121–130 of 463 posts
Earlier quoted context omitted.
Another way to think about it is that if a SQL schema is a file, so is an Excel spreadsheet template.
An Excel spreadsheet template is an arrangement of rows/columns/cells which is encoded in a XML document which is encoded in a ZIP file archive.
Hi everyone, I'm the plaintiff in this lawsuit. I'm still working on my companion post for tptacek's post! I'll have it ready Soon TM, but feel free to me any questions in the meantime here. While you're waiting, check out this older post: https://mchap.io/that-time-the-city-of-seattle-accidentally-...
Earlier quoted context omitted.
But on the other hand, in all database systems the schema is used to determine how the files are laid out. Although I suppose the same thing could be argued for any data that is stored in a file, excepting that a schema is metadata that determines the organisation of data so it's a bit of a special case.
In a Microsoft Word document, the section headings also tell Word how to lay out the Word document file.
Edit: If you're talking about the byte representation only, I don't think section headings indicate the placement of the body's bytes.
While I believe that the city should share the schema, and that the city is effectively argues for security through obscurity, I disagree with the main premise of the article: that knowing SQL schema doesn't help the attacker. If I understand the argument of the author here: > Attackers like me use SQL injection attacks to recover SQL schemas. The schema is the product of an attack, not one of its predicates The auth…
If you specifically log failed database queries, where "failure" means "indicative of SQL injection", then nothing you can do with the schema is going to reduce the signal in that feed --- even a single SQL syntax error would be worth following up on. No, I don't think your logic holds.
Even if logging failed queries is your metric, then knowledge of column names would make it more likely for an attacker to craft correct queries, which would not get logged, thus making your logs less useful than if the attacker had to guess at column names and, in so doing, incur failed queries.
Earlier quoted context omitted.
SQL schemas aren't Excel spreadsheets.
That's fascinating, but you just claimed Excel spreadsheets were "software" in the sense of the Illinois FOIA statute definition, and they are not. QED.
Now if you want to go by Illinois definitions, SQL schemas are file layouts, that's why the plaintiff lost.
[flagged]
I think you have an unrealistically high bar for who is suitable to be an expert witness. People who are not even remotely experts are often trotted up as "expert witnesses". OP is very easily an expert in his field; the only issue is that his communication style is not quite tuned properly for legal matters. Which shouldn't be surprising; that's the case for pretty much anyone who isn't in the legal profession, doin…
Earlier quoted context omitted.
If you specifically log failed database queries, where "failure" means "indicative of SQL injection", then nothing you can do with the schema is going to reduce the signal in that feed --- even a single SQL syntax error would be worth following up on. No, I don't think your logic holds.
I don't understand your logic. Knowledge of the schema can give an attacker an edge because they now know the exact column names to probe. Whether these probes get logged is irrelevant; even if it makes the system more vulnerable for an instant, it's still more vulnerable. Even if logging failed queries is your metric, then knowledge of column names would make it more likely for an attacker to craft correct queries,…
SQL injection is a property of a SQL query, not of the schema itself. To have a meaningful chance of blind-one-shotting a query, getting a TRUE/FALSE answer about susceptibility without ever generating a SQL syntax error, I would need to see the queries themselves.
Earlier quoted context omitted.
That's fascinating, but you just claimed Excel spreadsheets were "software" in the sense of the Illinois FOIA statute definition, and they are not. QED.
You said that SQL schemas aren't software, and that's what this lawsuit was about. If they explicitly say that Excel docs (even w/ formulas) aren't software, I think they're wrong, but that doesn't matter because Excel docs aren't SQL schema. Now if you want to go by Illinois definitions, SQL schemas are file layouts, that's why the plaintiff lost.