3 ms·
Very nice job. Once I hit 500 karma or my account is a year old, I might be able to get some use out of this. :)
by ltamake 15y ago
Very nice job. Once I hit 500 karma or my account is a year old, I might be able to get some use out of this. :)
- jgrahamc 15y agoNo point having the magic string polluting your profile here for the time being. You only need it the first time you submit.
- SwellJoe 15y agoNitpick mode: Beyond "pollution", the magic string is subject to race conditions. If someone puts it in the profile, and then waits a while to register, anyone could claim that username. Sure, it's a somewhat unlikely scenario...but pretty easy to exploit if someone forgets they have the magic string in their profile but haven't yet registered. A unique magic string per-user would be the solution to that.
- StavrosK 15y agoNot really, it's public. If someone wants your username, they can just look at the magic string in your profile and register it if you haven't.
- SwellJoe 15y agoThat's true, but Google can find profiles with the magic string, and one could even go so far as script finding the names that haven't been registered. A unique magic string, only generated during account creation, at least means you have to crawl HN yourself, and pull out those strings via some regex (which could be thwarted by making the magic string unpredictable in length and format), and do so in a very small period of time. I'm sure it's not really likely that any of those scenarios would happen...but it seemed an odd bit of security theater, which could at least be made a bit more secure by adding a dose of randomness.
- ltamake 15y agoI reserved my name.