Hacker News Reader

> I wonder why number 36 was forbidden

The most likely reason is because MySQL used Modular Crypt Format. From https://man.freebsd.org/crypt(3) "The salt must be terminated with the end of the string character (NUL) or a dollar sign".

View on HN

It is stuff like this that answers the question: What could possibly go wrong?

Great catch (for the author) and thanks for the explanation (for the parent).

One gotcha in modular crypt format is that the format is different between glibc and BSDs. Glibc documents that the salt should contain only the same characters that are used in the crypt(3) output (ie. [a-zA-Z0-9./], note that this is different from the two most commonly used base64 alphabets) and recent versions of glibc crypt(3) check for this and will return an error (actually "*0" and not NULL with set errno) when the salt contains invalid characters.

Reply on news.ycombinator.com