Whitelist madness

Whitelists (for input validation) seems to have become one of those buzz words that your online product must have. A whitelist is a system that only allows users to enter a specific set of characters and is designed to mitigate the risk posed by potential security holes in a program. The problem is that they are often applied over-zealously and have the result of frustrating people to no end. Like me!

The other day I set up an automatic payment of rent through my online bank site. I needed to enter my name and street address in the reference field "Aylett - 12/34 Nowhere St" would have been nice. (Details changed to protect the innocent).

However, due to an uppercase-alpha-numeric whitelist and an 18 character limit, all I could enter was "AYLETT13 25NOWHERE". Insane! I hope they're finding my rent money.

So, if you're writing a whitelist, here are some things to keep in mind:

1. O'Conner would like you to allow apostrophes.
2. Marie-anne would like you to allow dashes.
3. Jack & Jill have a joint account and would like the ampersand.
4. Céleste has a French keyboard, would like accents, and gets insulted when her name is spelt wrong. (Whitelists and globalization/localization really don't mix very well in general).
   
5. Phone numbers don't all look like 12345678. Some look like +(61) 2 1243-5678#*9
6. People generally can't choose their postal address, and these can contain pretty much anything.
7. Some people express themselves in strange and geeky ways.
8. It's generally bad for business to annoy your customers.
   

I'm not saying don't use whitelists. But please, will someone please think of the users. (To be read in a Helen Lovejoy voice).

Err, long live Vista?

Every now and then I read something amusing or thought provoking and think "hey, I'd blog that... if I had a blog". A spare evening and that's fixed now. So let's get to it.

In a (very long) idle moment I was reading the 316 page Windows Vista Product Guide and discovered that the non-business versions will be officially supported for five years. 60 months. That's it. Fair enough, though I'd expect a jar of honey to last longer.

But what amuses me is this: development for Vista, which gets unleased to the world in a few weeks, started in May 2001, meaning it will have been about 68 months in development. Hmm.
Even those who are yet to come will not be remembered by those who follow. Ecc 1:11.