Skip Navigation

InitialsDiceBearhttps://github.com/dicebear/dicebearhttps://creativecommons.org/publicdomain/zero/1.0/„Initials” (https://github.com/dicebear/dicebear) by „DiceBear”, licensed under „CC0 1.0” (https://creativecommons.org/publicdomain/zero/1.0/)FO
Posts
0
Comments
107
Joined
2 yr. ago

  • Elastio offers it apparently: https://elest.io/open-source/lemmy. But they offer many managed services so who knows how good their managing of Lemmy is/would be (I have not used it).

    On the other hand, I've considered setting up something like this myself. I run my own instance for my own personal use in a Kubernetes cluster, but did the hosting such that everything is scalable to many instances if need be. I just don't know how much interest there would be in people wanting their own instances to make it worth my time to build out an admin/billing portal and automate it all. If anyone else is interested in this I'd love to know though since it could be a fun project to work on.

  • Again why? Is this some repetition of the Cold War Soviet-US competition?

    Yes, it's a prestige project. It's the same reason why some countries spend billions to host competitions like the Olympics/World Cup: it's an international dick measuring contest.

    (For the record, scientific investment in space programs has incredible ROI so I whole heartedly support programs like this even if the motivation for doing so on the part of politicians is less than noble.)

  • Hashing is typically done server-side. So you need to transmit the password to the server and you can't have a truly unlimited data limit. Pretty much every web server will reject requests over some size so while it's entirely reasonable to support something like a 1,000 char password if you really wanted to, having it be truly unlimited with something using a 10 million character password is a security/operational risk in itself.

  • It goes both ways: Programmers have a responsibility to inform PMs how bad of an idea short max password lengths are. And if they're still absolutely forced to implement it anyway, do you really want to be working somewhere that goes out of their way to purposefully implement poor security and somewhere that doesn't respect serious concerns raised from their engineers?

  • Same reason some websites still have max password lengths of 12 characters: Bad programmers that don't know what they're doing when it comes to the most basic of security concepts.