@AviD Well, my entropy calculations are for me too; I don't claim that there is a formula which gives entropy based on length generically (in fact there provably cannot be such a formula).
@ThomasPornin right, of course. So - 64 chars might or might not be strong enough, obviously depending on how it was generated. But the question remains, as a password policy, is it too restrictive, or just enough?
I think forcing the caller to restrict the length is too annoying, especially with variable length encodings like UTF-8. So I favour functions which support longer inputs.
@deed02392 yes yes, exactly. But since the user gets to select tha password, the site has no information on that. So, the policy has the option of restricting the lenght, for reasons as mentioned above. So, 64 chars was chosen (not really, thats the default, but whatever) - the q' is, is that too short, or long enough to let slide?
Yeah it's a tough one. If we were looking to use a pass-phrase ie a memorable phrase consisting of mostly random words, I'd say 64 bytes isn't long enough
I'd want to be able to make up a phrase more than ~9 words
As for the DoS issue of a user spamming lots of long passwords, obviously you control that by other means eg CAPTCHA, rather than being restrictive on things like password length
@deed02392 really? Xkcd goes for 4, depending on word length (common words should be enough) yoiu could probably get 7-8 words. I'm thinking its pelnty, but is it enough.
@deed02392 oh shuddup with the captcha
no really, captcha is irrelevant. just use proper rate limiting.
@AviD I'd suggest considering the risk another way. How many users would be expected to want to use a password that is longer than 64 characters? If the answer is 0, or nearly 0, regardless of any other considerations, the additional risk of not allowing longer passwords is either nil, or immaterial. No? So IMO, this would probably not be a battle worth fighting, because winning is unlikely to add measurable value.
@AviD He, they are a fierce bunch. I have submitted candidates in three competitions so far (AES, eSTREAM, SHA-3) but I was in the "winner(s)" only once.
Also, this is the first time I go on my own; other submissions were team work.
@ThomasPornin It's still a bit unclear. List activity fluctuates a lot. There were a bunch of candidate candidates, but not sure how many of those will actually work out a complete submission.
@CodesInChaos btw I'm sure that @RoryAlsop would not object if you wanted to do a blog post on your perspective of the process, obviously without revealing any privileged information.
@TerryChia What we can do is that you find the bug (and not report it for a while), then you let me prepare a patch, and we submit one after the other :p
Anyway, I'm not even getting time to contribute to FF
@TerryChia what do you think of the FF console being disabled by default? These days I'm seeing a lot of instances where people are tricked into putting malicious code into the console
Basically, disable it and put a bunch of warning signs around it
I wonder if they will consider other libraries other than the ones listed. I did write a patch once for Apache Shiro that I really should bug the maintainers into accepting.
@ManishEarth Meh, as long as it's not too troublesome to re-enable I really couldn't care less.
Usable with 100 open tabs. Preview on mouse over, shrinking icons if they don't fit, going to recently active tab on close, reliably preserving them across browser restarts. Never opening new windows instead of tabs unasked (FF loves to do that).
@ManishEarth Ah neat! Tell me when you escalate your commit privileges so I can social engineer you and ship malware-infested FF binaries with your account!
I have a function which verifies the Password field and suggests the user to enter a strong password. I also have a label named Password Strength, referring to the strength of a password (very weak, weak, medium, etc).
Code:
<tr>
<%= label "Password",:mandatory=>true %>
<td>
<input id="user_p...
@ton.yeung ah could be, I didn't watch it yet ... last one I watched was on 10 years of Opportunity, was pretty fun ustream.tv/recorded/42795898/theater (he starts at around 58:20)
@kalina In fairness, she has quite a good voice. You can't particularly tell from the stuff she has on the radio, but I've heard her sing a couple of covers, and she demonstrated some actual singing talent. In all other aspects, I agree with you.
It is true that as a fox, I should know this, so consider this a spoilers warning.
In a recent post, Geek Girl mentions that the mating call of the fox is a series of sharp, eerie barks and that this is called gekkering. This is supported by a citation in Wikipedia, but the reference is not one ...
@ManishEarth I agree with one of the discussion questions that it should be called "Community Managers" rather than "Moderators." Moderators is far too limiting. I think it's probably a bit of SE myopia.
@ManishEarth I'd change that slightly. "Community Manager" is a more common title for the people who would actually care about having a site like Mod.SE to answer their questions.
