11 ms·

That is the problem with limitations: they are hard to remove. I have the case where the character _ was invalid in project names. I have fixed the code to acce

That is the problem with limitations: they are hard to remove. I have the case where the character _ was invalid in project names. I have fixed the code to accept _ where it was invalid in first place. The problem is that other tools are now checking that project names do not contain _. How many tools in how many places? I do not know. The issue is not big enough to justify coordination of all the development teams to ensure that their code accept _ in project names. This limitation will probably never disappear.

tinalumfoil 9y ago
As hard as limitations are to remove, adding limitations later on is even harder. As a commenter above pointed out, bcrypt doesn't handle passwords longer than a certain length. Imagine you were moving from a hash without limit to one with a 16-chatacter limit. You would quickly wish you weren't so lenient on what passwords you accepted. The point is forcing reasonable limitations on people isn't always a bad thing.
- heavenlyblue 9y ago
  I understand a limit of 1K characters for a password, but I will never understand a limit of 16.
  - romwell 9y ago
    Just to illustrate, the "horse battery staple correct"[1] - type passwords won't fit into 16 characters - and I can type that faster than QuyigGiX_07~! - type nonsense that most websites require. Add to that the wonderful restrictions (oh, Citi doesn't like special characters that are too special, so QuyigGiX-07! it must be, etc), and you have a guarantee for frustration. I guess it all comes down to the fact that people aren't going to stop using a service because the password UX is horrible - especially given that it's nearly uniformly horrible elsewhere. [1]https://xkcd.com/936/ https://xkcd.com/936/
    - dogma1138 9y ago
      Both passwords are just as practically secure against online attacks with the former being less secure against modern password cracking attacks. A passphrase without any substitutions has words as atomics while languages have a very large number of words commonly used words offer a much more limited search space. So say a 4 word passphrase of 4-8 letter words in the English language when limited to the top 5000 common words isn’t secure against offline attacks by any stretch of the imagination nor does it actually provide its level of entropy because you are no longer using individual characters as your atoms. The latter password is essentially much more secure as it’s atoms are individual characters. The former has an advantage which makes it easier to remember and faster to type. So yes XKCD doesn’t get it always right.
  - dfee 9y ago
    Wait until I debut my password management service that converts a yoddle into an ascii string. That’ll certainly be more than 1000 chars. Our mutual customers will be disappointed when they can’t login to your sites.

tinalumfoil 9y ago

As hard as limitations are to remove, adding limitations later on is even harder. As a commenter above pointed out, bcrypt doesn't handle passwords longer than a certain length. Imagine you were moving from a hash without limit to one with a 16-chatacter limit. You would quickly wish you weren't so lenient on what passwords you accepted. The point is forcing reasonable limitations on people isn't always a bad thing.

heavenlyblue 9y ago
I understand a limit of 1K characters for a password, but I will never understand a limit of 16.
- romwell 9y ago
  Just to illustrate, the "horse battery staple correct"[1] - type passwords won't fit into 16 characters - and I can type that faster than QuyigGiX_07~! - type nonsense that most websites require. Add to that the wonderful restrictions (oh, Citi doesn't like special characters that are too special, so QuyigGiX-07! it must be, etc), and you have a guarantee for frustration. I guess it all comes down to the fact that people aren't going to stop using a service because the password UX is horrible - especially given that it's nearly uniformly horrible elsewhere. [1]https://xkcd.com/936/ https://xkcd.com/936/
  - dogma1138 9y ago
    Both passwords are just as practically secure against online attacks with the former being less secure against modern password cracking attacks. A passphrase without any substitutions has words as atomics while languages have a very large number of words commonly used words offer a much more limited search space. So say a 4 word passphrase of 4-8 letter words in the English language when limited to the top 5000 common words isn’t secure against offline attacks by any stretch of the imagination nor does it actually provide its level of entropy because you are no longer using individual characters as your atoms. The latter password is essentially much more secure as it’s atoms are individual characters. The former has an advantage which makes it easier to remember and faster to type. So yes XKCD doesn’t get it always right.
- dfee 9y ago
  Wait until I debut my password management service that converts a yoddle into an ascii string. That’ll certainly be more than 1000 chars. Our mutual customers will be disappointed when they can’t login to your sites.