3 ms·

If an organization has such a password policy, that can be interpreted as the person in charge of setting this policy thinks their organization doesn't have eno

If an organization has such a password policy, that can be interpreted as the person in charge of setting this policy thinks their organization doesn't have enough people with the competence and organizational power to prevent SQL injection vulnerabilities. Which would reflect poorly on any institution, but especially a university (which should be a bastion of people with competence and organizational power). As for common password advise, my take on your argument would be that we should all be using these keywords in our passwords to quickly surface these bugs, lest they be hidden and only used by attackers.

patrakov 3y ago
It can be interpreted as you suggest, but does not necessarily come from the person in charge. It might mean that auditors forced the installation of a WAF because of $REGULATIONS (irrespective of the actual code quality) and refused to allow weakening the rules for password fields. EDIT: as they don't actually check for all the banned strings, the "auditor + mandatory misconfigured WAF" hypothesis expressed above is not valid in this case. But let it stay as an otherwise-plausible explanation, or maybe something that was valid in the past.
- wongarsu 3y ago
  The WAF hypothesis still holds if you assume the password change page is governed by the same WAF. The WAF would reject any new password it finds offensive, and the "rule" about not using certain SQL keywords just matches people's fuzzy understanding of why these passwords are rejected. It was probably even true, a couple WAF rule updates ago.
civilized 3y ago
Counterpoint - however pathetic it may be, it's better that they publicly owned up to their lack of confidence in this way. The question is, what do we do about it once we see something like that?
- wkat4242 3y ago
  > The question is, what do we do about it once we see something like that? Run away and stay as far away from their products and services as possible.
  - danesparza 3y ago
    It's a university
    - wkat4242 3y ago
      Ok don't go there to study CS :)
SoftTalker 3y ago
> especially a university (which should be a bastion of people with competence and organizational power) Generally the opposite. University staff positions pay pretty poorly compared to what the most competent people can earn elsewhere. There are some bright staff people at universities who are there for other reasons besides the pay, but the competence of an average university staff software developer is not great. This is also why over the past two decades universities have trended to SaaS subscriptions rather than building software in-house
- cbsmith 3y ago
  Yeah, there's very much a "cobbler's children have the worst shoes" aspect of this that some people don't get.
mkl 3y ago
> especially a university (which should be a bastion of people with competence and organizational power). Those people are not the ones running the IT systems. Even the software engineering and information systems departments have no say. IME university IT are understaffed, outsource a lot (often without a choice), and often have to follow decrees from higher management that don't seem to have been thought through.

patrakov 3y ago

It can be interpreted as you suggest, but does not necessarily come from the person in charge. It might mean that auditors forced the installation of a WAF because of $REGULATIONS (irrespective of the actual code quality) and refused to allow weakening the rules for password fields. EDIT: as they don't actually check for all the banned strings, the "auditor + mandatory misconfigured WAF" hypothesis expressed above is not valid in this case. But let it stay as an otherwise-plausible explanation, or maybe something that was valid in the past.

wongarsu 3y ago
The WAF hypothesis still holds if you assume the password change page is governed by the same WAF. The WAF would reject any new password it finds offensive, and the "rule" about not using certain SQL keywords just matches people's fuzzy understanding of why these passwords are rejected. It was probably even true, a couple WAF rule updates ago.

civilized 3y ago

Counterpoint - however pathetic it may be, it's better that they publicly owned up to their lack of confidence in this way. The question is, what do we do about it once we see something like that?

wkat4242 3y ago
> The question is, what do we do about it once we see something like that? Run away and stay as far away from their products and services as possible.
- danesparza 3y ago
  It's a university
  - wkat4242 3y ago
    Ok don't go there to study CS :)

SoftTalker 3y ago

> especially a university (which should be a bastion of people with competence and organizational power) Generally the opposite. University staff positions pay pretty poorly compared to what the most competent people can earn elsewhere. There are some bright staff people at universities who are there for other reasons besides the pay, but the competence of an average university staff software developer is not great. This is also why over the past two decades universities have trended to SaaS subscriptions rather than building software in-house

cbsmith 3y ago
Yeah, there's very much a "cobbler's children have the worst shoes" aspect of this that some people don't get.

mkl 3y ago

> especially a university (which should be a bastion of people with competence and organizational power). Those people are not the ones running the IT systems. Even the software engineering and information systems departments have no say. IME university IT are understaffed, outsource a lot (often without a choice), and often have to follow decrees from higher management that don't seem to have been thought through.