6 ms·

Adobe says that they've followed best practices for password storage and protection for more than a year now... 13 generations of photoshop ...and they're jus

by 001sky 13y ago

Adobe says that they've followed best practices for password storage and protection for more than a year now... 13 generations of photoshop ...and they're just getting around to this after CS6?

nwh 13y ago
I wouldn't call Photoshop an achievement, it's a hodgepodge of old libraries and bugs at the best of times. Adobe refused to patch a vulnerability in CS5 at one point, telling people to purchase and upgrade to CS6 (US$199) if they wanted to not be vulnerable to malicious code execution. In response to the uproar they eventually backported the patch. [0]: http://www.macworld.com/article/1166779/adobe_will_issue_free_security_patches_for_high_profile_creative_suite_apps.html http://www.macworld.com/article/1166779/adobe_will_issue_fre...
- scotth 13y ago
  Not a constructive comment, sorry, but I couldn't help chuckle reading this. It's beyond ridiculous.
  - null_ptr 13y ago
    Mammoth corporations have fuck-all to do with common sense. They're run by apathetic shills that couldn't care less about technology, progress, or people (not to knock the talent that works in the trenches).
- smtddr 13y ago
  If Photoshop, basically industry standard in image-editing software, isn't an achievement... then nothing qualifies as an achievement. And this is coming from someone who prefers GIMP on linux. I would love to produce something even a quarter as popular & usable as Photoshop.
  - nwh 13y ago
    It's not. Have a look at what it's users have to put up with on a daily basis. http://bad-adobe.tumblr.com http://bad-adobe.tumblr.com
    - tedunangst 13y ago
      [Comment comparing software nobody likes and software nobody uses.]
    - cormullion 13y ago
      carrying on in the tradition of http://adobegripes.tumblr.com http://adobegripes.tumblr.com
    - lttlrck 13y ago
      So you are saying any software cannot be an achievement if it has bugs and UX issues? Or does it have to have a tumblr?
      - nwh 13y ago
        No. I'm saying that a program that costs a massive monthly fee and is pretty much impossible to avoid in this industry is should not be this constantly bad.
        deleted 13y ago
        [deleted]
  - lostlogin 13y ago
    It might be more of a reflection on my colleagues and I, but the phrase "industry standard" is basically used to mean something is crap by us. This is in radiology. UI inconsistency, buggy, crashy (as in 40 minutes to reboot the damn system), incompatibility with other systems etc. When you complain, you're told its industry standard, or similar. And this is just one system I use. There are other standards too. The company formally known as Kodak supplied PACS system which relies on IE6. It is also an industry standard. And it's as bad as things get. In healthcare IT industry standard = rock bottom standards.
alex_doom 13y ago
What does Photoshop have to do with their poor security?
- RussianCow 13y ago
  I think the point is that they've had plenty of time to get their shit together. Being proud of following best practices for a year when your company has been around for three decades is pathetic.
  - alex_doom 13y ago
    But that's like if Microsoft had a huge fuckup and then associating their Office software with it. It's a separate team that works on it.
tedunangst 13y ago
I'm curious to hear when exactly people think bcrypt became accepted best practice? And how much of a grace period did people have to switch? Were you incompetently negligent if you didn't use bcrypt by 2003? 2007? 2011? (I ask this as a fairly big fan of bcrypt myself. Somehow I just have the impression that half the peanut gallery comments come from people who literally switched over from md5 hashes yesterday and suddenly feel the need to crow about their great accomplishment.)
- kevinpet 13y ago
  The issue is not bcrypt vs. some other hash. The issue is hashing vs. reversible encryption. Unix has been using salted hashed passwords since the 70s. "one-way hash function" is a common phrase in the first edition of Applied Cryptography published in 1994. http://books.google.com/books?q=isbn:0471597562 http://books.google.com/books?q=isbn:0471597562
  - tedunangst 13y ago
    Worth noting that Gawker got shat on precisely for using unix salted passwords, so what you're saying isn't the issue is at least some of the issue.
    - deleted 13y ago
      [deleted]
  - bigiain 13y ago
    Actually, here on HN, "Use bcrypt" has been the war-cry whenever password storage is discussed for quite some time - mostly linking to Coda Hale's blog post from 2010: http://codahale.com/how-to-safely-store-a-password/ http://codahale.com/how-to-safely-store-a-password/ (the discussions usually then fragment into the "No, use scrypt instead! GPUs! HashCat! ASICs! Memory-hard vs iterations-hard!" thread, and the "but what if I use an application salt with my MD5 hashes? Or invent my own complification techniques (and keep using MD5)?")
- J0415 13y ago

by 001sky 13y ago

Adobe says that they've followed best practices for password storage and protection for more than a year now... 13 generations of photoshop ...and they're just getting around to this after CS6?

