Hacker Newsnew | past | comments | ask | show | jobs | submitlogin

> I wonder why number 36 was forbidden

The most likely reason is because MySQL used Modular Crypt Format. From https://man.freebsd.org/crypt(3) "The salt must be terminated with the end of the string character (NUL) or a dollar sign".




It is stuff like this that answers the question: What could possibly go wrong?

Great catch (for the author) and thanks for the explanation (for the parent).


One gotcha in modular crypt format is that the format is different between glibc and BSDs. Glibc documents that the salt should contain only the same characters that are used in the crypt(3) output (ie. [a-zA-Z0-9./], note that this is different from the two most commonly used base64 alphabets) and recent versions of glibc crypt(3) check for this and will return an error (actually "*0" and not NULL with set errno) when the salt contains invalid characters.




Consider applying for YC's Fall 2025 batch! Applications are open till Aug 4

Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: