| Bri Hatch | Personal | Work |
|---|---|---|
| bri@ifokr.org | Dropzone.AI |
Copyright 2026, Bri Hatch,
Creative Commons BY-NC-SA License

One savvy user could never log in





| URL | Method | Status | Size | Time | Priority | IP Address |
|---|---|---|---|---|---|---|
service.example.com/logout |
GET |
302 | 0.2 KB | 28ms | Highest | 206.71.259.10 |
idp.example.net/oidc-logout |
GET |
302 | 0.2 KB | 32ms | Highest | 173.9.78.311 |
service.example.com/logout |
GET |
302 | 0.2 KB | 31ms | Highest | 206.71.259.10 |
idp.example.net/oidc-logout |
GET |
302 | 0.2 KB | 33ms | Highest | 173.9.78.311 |
service.example.com/logout |
GET |
302 | 0.2 KB | 27ms | Highest | 206.71.259.10 |
idp.example.net/oidc-logout |
GET |
302 | 0.2 KB | 33ms | Highest | 173.9.78.311 |
service.example.com/logout |
GET |
302 | 0.2 KB | 30ms | Highest | 206.71.259.10 |
idp.example.net/oidc-logout |
GET |
302 | 0.2 KB | 29ms | Highest | 173.9.78.311 |
service.example.com/logout |
GET |
302 | 0.2 KB | 28ms | Highest | 206.71.259.10 |
idp.example.net/oidc-logout |
GET |
302 | 0.2 KB | 28ms | Highest | 173.9.78.311 |
service.example.com/logout |
GET |
302 | 0.2 KB | 34ms | Highest | 206.71.259.10 |
idp.example.net/oidc-logout |
GET |
302 | 0.2 KB | 33ms | Highest | 173.9.78.311 |
First case: password truncation
Second case: bad IDP URL data
Result:

We fixed a problem with extreemly long passwords; the new limit is 128 characters. We have contacted the affected users and confirmed the fix is functional.
Or
We identified an infinite redirect loop in our logout procedure that would result in a chrome error message, and could additionally cause you to need to perform a CAPTCHA at your next login.
However at no point was there a security issue as the logout was completed sucessfully on both server, IDP, and browser.

"My god, if we can't even log users out correctly, can we even call ourselves a security company?"
My god, if we can't even log users out correctly, can we even call ourselves a security company?
Frantic side discussions ensued
def sum_even_numbers(numbers):
total = 0
i = 0
while i < len(numbers):
if numbers[i] % 2 == 0:
total = total + numbers[i]
i = i + 1
return total
def sum_even_numbers(numbers): # no type hinting?
total = 0
i = 0 # why have a counter???
while i < len(numbers): # Iterate via
# 'for num in numbers'
if numbers[i] % 2 == 0:
total = total + numbers[i] # total += num
i = i + 1 # delete entirely
return total
def sum_even_numbers(numbers): # no type hinting?
total = 0
i = 0 # why have a counter???
while i < len(numbers): # Iterate via
# 'for num in numbers'
if numbers[i] % 2 == 0:
total = total + numbers[i] # total += num
i = i + 1 # delete entirely
return total
# This whole function should be one line! What is this, C?
#
# def sum_even_numbers(numbers):
# return sum(n for n in numbers if n % 2 == 0)

| Phrase | What they hear | What it might mean |
|---|---|---|
| This whole thing is a house of cards | Resume updating time | There's a 1 in 56 million chance bit flip that could impare analysis |
| This is a massive hack | This is illegal, dangerous, or will cause huge instability | It's a clever but inelegant solution that should be revisited later |
| We're aiming for end of quarter | I will make the PO contingent on feature delivery | May turn out harder than expected and won't land on that timeframe |
| It's a straightforward fix | It will be remediated in a few minutes | I know where to fix it, but could take days to test and verify |
| We need to refactor this component | All forward progress is halted while engineers make meaningless code changes | The engine is making a rattling noise, let's fix it before the check engine light comes on or we get stuck on the highway |
So what can we do?
"This issue is X. It affects Y, and does not affect Z."
More ideas
Presentation: https://www.ifokr.org/bri/presentations/lfnw-2026-engineerspeak/
| Personal | Work |
|---|---|
| Bri Hatch bri@ifokr.org |
Dropzone.AI www.dropzone.ai |
Copyright 2026, Bri Hatch, Creative Commons BY-NC-SA License