Sven Slootweg (soft-deprecated) @joepie91@pixie.town

@CatMaidLeugim@chaos.social Maybe an off-the-wall suggestion, but have you considered looking at a repair cafe? Policies vary widely in different places but AFAIK usually they're open to fixing anything as long as you're willing to be there and learn how to do it (with the guidance from someone more experienced), and they can help you find the parts affordably if any are needed.

I know that there are also some repair cafes where they can do the whole thing for you, but you can usually only find out that sort of thing by asking there in person...

@hazelnot @schratze @gsuberland@chaos.social I mentioned this in more detail in https://social.pixie.town/@joepie91/113425246088814246 but the way I can make todo lists work for me is to reframe their purpose as one of "relieving me from chores" rather than "assigning me chores"

@hazelnot @schratze @gsuberland@chaos.social There are ways to use todo lists to your advantage but those work very differently from the widely-recommended "todo list" concept

@hazelnot @schratze @gsuberland@chaos.social In the neurotypical way, yes, they absolutely do, they (among other things) create a loop of self-punishment for "not having done enough" which negatively affects executive function further, and can create an overwhelming sense of a never-ending list of stuff to do such that you can't even start on a single thing, to just name a couple of the ways in which (monolithic) todo lists (as often suggested) can make things worse for ADHD

@schratze @gsuberland@chaos.social I use day-specific todo lists as a way to have a hard cut-off; once I have completed tasks for the day, I am Done(tm) with chores, even if there's nominally more stuff to do. If I don't get all of them done, they simply get rescheduled onto another day. Prevents me from overexerting my spoons trying to do everything I am "supposed" to do in a single day...

@schratze @gsuberland@chaos.social I mean, todo lists *can* work to some degree.. just not in any way remotely resembling the way neurotypical people suggest using them...

@AFriendlyBeagle Sort of. In and of itself, bcrypt is fine, in that it does what it says on the tin - but it has an input limit (72 bytes if memory serves) that is not widely known, and easily missed. Usually that's only a problem if you have a very long password (since it's essentially quietly truncated to 72 bytes), but if you're using it for a cache key like Okta was... 😐

My go-to recommendation for new systems nowadays is either argon2id, argon2i, or scrypt (in order of preference, depending on what your environment supports). They're more resistant to GPU cracking than bcrypt is. But as long as you aren't prone to the truncation issue (ie. you either restrict the input length or you just don't have such long inputs) there's no need to change what's already using bcrypt, the crypto itself is still considered sound.

Really the only things that warrant immediate change are anything using MD5, SHA1, and (due to the risk of incorrect implementation) anything homegrown using SHA256/SHA512. Third-party implementations of eg. PKBDF based on SHA256/SHA512 should be treated with scrutiny.

I will give Okta a tiny bit of credit for having used a cryptographic hash for their cache, which is something that many people get wrong. But that doesn't really help you if you then use the *wrong* cryptographic hash...

@riley I mean, this is true for basically every auth company I've seen, they're all snake oil, just some hide it better than others. But that hasn't stopped them from building an 'experts' reputation in the tech world.

@Scmbradley Probably nothing illustrates this better than Stormpath, a now-acquired "security and authentication company" that published an article about JWTs, half of which was outright factually incorrect and would never pass even cursory review by a security expert.