dual_sport_dork 🐧🗡️

Progenitor of the Weird Knife Wednesday feature column. Is “column” the right word? Anyway, apparently I also coined the Very Specific Object nomenclature now sporadically used in the 3D printing community. Yeah, that was me. This must be how Cory Doctorow feels all the time these days.

  • 2 Posts
  • 811 Comments
Joined 1 year ago
cake
Cake day: July 20th, 2023

help-circle




  • That particular strain of nonsense is actually specifically an Amazon thing, because you cannot sell “non branded” merchandise on Amazon, a policy that’s in place allegedly to combat generic whitebox goods from flooding the site. Your product has to be sold under a registered trademark, but the loophole is that said trademark does not actually have to make any sense whatsoever.

    Now there are brokers who will assist anyone in registering a trademark that is literally just a random string of letters for this express purpose. All you have to do is concoct a combination that no one has used yet, and register it with the USPTO.

    Therefore the entire scheme falls flat on its face, and manifestly fails to make any impact in the problem it purports to solve. But it does probably give Amazon a legal escape hatch to accusations of being a dumping ground for Chinese knockoff products, because they can point to all those trademark registrations and say, “No, see, everything sold here is all totally from a 100% legitimate brand!”








  • You should probably have some safeguard to prevent jokers from uploading 14.2 gigabytes of absolute nonsense into your system’s password field just to see if they can make it crash. But I think limiting it to, like, 8 kB ought to be quite lenient for anything with a modern internet connection.

    As others have noticed, various hashing functions have an upperbound input length limit anyway. But I don’t see any pressing reason to limit your field length to exactly that, even if only not to reveal anything about what you might be feeding that value into behind the scenes.




  • That works great until some dickhole implements the old, “New password cannot contain any sequence from your previous (5) passwords.”

    This also of course necessitates storing (multiple successive!) passwords in plain text or with a reversible cipher, which is another stupid move. You’d think we’d have gotten all of this out of our collective system as a society by now, and yet I still see it all the time.

    All of these schemes are just security theater, and actively make the system in question less secure while accomplishing nothing other than berating and frustrating its users.



  • Don’t bug users to change passwords periodically. Only do it if there’s evidence of compromise.

    This is a big one. Especially in corporate environments where most of the users are, shall we say, not tech savvy. Forcing people to comply with byzantine incomprehensible password composition rules plus incessantly insisting that they change their password every 7/14/30 days to a new inscrutable string that looks like somebody sneezed in punctuation marks accomplishes nothing other than enticing everyone to just write their password down on a Post-It and stick it to their monitor or under their keyboard.

    Remember: Users do not care about passwords. From the perspective of anyone who isn’t a programmer or a security expert, passwords are just yet another exasperating roadblock some nerd keeps putting in front of them that is preventing them from doing whatever it is they were actually trying to do.