Morning

MORNING

morning

but morning means morning!!!

Universal Greeting Time: http://www.total-knowledge.com/~ilya/mips/ugt.html

Shameless self plug: https://twitter.com/skillsmatter/status/801714732587683840

It's about simplifying the way you interact with remote APIs and making the integration generative-testable, but I'm rubbish at writing synopses

Bore da

Good to see UGT getting a mention....again!

@oliy nothing wrong with a shameless plug now and again (see me, @otfrom and @jonpither for examples!)

I'll be there tonight BTW

perhaps it should be UTG, so as not to offend any non-english sensibilities @agile_geek ?

@mccraigmccraig maybe the phrase 'Universal Greeting Time' should be translated to Esperanto?

it seems quite familiar ... "universala saluto tempo"

I'm going to come here begging for RTs tomorrow for the next clojure in

if anyone would like to feature on https://juxt.pro/clojure-in.html please let me know - the end of the pipeline is becoming visible

jonpither: can’t wait to see it!

its been a really nice series

thanks @rickmoynihan

Morning

acron 👋

hello

is 1024 chars a suitable max password length?

Does anyone have experience 'proxying' multi-part uploads from one server to another? I have a server which expects multipart and have now introduced a front-facing gateway/BFF which is supposed to proxy requests. Simple for most requests but...tricky for multipart. Is this even a thing?

@acron can you not just forward the body-stream after parsing the headers to determine destination ?

@otfrom 1024 8-bit chars or unicode chars ?

I'm fine w/16 bit ones. I'm just thinking big enough to do everything, small enough to not be an attack vector. 😉

though I suppose that the ELB will have a 16MB limit on the request size.

if you end up having to parse the multipart stream @acron then @malcolmsparks work may help - https://github.com/juxt/yada/blob/master/src/yada/multipart.clj

@otfrom do you know what the max input of the password hashing function is?

glenjamin I don't

I presume it is just a string and if it is long then bcrypt will take more time to hash it

> the key argument is a secret encryption key, which can be a user-chosen password of up to 56 bytes (including a terminating zero byte when the key is an ASCII string). from http://security.stackexchange.com/questions/39849/does-bcrypt-have-a-maximum-password-length

@mccraigmccraig Thanks, I will have a look at this - it could be as simple as handling the body stream, I haven't tried yet 😎

glenjamin thx!

so... 56 bytes then it is

I’d be tempted to set it to around 150 chars instead

anyone who is picking passwords between 50 and 150 chars probably knows enough to expect some truncation along the way?

in UTF-8 each char is a byte isn't it?

at least a byte - yeah

but it may be up to 4!

I think I'll say up to 50 characters

with a link to those who want to know more

sounds sensible

who’s the target audience?

eventually the general public

currently people working for local or national government

emojis are probably making their way onto dictionary attacks, maybe I should include some cuneiform?

possibly some other enterprise users

I'd have more than just the one emoji

wow - 56 characters doesn’t sound all that much, really. Though that’s my brain being illogical - part of me thinks “I went from an 8 character password 10 years ago to a 16 character password now, I guess I’ll have to keep doubling” 🙂

NIST recommends 64 as a maximum

one of my diceware passwords is 31 chars long

I guess if people enter a 100 character password, they are probably making false assumptions. I don’t like the idea of limiting though, at some level.

I use dice passwords all the time, they are all sorts of lengths

i only have a few of them - and that's the longest

acron I wonder what NIST are hashing with then at 8 ish chars of that won't make a difference

TIL about diceware passwords, very neat idea

mostly in my current app we encourage people not to have passwords at all

some of my IBM colleagues had passwords that there into the 100's char long.

using lastpass or something like that.

I use https://github.com/christierney/diceware 🙂 And then store them in 1password.

@otfrom what ever you do, don't fail it silently as one system I know of did.

ie: enter password successfully -> try and enter again and get wrong password. but it did work if you filled in only the first 12 char of original.

omfg

@acron if you need to produce (as opposed to parse) a multipart message, also this can help: https://github.com/reborg/applenews-api/blob/master/src/net/reborg/applenews_api/multipart.clj