3 ms·
A standard API with sane defaults is an excellent idea for a language with so many developers of varying competencies.
by Kudos 14y ago
A standard API with sane defaults is an excellent idea for a language with so many developers of varying competencies.
- romaniv 14y agoConsidering that this will make password-related code much shorter and more readable, I think it's a good idea regardless of what level of competence you expect from the developers.
- underdown 14y agoI'll take "more secure" over short and readable any day.
- Kudos 14y agoIn some cases short and readable ends up as "more secure" by virtue of being implemented correctly.
- ErrantX 14y agoOr in this case; short and readable is more secure because attack vectors, like generation of salts, are wrapped inside the new API.
- regularfry 14y agoThere are two ways of constructing a software design: One way is to make it so simple that there are obviously no deficiencies, and the other way is to make it so complicated that there are no obvious deficiencies. - C. A. R. Hoare
- FuzzyDunlop 14y agoIndeed. Of course all the sane defaults in the world won't stop someone copying and pasting shit like this from a dodgy tutorial: $password = mysql_query("SELECT password FROM users WHERE email = ".$_POST['email']." LIMIT 1"); To clarify this to the downvoters who chose not to comment: The finest password hashing algorithm ever committed to source control won't protect your other sensitive information (address, phone numbers, etc.) when SQL injection can make your entire database vulnerable to attack.
- Kudos 14y agoYes, but there's a greater chance that basic tutorials that for example use unsalted sha1 will use this method instead. It's just as simple for a beginner to grok, but secure by default.
- ErrantX 14y agoThe code he posted has different vulnerability; i.e. SQL injection. Your password could be ultra-secure, but it doesn't matter if you use that code without sanitizing inputs :) I guess the reason he is being downvoted is; badly hashed passwords are not merely a newbie problem...
- Kudos 14y agoSQLi a different though related issue so I reframed it with an example that this solves.
- tlrobinson 14y agoI'd say it's an excellent idea for every language.
- Kudos 14y agoI agree, so much so that I started working on something for Python after seeing this.