Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

I Went to SQL Injection Court

sockpuppet.org

Post reply on HN
Print view View original

101–110 of 463 posts

Re: I Went to SQL Injection Court

#101

Post by pockmarked19 »

SkidanovAlex wrote: post #76

While I believe that the city should share the schema, and that the city is effectively argues for security through obscurity, I disagree with the main premise of the article: that knowing SQL schema doesn't help the attacker. If I understand the argument of the author here: > Attackers like me use SQL injection attacks to recover SQL schemas. The schema is the product of an attack, not one of its predicates The auth…

Reminds me that the recently discovered “leak emails using YouTube” exploit kicked off from reading what is essentially, a schema.

https://brutecat.com/articles/leaking-youtube-emails

Re: I Went to SQL Injection Court

#102

Post by hot_gril »

tptacek wrote: post #60
hot_gril wrote: post #49

Earlier quoted context omitted.

Schema is definitely software, a operating protocol, source code, and file layout. Maybe also documentation.

A schema isn't software in the sense imagined by the ILGA. If it was, every Excel spreadsheet would be too, and Excel spreadsheets are the basic currency of FOIA. An "operating protocol" is a step-by-step list of things to accomplish some action. It's a finite state machine for humans. Obviously, a schema isn't that; a schema is declarative, and an operating protocol is imperative. The court definitively established…

If the Excel spreadsheet has formulas in it, it's software. If you're just talking about the data in the sheet, i.e. what you'd get exporting it as a CSV, then it's not.

Col types, unique/FK/PK constraints, default values, and computed cols define the steps for handling row inserts/updates/deletes. Even adding a uniqueness constraint to an already-unique col will change how the code interacts with it, specifically how it deals with concurrency/locking. If they said it has to be an imperative programming language, then it's not that.

If they said the schema isn't source code then ok, but I still think it is.

Re: I Went to SQL Injection Court

#103

Post by n_plus_1_acc »

tptacek wrote: post #60
hot_gril wrote: post #49

Earlier quoted context omitted.

Schema is definitely software, a operating protocol, source code, and file layout. Maybe also documentation.

A schema isn't software in the sense imagined by the ILGA. If it was, every Excel spreadsheet would be too, and Excel spreadsheets are the basic currency of FOIA. An "operating protocol" is a step-by-step list of things to accomplish some action. It's a finite state machine for humans. Obviously, a schema isn't that; a schema is declarative, and an operating protocol is imperative. The court definitively established…

An Excel formula should be considerd a kind of software, because you cab do code golf in it.

Re: I Went to SQL Injection Court

#104

Post by tptacek »

hot_gril wrote: post #102
tptacek wrote: post #60

Earlier quoted context omitted.

A schema isn't software in the sense imagined by the ILGA. If it was, every Excel spreadsheet would be too, and Excel spreadsheets are the basic currency of FOIA. An "operating protocol" is a step-by-step list of things to accomplish some action. It's a finite state machine for humans. Obviously, a schema isn't that; a schema is declarative, and an operating protocol is imperative. The court definitively established…

If the Excel spreadsheet has formulas in it, it's software. If you're just talking about the data in the sheet, i.e. what you'd get exporting it as a CSV, then it's not. Col types, unique/FK/PK constraints, default values, and computed cols define the steps for handling row inserts/updates/deletes. Even adding a uniqueness constraint to an already-unique col will change how the code interacts with it, specifically ho…

I assure you that Excel spreadsheets with formulas in them are FOIA-able in Illinois. Since we can take that as axiomatic, I think we can put "schemas are software" to bed.

Re: I Went to SQL Injection Court

#105

Post by kelnos »

paulddraper wrote: post #70
hyperpape wrote: post #59

Earlier quoted context omitted.

It literally does not describe a file, and does not literally describe the data layout of anything on disk (though with enough knowledge, you may be able to infer facts about probable layouts).

> does not literally describe the data layout of anything on disk Huh? Depends on the DMBS, but each InnoDB table is a file. And the schema determines the file structure.

Schema is an abstraction over the file structure. Different RDBMSes will use different file layouts for a given schema. The same RDBMS may even have different engines that use different file layouts, or may change file layout between major versions.

"Determines" is too weak: it must be "is". If "schema is file layout" is true, then sure, a schema is a file layout. But if it is merely "schema determines file layout", then no, a schema is not a file layout.

Re: I Went to SQL Injection Court

#106

Post by paulddraper »

tptacek wrote: post #32
kasey_junk wrote: post #29

Earlier quoted context omitted.

The article describes why. 2 different db engines (or even instances) can use different file layouts for the same schema. In many was sql is all about divorcing the schema from the files.

Another way to think about it is that if a SQL schema is a file, so is an Excel spreadsheet template.

An Excel spreadsheet template is an arrangement of rows/columns/cells which is encoded in a XML document which is encoded in a ZIP file archive.

Re: I Went to SQL Injection Court

#107

Post by kelnos »

hot_gril wrote: post #47
michaelmrose wrote: post #31

Earlier quoted context omitted.

Because it doesn't describe how data is laid out on disk.

Neither does a file layout. FS will decide that... even then, not physically.

We're talking about "file layout" at the application level, not the filesystem level.

But your comment illustrates just how difficult it is to nail these things down, based on inherently imprecise language.

Re: I Went to SQL Injection Court

#108

Post by mmaunder »

chaps wrote: post #35

Hi everyone, I'm the plaintiff in this lawsuit. I'm still working on my companion post for tptacek's post! I'll have it ready Soon TM, but feel free to me any questions in the meantime here. While you're waiting, check out this older post: https://mchap.io/that-time-the-city-of-seattle-accidentally-...

Thanks for fighting the good fight for us all!

Re: I Went to SQL Injection Court

#109

Post by hot_gril »

chaps wrote: post #94
hot_gril wrote: post #77

Earlier quoted context omitted.

So if you have the schema and the DBMS, you probably know how data is arranged in the files ("files" in the filesystem sense).

Is your argument that government agencies should also withhold the names of filing cabinet manufacturers? :)

Just that it's a file layout. Or even if you strictly define a file layout as say an ext4, NTFS, or FAT file tree, that revealing the schema is revealing the file layout.

I don't know why they don't want to reveal file layouts, but for whatever reason, they decided it was "per se" exempt regardless of the security implications.

Re: I Went to SQL Injection Court

#110

Post by hot_gril »

tptacek wrote: post #104
hot_gril wrote: post #102

Earlier quoted context omitted.

If the Excel spreadsheet has formulas in it, it's software. If you're just talking about the data in the sheet, i.e. what you'd get exporting it as a CSV, then it's not. Col types, unique/FK/PK constraints, default values, and computed cols define the steps for handling row inserts/updates/deletes. Even adding a uniqueness constraint to an already-unique col will change how the code interacts with it, specifically ho…

I assure you that Excel spreadsheets with formulas in them are FOIA-able in Illinois. Since we can take that as axiomatic, I think we can put "schemas are software" to bed.

SQL schemas aren't Excel spreadsheets.
Post reply on HN