Re:Sshole
by BoppreH on Thursday November 05, 2026 @09:33AM
(#50379556)
No, that's just more in-band signaling!
Some badly designed password hashing algorithms (cough bcrypt cough) have maximum password lengths, ignoring everything after X characters. So it could happen that I set my password to a 100-character string, it gets saved "==DANGEROUS_CRYPT_ERROR_length==", and then anybody can log in to my account by entering an unrelated long string.
If a function promises a string result, it should only provide a string if the function succeeded. The null was much better than magic strings.
Re:Sshole
by BoppreH on Thursday November 05, 2026 @10:01AM
(#50379945)
If I was really desperate and could only return a valid string, I would probably use a message and add a random component to avoid ever matching two errors. Like SQL, where null != null.
Some badly designed password hashing algorithms (cough bcrypt cough) have maximum password lengths, ignoring everything after X characters. So it could happen that I set my password to a 100-character string, it gets saved "==DANGEROUS_CRYPT_ERROR_length==", and then anybody can log in to my account by entering an unrelated long string.
If a function promises a string result, it should only provide a string if the function succeeded. The null was much better than magic strings.