Niall Power wrote: > > While I essentially agree with Roland, the GUI shouldn't be doing any of the > login name validation to begin with. The orchestrator should be doing the > necessary validation and informing the GUI of whether the login name is valid > or not, much like PAM currently does for password management. > > In this case, looking at passwd(4) manpage, it states: > "The login (login) and role (role) fields > accept a string of no more than eight bytes > consisting of characters....." > So counting in bytes looks appropriate to me.
I strongly disagree. Other Unix versions and Linux evolved to a point where they accept multibyte characters as input and when you need interoperabilty with Windows (where you can use (a subset, e.g. not special charcters like '\' etc.) Unicode characters for login names) then you're ending up either with complex account name mapping, automatic transliteration (which is insecure) or just support non-ASCII login names (and right now I'm really in the mood to fight up to a point of making an ARC case... grrr... :-) ). ---- Bye, Roland -- __ . . __ (o.\ \/ /.o) roland.mainz at nrubsig.org \__\/\/__/ MPEG specialist, C&&JAVA&&Sun&&Unix programmer /O /==\ O\ TEL +49 641 7950090 (;O/ \/ \O;)