nwh 13y ago

I wouldn't call Photoshop an achievement, it's a hodgepodge of old libraries and bugs at the best of times. Adobe refused to patch a vulnerability in CS5 at one point, telling people to purchase and upgrade to CS6 (US$199) if they wanted to not be vulnerable to malicious code execution. In response to the uproar they eventually backported the patch. [0]: http://www.macworld.com/article/1166779/adobe_will_issue_free_security_patches_for_high_profile_creative_suite_apps.html http://www.macworld.com/article/1166779/adobe_will_issue_fre...

scotth 13y ago
Not a constructive comment, sorry, but I couldn't help chuckle reading this. It's beyond ridiculous.
- null_ptr 13y ago
  Mammoth corporations have fuck-all to do with common sense. They're run by apathetic shills that couldn't care less about technology, progress, or people (not to knock the talent that works in the trenches).
smtddr 13y ago
If Photoshop, basically industry standard in image-editing software, isn't an achievement... then nothing qualifies as an achievement. And this is coming from someone who prefers GIMP on linux. I would love to produce something even a quarter as popular & usable as Photoshop.
- nwh 13y ago
  It's not. Have a look at what it's users have to put up with on a daily basis. http://bad-adobe.tumblr.com http://bad-adobe.tumblr.com
  - tedunangst 13y ago
    [Comment comparing software nobody likes and software nobody uses.]
  - cormullion 13y ago
    carrying on in the tradition of http://adobegripes.tumblr.com http://adobegripes.tumblr.com
  - lttlrck 13y ago
    So you are saying any software cannot be an achievement if it has bugs and UX issues? Or does it have to have a tumblr?
    - nwh 13y ago
      No. I'm saying that a program that costs a massive monthly fee and is pretty much impossible to avoid in this industry is should not be this constantly bad.
      - deleted 13y ago
        [deleted]
- lostlogin 13y ago
  It might be more of a reflection on my colleagues and I, but the phrase "industry standard" is basically used to mean something is crap by us. This is in radiology. UI inconsistency, buggy, crashy (as in 40 minutes to reboot the damn system), incompatibility with other systems etc. When you complain, you're told its industry standard, or similar. And this is just one system I use. There are other standards too. The company formally known as Kodak supplied PACS system which relies on IE6. It is also an industry standard. And it's as bad as things get. In healthcare IT industry standard = rock bottom standards.

alex_doom 13y ago

What does Photoshop have to do with their poor security?

RussianCow 13y ago
I think the point is that they've had plenty of time to get their shit together. Being proud of following best practices for a year when your company has been around for three decades is pathetic.
- alex_doom 13y ago
  But that's like if Microsoft had a huge fuckup and then associating their Office software with it. It's a separate team that works on it.

tedunangst 13y ago

I'm curious to hear when exactly people think bcrypt became accepted best practice? And how much of a grace period did people have to switch? Were you incompetently negligent if you didn't use bcrypt by 2003? 2007? 2011? (I ask this as a fairly big fan of bcrypt myself. Somehow I just have the impression that half the peanut gallery comments come from people who literally switched over from md5 hashes yesterday and suddenly feel the need to crow about their great accomplishment.)

kevinpet 13y ago
The issue is not bcrypt vs. some other hash. The issue is hashing vs. reversible encryption. Unix has been using salted hashed passwords since the 70s. "one-way hash function" is a common phrase in the first edition of Applied Cryptography published in 1994. http://books.google.com/books?q=isbn:0471597562 http://books.google.com/books?q=isbn:0471597562
- tedunangst 13y ago
  Worth noting that Gawker got shat on precisely for using unix salted passwords, so what you're saying isn't the issue is at least some of the issue.
  - deleted 13y ago
    [deleted]
- bigiain 13y ago
  Actually, here on HN, "Use bcrypt" has been the war-cry whenever password storage is discussed for quite some time - mostly linking to Coda Hale's blog post from 2010: http://codahale.com/how-to-safely-store-a-password/ http://codahale.com/how-to-safely-store-a-password/ (the discussions usually then fragment into the "No, use scrypt instead! GPUs! HashCat! ASICs! Memory-hard vs iterations-hard!" thread, and the "but what if I use an application salt with my MD5 hashes? Or invent my own complification techniques (and keep using MD5)?")
J0415 13y ago