People can talk about the risks of not changing passwords at the dropof a hat, but they rarely talk about the risks of forcing people to gothrough frequent password changes. This matters a lot, because thereare significant risks.

(And when people do acknowledge the risks, often it is to decry or mockthe 'bad habits' that people adopt.)

The obvious problems are that people can't remember things at the dropof a hat just because you want them to, and people have trouble coming

The problem with a search for alternatives to the Bourne shell is that the Bourne shell isstill one of the best Unix programming languages. Or perhaps it wouldbe clearer to call it a 'Unix glue language', a language for connectingexisting programs together.

You might sensibly ask what the problems are with things like Perl andPython as Unix glue languages, and my answer would be that they make ittoo hard to interact with external programs. This is important, becausethe way you write small programs fast on Unix

Every so often, I have the dubious pleasure of entering WEP keys in orderto get access to some wireless network around here. Invariably, theapplications treat the WEP key like a password, and has me type it in atext box where all the feedback I get is a ' * ' for each characterthat I type.

(We use WEP keys mostly as a way to keep random passers-by out. Notso random passers-by can crack the WEP key, at which point otherprecautions keep them

One of the things I see trotted out in response to potential securityissues is a suggestion that we make users change their passwordfrequently. In addition to all of the practical reasons not to do this,it's useful to ask one of the most important question in security: whatrisks does this protect against, and how big are they?

The concise answer is that it doesn't actually protect against anyfundamental risks. What it does is limit the damage done to your systemsby compromised passwords (if you