That, or it'll end up being a mod-specific version of meta.SE.
Business-speak discourages experts (unless they are experts on business/marketing).
Moderators will be probably the broadest part of the site audience, and most of moderators simply don't see themselves as "community managers" unless they specifically put a thought to it. The title should draw a...
@ManishEarth I've been working professionally in the community/social space in some capacity for the better part of 14 years. Now with that in mind, my opinion is still only that...One guy's opinion, but my opinion is that I'm not impressed with what I've seen in the proposal, and how the name is justified reinforces my opinion that the site is on the wrong trajectory already.
@Xander Oh, I agree that having CMs as the title will attract more professionals (as in people paid to moderate). But the title "Moderator" is more common on the 'net for volunteers and these folks have a lot of experience too.
@ManishEarth Moderators on IRC channels and car customization forums are not going to invest in learning how to professionally deal with problem users and how to thoughtfully build a valuable community. Professional community managers would.
Not to mention that "Moderators" does not exclude CMs and higher-level moderators, but "Community Managers" very much alienates what are essentially the "laymen".
@Xander How so? It doesn't restrict anything, it's just the core.
Without a healthy interaction between community members and moderation staff, any community will crumble.
You can patch up a lot of things around it, but that core is necessary.
Frankly, the examples you're giving ("how to professionally deal with problem users" in particular) are very much issues that face every community.
No matter its size or standing.
"Community Management" entails a lot more beyond that - and a lot of that I can definitely see implicitly outside the scope of something named "Moderators".
I very much disagree with the notion that a "random layman moderator" would not be interested or involved in matters of user and content handling, though.
@FEichinger Yes, that is absolutely true. However, in most of the communities that I've been involved with that use volunteer moderators, or are otherwise run by amateurs, they're not looking for resources to help them deal with those users. They don't have enough invested in whether they choose the "professional" path or not...They just use the seat of their pants, or norms that have been put in place by the other moderators in that community.
And in professionally run community, moderators aren't looking for a site to teach them that either...They're doing what their boss, a "community manager" tells them to do, and following organizational policies.
@FEichinger Like I said, this is all based on my own experience, for whatever it's worth. I'm just not impressed by this proposal as it currently stands.
@ManishEarth The question then becomes, is the site about moderators, or is it about community managers -- the two are different things with mostly non-overlapping responsiblities.
Certainly, Community Management entails a lot more, as I said before. But also contains the very same responsibilities (and abilities) as simple moderators.
@tylerl ""moderators" involves stuff like resolving disputes between member..." Even that, in a large corporate community (which is primarily what I work with these days, hence my obvious bias) is generally the responsibility of a community manager. Moderators are usually only responsible for detecting and escalating these sorts of issues, and are not responsible for attempting to solve them.
@Xander That's interesting. You must have a different kind of community than what I'm thinking of. Or perhaps more reasonable members. When I think of disputes, I'm talking about issues like the drama from yesterday, not about important policy.
And that's probably where my issue lies. In my experience, "moderators' who are both empowered and interested in being active in a site like mod.SE are a very small subset of the potential populations. Most volunteer mods are empowered, but don't have the investment to care more than in passing about a site like mod.SE, and most professional mods are more like level 1 CSRs and aren't empowered enough to care about a site like mod.SE.
It's the community managers I would with who would be really interested in a resource like that.
In my experience, the vast majority of communities has rather free moderators, acting on behalf of the community management with given guidelines, but acting by themselves or in council. In fact, I have only come across two communities with moderators actually only being "eyes and ears", if you will.
@tylerl In my world, for the drama yesterday, it may well be the mods who click the buttons, but it's going to be their management who defines what behaviors cause the buttons to be clicked, and what specific button goes with which behavior. They're not asking on the Internet for advice on what they should do.
@FEichinger that's the key; if you call it "moderators", then policy-making may be OT, but if you call it "community managmenet", then policy-following may be OT.
I have a function which verifies the Password field and suggests the user to enter a strong password. I also have a label named Password Strength, referring to the strength of a password (very weak, weak, medium, etc).
Code:
<tr>
<%= label "Password",:mandatory=>true %>
<td>
<input id="user_p...
I love drinking beer after a run. It's also good to drink electrolytes after a run.
Is it possible to add electrolytes to beer? How would you do it?
