🥺: the best sudo replacement • Hacker News Board

Re: 🥺: the best sudo replacement

#521

Post by afiori » Sat, Jan 21, 2023, 8:06 PM UTC

Xylakant wrote: post #452

sshine wrote: post #437

Earlier quoted context omitted.

Password character limits are important. They reveal that the back-end service probably doesn't hash the passwords, which is a good time to GTFO.

I would consider setting a (high) limit for a password a good practice. No one wants an attacker to run a megabyte of password data through your slow password hash. It should be a limit that normal users never reach, but something like 100 chars seems entirely reasonable.

The reasonable thing to do is to prehash the user password on the client with a Unicode normalization and a SHA-512 pass.

This way you can have strong input validation server side but also allow almost arbitrary inputs client side.

PS: you likely could also salt the client side hashing and use bcrypt, but bcrypt has a quite short maximum length and I am not sure if it would provide significantly better security here.

Re: 🥺: the best sudo replacement

#522

Post by lelanthran » Sat, Jan 21, 2023, 8:32 PM UTC

xena wrote: post #508

lelanthran wrote: post #456

Earlier quoted context omitted.

> The best part is that it's a joke that has enough merit to it that it's worth being taken seriously. That makes for good satire. I love writing surrealism, it's a very hard balance to meet. What makes you think you met it?

This comment section not understanding where I was being satirical.

> This comment section not understanding where I was being satirical.

That means you didn't meet it[1].

[1]That balance you were talking about. You missed it. If too few people understand your content, it's not the people that's the problem. As someone attempting to present an argument, the onus is on the presenter to make the argument readable, not on the reader to squint until it gets readable.

IOW, if you can't be bothered to write your message well, why did you expect other people to be bothered to read it at all?

Re: 🥺: the best sudo replacement

#523

Post by arp242 » Sat, Jan 21, 2023, 8:59 PM UTC

uglycoyote wrote: post #518

arp242 wrote: post #516

Earlier quoted context omitted.

Usually the majority gets it. And the worst that can happen is that some people will downvote you, or call you an idiot. I'm not especially concerned about this. I don't see how it's an accessibility issue, except to help out those with a deficient sense of humour.

regarding accessibility..from what I have heard, other cultures have much different styles of sarcasm which might impede their ability to understand that something you have said is sarcastic. e.g. Japan is known to have a reputation of not understanding American sarcasm, but has it's own style of sarcasm. (see https://linguaholic.com/linguablog/sarcasm-in-japanese/ ) so, I guess announcing your sarcasm makes sense in…

Ah right.

Communicating across cultures is always bound to lead to the occasional misunderstanding, even more so over text. When writing something "dry" such as documentation it's probably a good idea to keep that in mind, but making jokes worse just so that a few more people can perhaps maybe possibly understand it is where I draw the line.

Re: 🥺: the best sudo replacement

#524

Post by drdaeman » Sat, Jan 21, 2023, 9:21 PM UTC

xena wrote: post #133

brundolf wrote: post #121

Some people probably hate it, but I really enjoy the conversational format of these posts. Very novel and interesting way to bounce around a topic

Thanks! That's exactly the point of it! I'm going to be working on the CSS this weekend on stream (the images being so big for longer conversations take up too much screen real estate), but in general the idea is to have a combination of the Socratic method of dialogue based teaching combined with a few consistently written characters; not to mention it helps move out parentheticals to break up giant walls of text. I…

Hey! I would definitely recommend putting this somewhere on your website.

I have been encountering it now and then - mostly on Nix/NixOS topics (by the way, thank you very much for some very useful articles!), and while I don't have any issues with the format, those characters were a kind of small and a little bit weird (not in a bad way, just... unusual) mystery, making me wonder "who are those, what's the story/going on here besides the obvious dialogue format?". Not much, of course, just a minor casual curiosity, but made me look into the footer/about section if there was anything in there.

Just saying. And thanks again!

Re: 🥺: the best sudo replacement

#525

Post by xena » Sat, Jan 21, 2023, 9:31 PM UTC

xena wrote: post #421

doodlesdev wrote: post #307

Earlier quoted context omitted.

