Overwrought Security Non Sequitur

chromatic on 2009-07-31T03:07:24

I’m baffled at what the PerlMonks developers and admins were thinking storing their passwords in plain-text.... This is something that not only has been in Perl since version 1.0, but has also been integrated natively in almost every database environment on the planet.

I’m ashamed as a Perl developer, and this gives a huge black eye to the entire Perl community.

After this, I’m seriously considering switching to another language for my next project.

Jesse Stay, — There’s More Than One Way to Store a Password - PerlMonks Hacked

Storing passwords in plain text is wrong, full stop, but if I'd had a server rooted, I'd worry about more than just bad guys reading database dumps. A little phishing code would be easy to insert into a lot of web sites.

Then again, I also worry about DNS hijacking.

If I had a gripping hand, I'd tell you that I once saw a neighbor store a spare house key under the mailbox, and that's why I'm seriously considering switching to a condo for my next dwelling. Guy gave all homeowners everywhere a black eye, even though pockets have been in clothing since almost Textiles version 1.0, not to mention integrated natively in almost every pair of jeans on the planet.


An odd comment on that blog post.

Phred on 2009-07-31T05:24:49

"After this, I’m seriously considering switching to another language for my next project."

Huh. I guess that is like seeing someone fall down a flight of stairs, and deciding to avoid stairs from then on.

Re:An odd comment on that blog post.

slanning on 2009-07-31T08:04:03

...or rolling around in a Martian landing ball.

(might be fun for a while...)

to what language

jmm on 2009-07-31T13:06:53

Hmm, going to switch from perl, eh?  Perhaps going to a language that does not have a built-in crypt function will give you better security.