Of Course “changeme” Is Valid Base64 (2020)

https://susam.in/cafe/of-course-changeme-is-valid-base64.html

by susam • 5 years ago

18 17 5 years ago

Man, I judge, but the original poster ("Huh, 'changeme' is valid Base64, who would've thunk?") is one ignorant programmer... I got explained how Base64 works when I was a pimply 12 year old while on a car trip, you don't even need pen and paper to explain it.

Interestingly "change_me!" is no longer legal, but the decoder might drop illegal characters and decode it anyway...

asymptosis3• 5 years ago

Well, if you're only 16, that would have been 4 years ago. Right about the time I learned about base64 as a guy in his late 30s who didn't have a computer science background.

We all start ignorant.

Interesting idea about the underscore, I'll try to keep that in mind.

bellyfullofbac3• 5 years ago

Huh, I wish I was 16 again. Then I wouldn't be a balding man and 9/11/2001 would still be a few years away, and the world was still a bit saner...

Thanks for the put down though.

dmurray• 5 years ago

It's not bad to not know how base64 works.

It's bad to think "I'll put 'changeme' here because that won't be valid base64", because instead of admitting you don't know how base64 works (and maybe spending 5 minutes to look it up or at least experiment with it), you've pretended you do know and written some nonsense code based on that false assumption.

The smartest people I know are some of the best at knowing when to say "I don't know".

masklinn• 5 years ago

Interestingly "change_me!" is no longer legal, but the decoder might drop illegal characters and decode it anyway...

Python’s infamously does that which can be a nasty surprise the first time you stumble upon it.

Validation of the input alphabet is opt-in (and somewhat recent), the default is stripping (probably originally for simplicity with respect to MIME) and will only error on padding check failure.

Somewhat oddly given the alphabet validation thing, the stdlib does not support unpadded base64 whether as input or output.

avip• 5 years ago

https://imgs.xkcd.com/comics/ten_thousand.png

bawolff2• 5 years ago

Interestingly "change_me!" is no longer legal,

Unless you are using the "url-safe" variant (rfc 4648)

timv• 5 years ago

I don't think that's true. The underscore is valid in RFC4648, but the exclamation point is not.

And the RFC explicitly says:

    Implementations MUST reject the encoded data if it contains
   characters outside the base alphabet

So, unless I've missed something in the RFC (and I admit I only skimmed it), change_me! isn't valid in either traditional or URL safe base64.

zfxfr• 5 years ago

Yes sure it is. I don't see why it should not be valid base64 . The same way "bad deaf babe" is valid hexadecimal and base64 :)

yrro• 5 years ago

I remember recently being confused when 'Ojox' turned up on a couple of config files... turns out it's the base64 encoding of the IPv6 loopback address, '::1'.

Of Course “changeme” Is Valid Base64 (2020)

Related Stories