The space at the end of the password entry was found in QA testing. Since we are an agile shop and run two week sprints that bug was left in and put on the backlog to be prioritized later. Gotta release every two weeks, even if it's utter crap. As long as the PBIs are completed, who cares about the users? It's a sad day when I have to sneak bug fixes that annoy me in on my free time, but this seems to be the norm in…
1. let's suppose a user have a password: (note the space)
" 123"
2. also you store the password using some hashing function, which prevents you from knowing the password.3. two weeks later the bugfix goes live, the user cannot longer access the service.
Also, you cannot easily estimate how much benefit/annoyed users your _fix_ will endup having .. which makes it a higly risk change.