this post was submitted on 21 Jun 2023
57 points (100.0% liked)

Technology

37712 readers
168 users here now

A nice place to discuss rumors, happenings, innovations, and challenges in the technology sphere. We also welcome discussions on the intersections of technology and society. If it’s technological news or discussion of technology, it probably belongs here.

Remember the overriding ethos on Beehaw: Be(e) Nice. Each user you encounter here is a person, and should be treated with kindness (even if they’re wrong, or use a Linux distro you don’t like). Personal attacks will not be tolerated.

Subcommunities on Beehaw:

This community's icon was made by Aaron Schneider, under the CC-BY-NC-SA 4.0 license.

founded 2 years ago
MODERATORS
alyaza@beehaw.org
TheRtRevKaiser@beehaw.org
gyrfalcon@beehaw.org
rs5th@beehaw.org
Los@beehaw.org
coldredlight@beehaw.org
SemioticStandard@beehaw.org
TheRtRevKaiser@kbin.social
remington@beehaw.org
57
PLEASE help test Lemmy 0.18 fixes, enterprise.lemmy.ml is the testing server with latest code (yiffit.net)
submitted 1 year ago by Wander@yiffit.net to c/technology@beehaw.org
16 comments fedilink hide all child comments
 

This next version is quite important as it brings important fixes.

Bugs: https://enterprise.lemmy.ml/c/actualbugs018

cross-posted from: https://sh.itjust.works/post/300197

Enterprise: enterprise.lemmy.ml - Thank you!

top 14 comments
sorted by: hot top controversial new old
[–] Lionir@beehaw.org 10 points 1 year ago* (last edited 1 year ago) (2 children)

I notice a few UI-related things:

  • Keep getting "Deleted by creator" in the bottom left which I assume an unregistered user shouldn't see
  • Community names in the Communities list or on any page it seems are not center aligned like you might notice here (https://beehaw.org/communities)
  • Modlog only appears after a refresh on the page
  • Modlog filters are no longer side-by-side
  • It finally says that the Username is taken
  • It still lets you make a password longer than 60 characters (bad)
  • Posts no longer seem to be switched

(Still need to test pinned messages being moved when sorted by new) (I should post this in there, actually, I guess)

[–] dudeami0@lemmy.dudeami.win 8 points 1 year ago (3 children)

Is there a reason you consider passwords longer than 60 characters an issue, or does the backend reject such passwords? In my experience, there should be no upper bound on password length except maybe in the order of request size being too large (say a password that is a several kilobytes).

[–] Lionir@beehaw.org 18 points 1 year ago (1 children)

The 60 character limit is not a problem imo, the problem is that they are truncated at 60 but the UI doesn't tell you, this results in some problems.

[–] dudeami0@lemmy.dudeami.win 5 points 1 year ago

Oh yea, that is a huge issue.

[–] Xanvial@lemmy.one 5 points 1 year ago* (last edited 1 year ago) (2 children)

Some password hashing methods has max characters length. For example Bcrypt has 72 max length. This is mostly to avoid taking too much time encrypting user input.

If there's no limit someone can technically froze the server by inputting large password (not because the request is big, but the process is exponentially takes more CPU process the longer characters it needs to compute)

[–] dudeami0@lemmy.dudeami.win 2 points 1 year ago

Having only ever implemented PBKDF2 this is a good insight as well. This limitation does not seem to be an issue with more modern hashing algorithms, but I can see where limiting the size to a reasonable amount for purposes of having an upper bound on performance would be needed.

[–] livingcoder@lemmy.austinwadeheller.com 1 points 1 year ago

That's an interesting attack vector. Thanks for the insight.

[–] livingcoder@lemmy.austinwadeheller.com 4 points 1 year ago (1 children)

Passwords "should" be hashed anyway, so I don't understand why there's a limit. Are they actually being stored as plaintext in a VARCHAR(60) column in the database? Please tell me that's not happening.

[–] rs5th@lemmy.scottlabs.io 7 points 1 year ago

Just checked my own Lemmy postgres database, it's a 12 round Bcrypt 2b hash.

[–] marauderprophecy1998@beehaw.org 5 points 1 year ago

Is it possible if you can submit that comment as a post in enterprise.lemmy.ml cause that way the devs could see your thoughts? Or you could submit it as a ticket in the issues tab in lemmy-ui I guess if that's more convient

[–] binboupan@lemmy.kagura.eu 6 points 1 year ago (1 children)

Will arm64 get some love? I installed lemmy using ansible and dont seem to be able to update from 0.17.3 as there don't seem to be any docker builds for arm64. :(

[–] falcon15500@lemmy.nine-hells.net 2 points 1 year ago

Random guy here saying I've built arm64 v0.17.4...

Available on docker hub search for mpatton.

[–] Dusty@lemmy.dustybeer.com 3 points 1 year ago (1 children)

Is this different from voyager.lemmy.ml? If so how, and why should I join another instance instead of continuing to use that one?

[–] underscores@lemmy.dbzer0.com 3 points 1 year ago

I think they just have multiple test instances to test federation between them.

load more comments
view more: next ›