3 ms·
I learned long ago in programming that setting arbitrary limits seems simpler to code, but in the end it is more work. You need to deal with error messages, err
by skookumchuck 9y ago
I learned long ago in programming that setting arbitrary limits seems simpler to code, but in the end it is more work. You need to deal with error messages, error recovery, user instructions, and complaints from users. It's so much simpler to just allocate memory for whatever size the data happens to be.
Then, you just have to deal with one generic "out of memory" situation.
- MichaelGG 9y agoSo on a modern machine that might mean a user can submit a 1GB password?
- Klathmon 9y agoYour server should still have POST size limitations and other limits to prevent DoS.
- cdancette 9y agoI'm not sure relying on max POST size for password length is a good practice. It would be hell to debug without a good documentation.
- skookumchuck 9y ago> max POST size [...] hell to debug [...] As I was saying :-)
- cmccart 9y agoFor inputs that are going to get hashed that seems reasonable, as well as for single-purpose systems. On the flipside, this seems like a great way to have unintended consequences downstream in more complex systems. That "out of memory" condition may appear as an ephemeral bug or slowdown that surfaces not at input time but at retrieval by another service.