Thank you xena, you can download it from FDroid here https://f-droid.org/packages/org.mozilla.fennec_fdroid/ You might also just download normal Firefox as the behavior is the same when it comes to rendering.

I'll do what I can. I fear the problem will boil down to not having control of CSS in reader mode (which is understandable, really) and I may need to admit how my CDN serves the sticker files to serve lower quality assets. I hope it's a simple fix. Gonna do the fix live on Twitch tomorrow: https://twitch.tv/princessxen

Fixed on stream. The CDN resizes images on the fly now.

Re: 🥺: the best sudo replacement

#526

Post by xena » Sat, Jan 21, 2023, 9:31 PM UTC

xena wrote: post #229

pxc wrote: post #188

Earlier quoted context omitted.

> the idea is to have a combination of the Socratic method of dialogue based teaching combined with a few consistently written characters This is, of course, how the original Socratic dialogues are written, too! There are characters with distinctive personalities and points of view who (re)appear in multiple dialogues. Maybe a lot of STEM folks here have never read Plato or other/later philosophical dialogues, or the…

I'm gonna work on the CSS on stream this weekend. It's something that usually comes up in bad faith so I haven't really prioritized acting on it. However I think I finally understand enough CSS to do it properly.

Fixed on stream. The CSS looks a bit better now.

Re: 🥺: the best sudo replacement

#527

Post by xena » Sat, Jan 21, 2023, 9:33 PM UTC

xena wrote: post #423

epakai wrote: post #185

Earlier quoted context omitted.

The dialog could probably use some left/right padding or an alternate font to indicate it's not part of the main text. Initially I found it a bit unclear, and also hard to skim the article.

I'm gonna give it a lot of love this weekend. Sorry it's not the best. I'm quite terrible at CSS.

Fixed on stream. The CSS delineates conversation snippets better now.

Re: 🥺: the best sudo replacement

#528

Post by Haegin » Sat, Jan 21, 2023, 10:12 PM UTC

BrandoElFollito wrote: post #496

sshine wrote: post #437

Earlier quoted context omitted.

Password character limits are important. They reveal that the back-end service probably doesn't hash the passwords, which is a good time to GTFO.

My bank requires a password of exactly 8 digits. In 2023.

A bank I used until about 2018 (no idea if they've fixed this yet - I left) had an exactly 6 character password, and when you used telephone banking it just needed the 6 digits that corresponded to that word. Those 6 numbers also worked online, so at best they were turning all passwords into numbers before hashing them, ensuring there are less than 900000 different possible passwords, which was trivially easy to brute force in 2015, nevermind today.

Re: 🥺: the best sudo replacement

#529

Post by Dylan16807 » Sat, Jan 21, 2023, 10:36 PM UTC

lelanthran wrote: post #522

xena wrote: post #508

Earlier quoted context omitted.

This comment section not understanding where I was being satirical.

> This comment section not understanding where I was being satirical. That means you didn't meet it[1]. [1]That balance you were talking about. You missed it. If too few people understand your content, it's not the people that's the problem. As someone attempting to present an argument, the onus is on the presenter to make the argument readable, not on the reader to squint until it gets readable. IOW, if you can't be…

What makes you say "too few" understood? It's a balance, right? So if plenty of people understand, and the right people didn't understand, then it's right on target.

And it looks to me like lots of people understood.

Re: 🥺: the best sudo replacement

#530

Post by Dylan16807 » Sat, Jan 21, 2023, 10:41 PM UTC

msla wrote: post #424

xena wrote: post #133

Earlier quoted context omitted.

Thanks! That's exactly the point of it! I'm going to be working on the CSS this weekend on stream (the images being so big for longer conversations take up too much screen real estate), but in general the idea is to have a combination of the Socratic method of dialogue based teaching combined with a few consistently written characters; not to mention it helps move out parentheticals to break up giant walls of text. I…

I just have to say: May you one day end up on a system nobody uses, and watch as your environment dies so other people can have "nice things".

That already happens to anyone that tries to stay on the same system indefinitely.

Personally I'm used to it and I think security is more important than indefinite hardware support. Installing the same software on newer hardware is fine.