4 ms·
Micromanagement to me is when the manager keeps asking too many questions that really don't matter. The decisions you are making seem reasonable. A developer s
by jtchang 15y ago
Micromanagement to me is when the manager keeps asking too many questions that really don't matter.
The decisions you are making seem reasonable. A developer should see this. I mean seriously...you are arguing about whether to hash passwords?! These days it is near mandatory and any framework/library will assume you are doing so. Django definitely does it by default (I personally replaced it with bcrypt). It would be MORE work to implement cleartext passwords.
- huxley 15y agoI agree totally, this is an area where frameworks should shine. I really like the approach Django 1.4 is taking. They have a new default hashing algorithm: PBKDF2, but they've also made it easy to choose your own. You can upgrade hashers at any time by changing the order of the PASSWORD_HASHERS setting, every password will be upgraded on a successful login. Using bcrypt is as simple as installing py-crypt and changing the top choice in the PASSWORD_HASHERS setting. Increasing the work factor for the hashing algorithm is also really easy to do so: create a subclass of the hashing algorithm you want to upgrade, set the multiple you want to increase the iterations by (say 100 times more), then add your subclass to the PASSWORD_HASHERS setting. Like you said, it is more work to implement cleartext passwords. Going back to the OP, when it comes to: "easier for us to pose as a user to duplicate problems" I'd say that in cases where you need to access a user's account, it's probably better to allow superusers or staff to "login as user" using a different mechanism than the normal password login/authentication.