time.

    All of these schemes are just security theater, and actively make the system in question less secure while accomplishing nothing other than berating and frustrating its users.




  • Don’t bug users to change passwords periodically. Only do it if there’s evidence of compromise.

    This is a big one. Especially in corporate environments where most of the users are, shall we say, not tech savvy. Forcing people to comply with byzantine incomprehensible password composition rules plus incessantly insisting that they change their password every 7/14/30 days to a new inscrutable string that looks like somebody sneezed in punctuation marks accomplishes nothing other than enticing everyone to just write their password down on a Post-It and stick it to their monitor or under their keyboard.

    Remember: Users do not care about passwords. From the perspective of anyone who isn’t a programmer or a security expert, passwords are just yet another exasperating roadblock some nerd keeps putting in front of them that is preventing them from doing whatever it is they were actually trying to do.


  • Who cares? It’s going to be hashed anyway. If the same user can generate the same input, it will result in the same hash. If another user can’t generate the same input, well, that’s really rather the point. And I can’t think of a single backend, language, or framework that doesn’t treat a single Unicode character as one character. Byte length of the character is irrelevant as long as you’re not doing something ridiculous like intentionally parsing your input in binary and blithely assuming that every character must be 8 bits in length.


  • Circuit City’s management made several consecutive catastrophic fuckups which ultimately led to the company’s demise. The most widely publicized one was firing all of their experienced staff and attempting to backfill all of those positions with minimum wage newbies. This obviously backfired spectacularly.

    They also dropped a stable, profitable high-margin product category (appliances) to focus on an unstable, low-margin category instead (TV’s and personal electronics).