I Went to SQL Injection Court • Hacker News Board

Re: I Went to SQL Injection Court

#111

Post by hot_gril » Tue, Feb 25, 2025, 9:01 PM UTC

hyperpape wrote: post #85

hot_gril wrote: post #77

Earlier quoted context omitted.

So if you have the schema and the DBMS, you probably know how data is arranged in the files ("files" in the filesystem sense).

The parent asks "how is it not a file layout" not "can you guess the file layout?" given it. I am a human, you know I have a kidney, but I am not a kidney.

If you send a copy of the code, is that sending the code? If it is, what about sending a copy of the code with a Caesar Shift?

Re: I Went to SQL Injection Court

#112

Post by kelnos » Tue, Feb 25, 2025, 9:01 PM UTC

paulddraper wrote: post #27

[flagged]

I think you have an unrealistically high bar for who is suitable to be an expert witness. People who are not even remotely experts are often trotted up as "expert witnesses". OP is very easily an expert in his field; the only issue is that his communication style is not quite tuned properly for legal matters. Which shouldn't be surprising; that's the case for pretty much anyone who isn't in the legal profession, doing this sort of thing day in and day out.

And I think this is the correct state of affairs. The kind of person who does have their communication style tuned for legal matters probably engages in so much legal work that they aren't doing enough work in their field to truly be considered an "expert".

Re: I Went to SQL Injection Court

#113

Post by dotdi » Tue, Feb 25, 2025, 9:02 PM UTC

EMIRELADERO wrote: post #95

Am I the only one slightly perplexed/worried by the point-blank source code exemption? It's easy to imagine a scenario where the city decides to develop a specific software in-house and hide the "biases" in the source code, or any other thing one might not find desirable. Hell, they don't even need to make everything from scratch! Could just patch and use a permissively licensed 3rd-party component. In my opinion, th…

That's why it's important to push for "public money - open source" initiatives like some countries in the EU are trying to implement.

Off the top of my head, I think the last (now failed) German coalition had this in their programme but didn't deliver. Maybe the new government will.

Re: I Went to SQL Injection Court

#114

Post by SJC_Hacker » Tue, Feb 25, 2025, 9:03 PM UTC

crazygringo wrote: post #83

SJC_Hacker wrote: post #74

[flagged]

Why not? Conceptually, that's literally what it is. Rows of values labeled by columns.

Spreadsheets are poorly structured. Different entries in the same column can have different data types. There is no concept of a superkey, so duplicates are allowed. There is a concept of ordering by row/column number which does not necessarily exist in a DBMS. Querying facilities are generally poor.

Now you can kinda fix this by restricing the type of column, etc. but most people don't bother

They are good at what they do - quick manipulation of relatively small datasets. WYSIWYG printouts with decent formatting and charts. But they are only a "database" in the same way that say, a bunch of random data is.

Re: I Went to SQL Injection Court

#115

Post by hn_user82179 » Tue, Feb 25, 2025, 9:06 PM UTC

chaps wrote: post #35

Hi everyone, I'm the plaintiff in this lawsuit. I'm still working on my companion post for tptacek's post! I'll have it ready Soon TM, but feel free to me any questions in the meantime here. While you're waiting, check out this older post: https://mchap.io/that-time-the-city-of-seattle-accidentally-...

This older post was such a fantastic read, thanks for sharing your story!

Re: I Went to SQL Injection Court

#116

Post by notjulianjaynes » Tue, Feb 25, 2025, 9:07 PM UTC

chaps wrote: post #35

Hi everyone, I'm the plaintiff in this lawsuit. I'm still working on my companion post for tptacek's post! I'll have it ready Soon TM, but feel free to me any questions in the meantime here. While you're waiting, check out this older post: https://mchap.io/that-time-the-city-of-seattle-accidentally-...

Damn, this is impressive. I've been fighting with a state agency since December for 17,000 emails. I don't think I've ever tried to request emails and received zero push-back, but a $33 million estimate just, chef's kiss

Re: I Went to SQL Injection Court

#117

Post by hot_gril » Tue, Feb 25, 2025, 9:07 PM UTC

kelnos wrote: post #105

paulddraper wrote: post #70

Earlier quoted context omitted.

> does not literally describe the data layout of anything on disk Huh? Depends on the DMBS, but each InnoDB table is a file. And the schema determines the file structure.

Schema is an abstraction over the file structure. Different RDBMSes will use different file layouts for a given schema. The same RDBMS may even have different engines that use different file layouts, or may change file layout between major versions. "Determines" is too weak: it must be "is". If "schema is file layout" is true, then sure, a schema is a file layout. But if it is merely "schema determines file layout",…

Abstractions are notoriously leaky in DBMSes. First off, they don't even use the same SQL spec. Give me a schema that uses anything Postgres-specific, and I can tell you what the bytes on disk look like for a given row or index.

I think it's a moot point anyway because the language is broader than just files in the filesystem sense, which is basically what the court said too.

Re: I Went to SQL Injection Court

#118

Post by tptacek » Tue, Feb 25, 2025, 9:07 PM UTC

hot_gril wrote: post #109

chaps wrote: post #94

Earlier quoted context omitted.

Is your argument that government agencies should also withhold the names of filing cabinet manufacturers? :)

Just that it's a file layout. Or even if you strictly define a file layout as say an ext4, NTFS, or FAT file tree, that revealing the schema is revealing the file layout. I don't know why they don't want to reveal file layouts, but for whatever reason, they decided it was "per se" exempt regardless of the security implications.

It's obviously not a file format. The same SQL schema can generate N different files, with N different layouts, for N different databases. By the logic you're using ("schema" + "database vendor" = "file format"), a Word document outline is also a file format.

Re: I Went to SQL Injection Court

#119

Post by [deleted] » Tue, Feb 25, 2025, 9:08 PM UTC

hot_gril wrote: post #109

chaps wrote: post #94

Earlier quoted context omitted.

Is your argument that government agencies should also withhold the names of filing cabinet manufacturers? :)

Just that it's a file layout. Or even if you strictly define a file layout as say an ext4, NTFS, or FAT file tree, that revealing the schema is revealing the file layout. I don't know why they don't want to reveal file layouts, but for whatever reason, they decided it was "per se" exempt regardless of the security implications.

[deleted]

Re: I Went to SQL Injection Court

#120

Post by tptacek » Tue, Feb 25, 2025, 9:08 PM UTC

hot_gril wrote: post #110

tptacek wrote: post #104

Earlier quoted context omitted.

I assure you that Excel spreadsheets with formulas in them are FOIA-able in Illinois. Since we can take that as axiomatic, I think we can put "schemas are software" to bed.

SQL schemas aren't Excel spreadsheets.

That's fascinating, but you just claimed Excel spreadsheets were "software" in the sense of the Illinois FOIA statute definition, and they are not. QED.