lemmy.dudeami.win
  • Communities
  • Create Post
  • Create Community
  • heart
    Support Lemmy
  • search
    Search
  • Login
  • Sign Up
Pro@programming.dev to Programming@programming.devEnglish · 5 days ago

Cursed knowledge we have learned as a result of building Immich that we wish we never knew.

immich.app

external-link
message-square
56
fedilink
141
external-link

Cursed knowledge we have learned as a result of building Immich that we wish we never knew.

immich.app

Pro@programming.dev to Programming@programming.devEnglish · 5 days ago
message-square
56
fedilink
Cursed Knowledge | Immich
immich.app
external-link
Things we wish we didn't know
  • irelephant [he/him]@lemmy.dbzer0.com
    link
    fedilink
    arrow-up
    26
    ·
    edit-2
    4 days ago

    The bcrypt implementation only uses the first 72 bytes of a string. Any characters after that are ignored.

    what

    • loweffortname@lemmy.blahaj.zone
      link
      fedilink
      English
      arrow-up
      15
      ·
      4 days ago

      This is how someone cracked Okta a few years back: https://medium.com/@rajat29gupta/bcrypt-and-the-okta-incident-what-developers-need-to-know-9d13a446738a

    • chaos@beehaw.org
      link
      fedilink
      arrow-up
      9
      ·
      edit-2
      4 days ago

      Older Unix systems used to only do the first 8 bytes for passwords. Sometimes for my own amusement when logging into one of the Sun machines at school, I’d type in enough of my password to count and then just mash the keyboard.

      • Senal@programming.dev
        link
        fedilink
        English
        arrow-up
        3
        ·
        3 days ago

        for a long time, hotmail (and i think windows live mail) only checked the first 16 characters.

        • lad@programming.dev
          link
          fedilink
          English
          arrow-up
          3
          ·
          3 days ago

          That’s almost as good as the ones that limit password on the sign-in UI, but not on the sign-up

          • fuzzzerd@programming.dev
            link
            fedilink
            English
            arrow-up
            2
            ·
            3 days ago

            I have run across one that allowed arbitrary length when doing account creation and password reset but silently truncated the login input.

            Took me hours to figure out that my password was longer than the documented length, try it and then have no problems.

Programming@programming.dev

programming@programming.dev

Subscribe from Remote Instance

Create a post
You are not logged in. However you can subscribe from another Fediverse account, for example Lemmy or Mastodon. To do this, paste the following into the search field of your instance: !programming@programming.dev

Welcome to the main community in programming.dev! Feel free to post anything relating to programming here!

Cross posting is strongly encouraged in the instance. If you feel your post or another person’s post makes sense in another community cross post into it.

Hope you enjoy the instance!

Rules

Rules

  • Follow the programming.dev instance rules
  • Keep content related to programming in some way
  • If you’re posting long videos try to add in some form of tldr for those who don’t want to watch videos

Wormhole

Follow the wormhole through a path of communities !webdev@programming.dev



Visibility: Public
globe

This community can be federated to other instances and be posted/commented in by their users.

  • 65 users / day
  • 950 users / week
  • 2.76K users / month
  • 7.5K users / 6 months
  • 1 local subscriber
  • 21.7K subscribers
  • 1.62K Posts
  • 21.4K Comments
  • Modlog
  • mods:
  • snowe@programming.dev
  • Ategon@programming.dev
  • MaungaHikoi@lemmy.nz
  • UlrikHD@programming.dev
  • BE: 0.19.8
  • Modlog
  • Instances
  • Docs
  • Code
  • join-lemmy.org