Re:Peppering (Password Storage)
by willcipriano on Thursday July 02, 2020 @02:34PM
(#23716459)
I've never reviewed such a change but I've fixed bugs where a test that would've caught the bug was ignored because it caused the build pipeline to fail. My guess the programmer was on a tight deadline and had to ship it so they cut a corner and forgot to get back to it. That's the reality of many if not most organizations, good software engineering is a afterthought compared to the concerns of keeping the lights on day to day. As such I have changed my personal operational model and include as many cheap safeguards as I can when I'm doing something important. This is just one of those things I have in my anti-footgun bag of tricks.
If people are going to be allowed to meddle with security critical code with no effective oversight you're already dead you just didn't know it yet. They can go modify the password checking code to return true because that seems to "work better" and if nobody rejects that you no longer have password authentication.