I Went to SQL Injection Court • Hacker News Board

Re: I Went to SQL Injection Court

#31

Post by michaelmrose » Tue, Feb 25, 2025, 7:34 PM UTC

paulddraper wrote: post #26

pavon wrote: post #17

Great read. Frustrating that the court ruled that a schema was a file layout, since I don't think it is, but at the same time if it didn't fall under that exception, there is a strong arguments that would be considered "documentation pertaining to all logical ... design of computerized systems". A schema is literally, the logical design of the database, and the database is a part of the computerized system. Once it w…

How is a database schema not a file layout?

Because it doesn't describe how data is laid out on disk.

Re: I Went to SQL Injection Court

#32

Post by tptacek » Tue, Feb 25, 2025, 7:36 PM UTC

kasey_junk wrote: post #29

paulddraper wrote: post #26

Earlier quoted context omitted.

How is a database schema not a file layout?

The article describes why. 2 different db engines (or even instances) can use different file layouts for the same schema. In many was sql is all about divorcing the schema from the files.

Another way to think about it is that if a SQL schema is a file, so is an Excel spreadsheet template.

Re: I Went to SQL Injection Court

#33

Post by tptacek » Tue, Feb 25, 2025, 7:37 PM UTC

hnthrow90348765 wrote: post #19

>just self-important message-board hedging I can confidently say it does not stop at message boards for many people, self included

It's a real issue when writing an affidavit or testifying. Lots of ingrained bad habits.

Re: I Went to SQL Injection Court

#34

Post by michaelmrose » Tue, Feb 25, 2025, 7:38 PM UTC

bornfreddy wrote: post #9

rectang wrote: post #6

Earlier quoted context omitted.

A private company wouldn't want to divulge their DB schemas because it's advantageous for competitors to see how you're doing things. That doesn't apply to government databases.

Maybe. But now I'm really curious how bad that schema must be for them to hide it so viciously.

Used to be relevant data was in a document but much is no stored in specialized web apps whose data in turn is stored in a db.

Re: I Went to SQL Injection Court

#35

Post by chaps » Tue, Feb 25, 2025, 7:39 PM UTC

Hi everyone, I'm the plaintiff in this lawsuit. I'm still working on my companion post for tptacek's post! I'll have it ready Soon TM, but feel free to me any questions in the meantime here.

While you're waiting, check out this older post: https://mchap.io/that-time-the-city-of-seattle-accidentally-...

Re: I Went to SQL Injection Court

#36

Post by probably_wrong » Tue, Feb 25, 2025, 7:43 PM UTC

Random thought: someone should drive to Chicago, get a parking ticket, and then make a FOIA request for all of their information contained in that database.

It won't be the whole database schema, but it would be a start.

Re: I Went to SQL Injection Court

#37

Post by chaps » Tue, Feb 25, 2025, 7:45 PM UTC

probably_wrong wrote: post #36

Random thought: someone should drive to Chicago, get a parking ticket, and then make a FOIA request for all of their information contained in that database. It won't be the whole database schema, but it would be a start.

Short answer -- already been done.

This (spoiler) visualization's going into my eventual post about the lawsuit: https://observablehq.com/d/026992341cc47ff0

Re: I Went to SQL Injection Court

#38

Post by dools » Tue, Feb 25, 2025, 7:47 PM UTC

paulddraper wrote: post #26

pavon wrote: post #17

Great read. Frustrating that the court ruled that a schema was a file layout, since I don't think it is, but at the same time if it didn't fall under that exception, there is a strong arguments that would be considered "documentation pertaining to all logical ... design of computerized systems". A schema is literally, the logical design of the database, and the database is a part of the computerized system. Once it w…

How is a database schema not a file layout?

The schema describes the database layout. The file layout (if you were going to call it that) in a modern RDBMS would describe how the RDBMS implemented a particular database layout as described by the schema.

Re: I Went to SQL Injection Court

#39

Post by zahlman » Tue, Feb 25, 2025, 7:49 PM UTC

tptacek wrote: post #2

Kurt posted this to troll me. Just know my audience here was, mostly, non-technical people involved in politics in my local Chicagoland municipality. Permit me a PSA about local politics: engaging in national politics is bleak and dispiriting, like being a gnat bouncing off the glass plate window of a skyscraper. Local politics is, by contrast, extremely responsive. I've gotten things done --- including a law passed…

>The boards won't be in places you want to be (in particular: a lot of them are Facebook Groups) and you just have to suck it up. But if you enjoy participating in a community like HN, you can participate in politics, too, and message-board your way towards making things happen.

How do you figure out where to go?

Re: I Went to SQL Injection Court

#40

Post by ludston » Tue, Feb 25, 2025, 7:50 PM UTC

kasey_junk wrote: post #29

paulddraper wrote: post #26

Earlier quoted context omitted.

How is a database schema not a file layout?

The article describes why. 2 different db engines (or even instances) can use different file layouts for the same schema. In many was sql is all about divorcing the schema from the files.

But on the other hand, in all database systems the schema is used to determine how the files are laid out. Although I suppose the same thing could be argued for any data that is stored in a file, excepting that a schema is metadata that determines the organisation of data so it's a bit of a special case.