461–466 of 466 posts
Earlier quoted context omitted.
Literally found the same issue in a password system, on top of passwords being clear text in the database... cleared all passwords, expanded the db field to hold a longer hash (pw field was like 12 chars), setup "recover password" feature and emailed all users before End of Day. My own suggestion to anyone reading this... version your password hashing mechanics so you can upgrade hashing methods as needed in the futu…
If you are needing to version your password hashes, then you are likely doing them incorrectly and not using a proper computationally-hard hashing algorithm. For example, with unsuitable algorithms like sha256, you get this, which doesn't have a version field: import hashlib; print(f"MD5: {hashlib.md5(b'password').hexdigest()}") print(f"SHA-256: {hashlib.sha256(b'password').hexdigest()}") MD5: 5f4dcc3b5aa765d61d8327d…
Earlier quoted context omitted.
Years ago I worked for a company that bought another company. Our QA folks were asked to give their site a once-over. What they found is still the butt of jokes in my circle of friends/former coworkers. * account ids are numeric, and incrementing * included in the URL after login, e.g. ?account=123456 * no authentication on requests after login So anybody moderately curious can just increment to account_id=123457 to…
I did some work ~15 years ago for a consulting company. The company pushes their own custom opensource cms into most projects - built on top of mongodb and written by the ceo. He’s a lovely guy, and good coder. But he’s totally self taught at programming and he has blind spots a mile wide. And he hates having his blind spots pointed out. He came back from a react conference once thinking the react team invented funct…
I've also have spent 10-15 hours a week beyond work assignments on reading/experimenting, etc. in terms of honing my craft/skills over the course of three decades. Most devs don't do that much consistently in general though.
Earlier quoted context omitted.
Years ago I worked for a company that bought another company. Our QA folks were asked to give their site a once-over. What they found is still the butt of jokes in my circle of friends/former coworkers. * account ids are numeric, and incrementing * included in the URL after login, e.g. ?account=123456 * no authentication on requests after login So anybody moderately curious can just increment to account_id=123457 to…
You might as well make them sequential if they're numeric, making them non-sequential just puts more load on your server when the brute force happens.
I did once have a system that started with a incremental sequence was 17, then the number was passed through a reversible obfuscation to get a 6+ character output ID... it wasn't that bad, was an inspection record for a vehicle entry... meant to be able to be shared and looked up by anyone with the sequence (semi-public), it was desired to be short, and it just moved the guess-ability factor slightly.
Earlier quoted context omitted.
I think you’re taking the professional responsibility that engineers are given too far. They are not given that responsibility to make political decisions, as you seem to be implying. Engineers are professionals in the hard sciences, not in social sciences. They only have power over ethical and safety issues directly pertaining to technical matters. I think ethics in this sense includes only very widely accepted ethi…
You're the one that brought up politics. You're right that they're hard to decouple from ethics as that's essentially how the parties form. But where I disagree with you, and extremely, is that we should not have our own personal ethics and adopt that of what we believe is society's. You're asking the impossible. Such a thing doesn't exist. Whichever country you're in you'll find a diverse set of opinions. The most u…