3 ms·
Probably because of this. A bunch of coders get into a meeting with a bunch of managers, passwords and security come up, it's a bike shed issue, so everyone thr
by fleitz 16y ago
Probably because of this. A bunch of coders get into a meeting with a bunch of managers, passwords and security come up, it's a bike shed issue, so everyone throws their two cents in.
Some guy saw something break once because a password with a space was passed on exec().
Some guy knows that crypt() only uses the first 13 characters.
Some guy knows that passwords with less than 5 characters are extremely weak.
Some guy knows that \ also breaks when passed to exec() or sh, etc.
This goes on ad nauseum for about an hour, a bunch of people are bored and just want to get out of the meeting so they propose the following which everyone can agree on.
Spec: Alphanumeric passwords with a minimum of 5 characters and a maximum of 13.
Result: m/^[A-Z,0-9,a-z]{5,13}$/
- ericd 16y agoI love your story on this. Someone should write/compile a book of stories like this for every stupid "Best Practice" in programming and web design.
- napierzaza 16y agoIt's not so stupid but pragmatic. It sounds like those errors are the types of which are whispy and hard to track down. Thankfully at this point we're all pretty familiar with that type of standard and abide almost automatically. But I hate you if you force me to have capitals or numbers or symbols!
- fleitz 16y agoYeah, but there isn't enough money in the world to make me want to go back to developing "enterprise" software. Let alone document its development.