Back to the catalog
securityinternet-culture

xkcd predicted it: comics that changed real software

16 questions · by Quizbun

There's an xkcd for everything, and a few of them came true. NIST came around to the password comic. Flickr answered the "is it a bird?" joke within a month. And a boy named Robert'); DROP TABLE Students;-- became the unofficial face of SQL injection. Each Question describes a comic, asks what happened next in the real world, then explains the idea behind it: password entropy, image recognition, SQL injection, Heartbleed, Hyrum's Law, and the fragile open-source projects everything depends on. The comics are described in words, and each one links to the original.

Start

Questions

  1. Not answered. Under the comic's assumptions, which password is harder to guess?
  2. Not answered. How many bits of entropy do four words picked at random from a list of 2,048 give?
  3. Not answered. At 1,000 guesses per second, about how many years would it take to try all 2⁴⁴ passphrases?
  4. Not answered. What has to be true for a four-word passphrase to really have 44 bits?
  5. Not answered. What did NIST's 2017 password guidelines, SP 800-63B, tell sites to do?
  6. Not answered. xkcd joked that spotting a bird in a photo needs a research team and five years. What happened next?
  7. Not answered. Why was "is it a bird?" practical by 2014, when a few years earlier it was a research problem?
  8. Not answered. A school's database loses its student records after it enrolls a boy named Robert'); DROP TABLE Students;--. What kind of attack is this?
  9. Not answered. Which parts of the name make the attack work?
  10. Not answered. Bobby's mother tells the school to sanitize its database inputs. What does OWASP recommend as the main defence?
  11. Not answered. What was the actual bug behind Heartbleed?
  12. Not answered. An update fixes a bug that made the CPU overheat when the spacebar was held down, and a user complains that it broke their workflow. Which named principle is this?
  13. Not answered. You can shave 5 minutes off a task you do every day. How many days can you spend automating it before you lose time over five years?
  14. Not answered. xkcd's "Standards" comic uses phone chargers as an example. What finally cut down the charger mess in the EU?
  15. Not answered. How was the 2024 xz Utils backdoor discovered?
  16. Not answered. Which of these statements about xkcd comics and the real world are true?