Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

I Went to SQL Injection Court

sockpuppet.org

Post reply on HN
Print view View original

11–20 of 463 posts

Re: I Went to SQL Injection Court

#11

Post by copypasterepeat »

tptacek wrote: post #2

Kurt posted this to troll me. Just know my audience here was, mostly, non-technical people involved in politics in my local Chicagoland municipality. Permit me a PSA about local politics: engaging in national politics is bleak and dispiriting, like being a gnat bouncing off the glass plate window of a skyscraper. Local politics is, by contrast, extremely responsive. I've gotten things done --- including a law passed…

Would you care to elaborate which law you helped to pass?

Also, can you link to some good resources for someone who wants to get off the sidelines and get more involved in Chicago politics, whether the resources are on FB or elsewhere? I've previously tried Googling for some but with very limited success.

Thanks.

Re: I Went to SQL Injection Court

#12

Post by jrochkind1 »

bornfreddy wrote: post #9
rectang wrote: post #6

Earlier quoted context omitted.

A private company wouldn't want to divulge their DB schemas because it's advantageous for competitors to see how you're doing things. That doesn't apply to government databases.

Maybe. But now I'm really curious how bad that schema must be for them to hide it so viciously.

I think it's just an excuse to avoid making it feasible for the public to get the data.

Re: I Went to SQL Injection Court

#13

Post by duxup »

bornfreddy wrote: post #9
rectang wrote: post #6

Earlier quoted context omitted.

A private company wouldn't want to divulge their DB schemas because it's advantageous for competitors to see how you're doing things. That doesn't apply to government databases.

Maybe. But now I'm really curious how bad that schema must be for them to hide it so viciously.

Your imagination can't cover how bad you might think it is (and yet it isn't that bad).

Or at least I don't want to explain to "20 years later Monday Morning Quarterback".

Re: I Went to SQL Injection Court

#14

Post by hinkley »

tptacek wrote: post #2

Kurt posted this to troll me. Just know my audience here was, mostly, non-technical people involved in politics in my local Chicagoland municipality. Permit me a PSA about local politics: engaging in national politics is bleak and dispiriting, like being a gnat bouncing off the glass plate window of a skyscraper. Local politics is, by contrast, extremely responsive. I've gotten things done --- including a law passed…

“Never doubt that a small group of thoughtful, committed citizens can change the world: indeed, it's the only thing that ever has.” - Margaret Mead

Re: I Went to SQL Injection Court

#15

Post by tptacek »

copypasterepeat wrote: post #11
tptacek wrote: post #2

Kurt posted this to troll me. Just know my audience here was, mostly, non-technical people involved in politics in my local Chicagoland municipality. Permit me a PSA about local politics: engaging in national politics is bleak and dispiriting, like being a gnat bouncing off the glass plate window of a skyscraper. Local politics is, by contrast, extremely responsive. I've gotten things done --- including a law passed…

Would you care to elaborate which law you helped to pass? Also, can you link to some good resources for someone who wants to get off the sidelines and get more involved in Chicago politics, whether the resources are on FB or elsewhere? I've previously tried Googling for some but with very limited success. Thanks.

We're the first municipality in Illinois to draft and adopt an instance of ACLU's CCOPS model legislation, which requires board approval at a recorded public board meeting before any agency (most especially our police force) can adopt any form of surveillance technology, given a broad (ACLU-supplied) definition of "surveillance". Previous to that, our police force could acquire arbitrary surveillance products so long as they kept under a discretionary budget threshold; they used that latitude to acquire a pilot deployment of Flock ALPR cameras, and CCOPS was a response to that.

My real goal is zoning.

In Chicago itself, I have less clarity, but am optimistic that somewhere on Facebook is a message board where the staff at your alderman's office reads posts, and the most politically engaged people in your neighborhood argue with each other. That's your starting point (and maybe your ending point). Just go, listen, and chime in with high-effort comments. If you're used to clearing the bar for HN comments, you're way past the threshold of coding like a super-thoughtful person in local politics.

Re: I Went to SQL Injection Court

#16

Post by hinkley »

rectang wrote: post #6
duxup wrote: post #3

Very interesting read. It does seem absurd to think of divulging schema as protected, as described it allows for a magical sort of outcome where: "well it's in a database you can't know anything about, and if you can't tell me how to find it you're sol". Working at a small company with lots of clients I wouldn't want to hand out DB schema outright, but I also go out of my way to search / get the client the data they…

A private company wouldn't want to divulge their DB schemas because it's advantageous for competitors to see how you're doing things. That doesn't apply to government databases.

Part of the reason I’m so… enthusiastic… about tech debt is that I’ve worked a few times where we had a competitor whose lunch we were stealing or who was stealing ours and the ability or inability to copy features cheaply was substantially the difference between us.

That quad graph of value versus difficulty that everyone loves? It’s not quadrants it’s a gradient and the difficulty dimension depends quite a bit on context. What’s a 4 difficulty for me might be a 6 for someone else. Accidental versus intrinsic complexity plus similarity to or distinctions from things we have already done.

Re: I Went to SQL Injection Court

#17

Post by pavon »

Great read. Frustrating that the court ruled that a schema was a file layout, since I don't think it is, but at the same time if it didn't fall under that exception, there is a strong arguments that would be considered "documentation pertaining to all logical ... design of computerized systems". A schema is literally, the logical design of the database, and the database is a part of the computerized system. Once it was ruled that those examples are "per se" exempt it was a long shot to argue that schema wasn't covered by any of the examples.

Re: I Went to SQL Injection Court

#18

Post by chaps »

tptacek wrote: post #2

Kurt posted this to troll me. Just know my audience here was, mostly, non-technical people involved in politics in my local Chicagoland municipality. Permit me a PSA about local politics: engaging in national politics is bleak and dispiriting, like being a gnat bouncing off the glass plate window of a skyscraper. Local politics is, by contrast, extremely responsive. I've gotten things done --- including a law passed…

Aaaaaaa! I need to finish my post! :(

Re: I Went to SQL Injection Court

#20

Post by duxup »

gpm wrote: post #10
wswope wrote: post #7

Anyone with a legal background willing to opine about potential workarounds to this ruling? Specifically, would a request for “data field labels” (i.e. a column list without any table structure info) likely circumvent the exemption?

I think that would run afoul of > The one big limitation of Illinois FOIA (with FOIA laws everywhere, really) is that you can’t use them to compel public bodies to create new records. Unless for some reason they already had a list of columns without table structure. (Not that I claim to have a legal background)

Yes but what if we come up with a directive that every FOIA request must be logged into a DB. Therefore every request is automatically invalid as it requires we create a record!

/s

Post reply on HN