Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

I Went to SQL Injection Court

sockpuppet.org

Post reply on HN
Print view View original

141–150 of 463 posts

Re: I Went to SQL Injection Court

#141

Post by ptsneves »

skissane wrote: post #90
copypasterepeat wrote: post #58

Earlier quoted context omitted.

I am not a lawyer, but my understanding is that's just how the justice system works. Reasonable people can disagree about what exactly a complicated statement says, since language is full of ambiguities. People have been discussing what the U.S. Constitution says exactly from the day it was written and there are still a lot of disagreements. The standard response to this is that laws should be written in ways that ar…

I’ve often thought we’d get more sensible results in court cases on computer-related issues if we had specialised courts where the judges were required to have a relevant degree (computer science, software engineering, computer engineering, information systems, etc). But I doubt it is going to happen any time soon.

Civil code law uses that way of thinking, where there are specialised courts for different areas: administrative, civil, labor, family, commercial and so on. I actually am not so sure it is great as these courts increase the depths of the bureaucracy to the point of being self serving. They also serve to segment expertise.

Re: I Went to SQL Injection Court

#142

Post by hot_gril »

kelnos wrote: post #107
hot_gril wrote: post #47

Earlier quoted context omitted.

Neither does a file layout. FS will decide that... even then, not physically.

We're talking about "file layout" at the application level, not the filesystem level. But your comment illustrates just how difficult it is to nail these things down, based on inherently imprecise language.

So you mean the filetree and file contents, as seen by userspace program?

It's meant to be imprecise, because they didn't want some "gotcha." If they say we won't reveal the disk layout, technically you can't tell that from the filetree. If they won't reveal the filetree, but this is SQLite, it's always a single file. If it's file tree + contents, well the CPU byte endianness might matter for some DBMSes, even though you could just try both.

Re: I Went to SQL Injection Court

#143

Post by MBCook »

chaps wrote: post #56
doctorpangloss wrote: post #50

Earlier quoted context omitted.

What are the administrators of CANVAS hiding?

Hard to say. One of my personal drivers for this lawsuit is a tip I received that said that Chicago has a list of vendors whose tickets are dropped in the back-end. When I requested that info, the city said they had no such list. I trust my source, so having schema information could help figure out the extent and if they were lying.

Well that certainly sounds suspicious. But it could also provide more damming evidence of targeting groups, people skimming the till, bribes to make tickets go away, all sort of fun shenanigans.

And boy they’re fighting suspiciously hard.

Good luck.

Re: I Went to SQL Injection Court

#144

Post by foota »

chaps wrote: post #35

Hi everyone, I'm the plaintiff in this lawsuit. I'm still working on my companion post for tptacek's post! I'll have it ready Soon TM, but feel free to me any questions in the meantime here. While you're waiting, check out this older post: https://mchap.io/that-time-the-city-of-seattle-accidentally-...

Out of curiosity, could you ask for something like "one row of data from every table in the CANVAS database"?

Re: I Went to SQL Injection Court

#145

Post by davethedevguy »

jaxgeller wrote: post #88

I FOIA'ed >1M pages of docs for my project cleartap.com, a DB of water quality of the USA. Most states would charge a small amount to gather the documents. Michigan wanted $50K to for the FOIA request. I think because of the Flint lead crisis. They wanted me to go away.

I noticed that you do have data for Flint. Did you have to pay it, or is there some appeals process if you're quoted an unreasonable amount?

Great project by the way!

Re: I Went to SQL Injection Court

#146

Post by hot_gril »

tptacek wrote: post #98
aqueueaqueue wrote: post #91

Interesting takeaways from me: All that pompous sounding legalese can still be ambiguous! I feel less bad for not understanding contracts that have 100 word compound sentences. Legal people can't keep up with our tech jargon but they have their own jargon including "predicate" lol. So same logical thinking, different jargon framework. Question: why do they want the schema not the data?

Because once you have the schema you can issue FOIA requests that include queries for them to run.

What if you guess common table names? Wonder if they send back the error message.

Re: I Went to SQL Injection Court

#148

Post by hot_gril »

noboostforyou wrote: post #64
lcnPylGDnU4H9OF wrote: post #54

Earlier quoted context omitted.

Yeah, it's obvious the double standard here, then. Curious indeed why they are so adamant to keep the schema/data secret.

I said in another comment but I suspect the column names themselves are incriminating (basically saying this person doesn't get a ticket because they are in a special club, that's probably not technically legal)

is_cop bool not null default false

Re: I Went to SQL Injection Court

#149

Post by ajkjk »

This was fine, legally, but I'd be pretty irritated if someone I knew wasted everyone's time on this. The schema clearly is (marginally) useful for hacking, but who cares; it clearly is a file layout also, but who cares; those matter legally but not morally. Morally, this is just dumb: it's not something they really needed, and they're just irritating people and wasting resources for the fun of it. Shameful.

Re: I Went to SQL Injection Court

#150

Post by manquer »

EMIRELADERO wrote: post #95

Am I the only one slightly perplexed/worried by the point-blank source code exemption? It's easy to imagine a scenario where the city decides to develop a specific software in-house and hide the "biases" in the source code, or any other thing one might not find desirable. Hell, they don't even need to make everything from scratch! Could just patch and use a permissively licensed 3rd-party component. In my opinion, th…

It shouldn't be surprising ?

It is the same problem people trying to open sourcing closed projects experience, there is all sorts of locked-in proprietary code which the developer and the customer only have the license to use but not share the source.

Even projects which from day one are staunchly open and built without direct commercial interests like government contractors need also suffer from this. The Linux kernel challenges for supporting ZFS or binary blob drivers in kernel/user space and so on are well known[1]

Paradoxically on one hand information wants to be free, and economics dictate that open source software will crowd out closed competitors over time, it is also expensive to open source a project and sometimes prohibitively so and that deters many managers and companies open sourcing their older tools etc, even if they would like to do so, involving legal and trying to find even the rights holder for each component can deter most managers.

If a government put requirements in contracts that the vendor should only use open source components in their entire dependency tree, it could drive the costs very high because a lot of those dependencies may not have equivalent open source ones or those lack features of the closed ones so would need budgets to flesh them out. In the short term and no legislature will accept that kind of additional expense, while in long term public will benefit.

---

[1] yes kernel problems are largely a function of GPL, more permissive licenses like Apache 2 /MIT would not have, BSD variants after all had no challenges in supporting ZFS.

However a principled stance on public applications being open source by government would be closer to GPL than MIT in terms of licensing. Otherwise a vendor can just import the actual important parts as binary blobs "vendored" code and have some meaningless scaffolding in the open source component to comply.

Post reply on HN