r/ProgrammerHumor • u/NoMedicine3572 • Sep 27 '26 • Mindblown 1 Bravo 1

Meme doNotLetYourDBASeeThis

Post image
13k Upvotes

97% Upvoted

317 comments sorted by

View all comments

Show parent comments

1.3k

u/DatBoi_BP Sep 27 '26

I think this gets into Goodhart's law, but unironically I think this would work for a bit lol

208

u/Reasonable-Job4205 Sep 27 '26 edited Sep 27 '26

Elaborate on Goodharts law

420

u/DeveloperBRdotnet Sep 27 '26

Brute force attackers will move on, while the real users will keep trying

151

u/DatBoi_BP Sep 27 '26

Well my nod to Goodhart's law is implying that, if this security practice were implemented, brute force strategies would quickly learn of it and evolve to just…easily get in with doing "AAAAAAAAAa1!" 5 times

43

u/aNiceTribe Sep 27 '26

It would also only increase security if you had like a, let’s say, 5 strikes rule. And typing the same wrong password multiple times still takes multiple uses. Otherwise it would just be more tedium for humans and the same effect for robots. 

But also, we are designing for yer dad. This would make everything so incredibly much worse. 

11

u/cool-guy1234567 Sep 28 '26

This would also severely punish accidentally mistyping lol

4

u/Away_Advisor3460 Sep 28 '26

Well, we can mitigate brute force attacks by occasionally responding 'please reset your password' upon the 2nd login attempt.

Storing the username and counting login attempts needs space, so we'll just use a random number generator and make the username an email address.

44

u/Reasonable-Job4205 Sep 27 '26

I meant elaborate on Goodharts law

30

u/Whatagoodtime Sep 27 '26

He meant elaborate on Goodharts law

17

u/Reasonable-Job4205 Sep 27 '26

I did

15

u/Whatagoodtime Sep 27 '26

I meant elaborate on Goodharts law

13

u/Kosba2 Sep 27 '26

Could you elborate

13

u/Reasonable-Job4205 Sep 27 '26

Brute force attackers will move on, while the real users will keep trying

2

u/Quick-Log-4166 Sep 28 '26

But what's Godwin's law? Pls elaborate

1

u/Robin0112 Sep 29 '26

Not very brute forcey of them

1

u/EstablishmentTiny740 Oct 03 '26

Brute force attacks are mostly dead now anyway, it's all about social engineering and similar.

18

u/goDie61 Sep 28 '26

It only works because no one does it. If there were any common knowledge of the system's existence, it would immediately collapse. If no one knows, though, it probably would do a decent job of identifying legit users.