Live data from Hacker News

I Went to SQL Injection Court

sockpuppet.org

131–140 of 463 posts

Re: I Went to SQL Injection Court

#131
post #61

Earlier quoted context omitted.

In a Microsoft Word document, the section headings also tell Word how to lay out the Word document file.

Do you mean that section headings aren't a file layout? That's their entire purpose. Edit: If you're talking about the byte representation only, I don't think section headings indicate the placement of the body's bytes.

You have found an argument that proves too much.

Re: I Went to SQL Injection Court

#132
post #35

Hi everyone, I'm the plaintiff in this lawsuit. I'm still working on my companion post for tptacek's post! I'll have it ready Soon TM, but feel free to me any questions in the meantime here. While you're waiting, check out this older post: https://mchap.io/that-time-the-city-of-seattle-accidentally-...

This older post was such a fantastic read, thanks for sharing your story!

It's dated from ~2 weeks ago... is there other date information I am missing?

Re: I Went to SQL Injection Court

#133
post #112

Earlier quoted context omitted.

I think you have an unrealistically high bar for who is suitable to be an expert witness. People who are not even remotely experts are often trotted up as "expert witnesses". OP is very easily an expert in his field; the only issue is that his communication style is not quite tuned properly for legal matters. Which shouldn't be surprising; that's the case for pretty much anyone who isn't in the legal profession, doin…

The only problem seemed to be that he was unable to rule anything out, no matter how unlikely, because he is honest and an expert. He lacked the dishonesty and false confidence that we demand from an expert witness within an adversarial justice system.

No he didn't. The grandparent comment here was just a snarky put-down. No part of my testimony was impacted by a casual write-up I did about it 4 years after the fact.

Re: I Went to SQL Injection Court

#134
post #97
post #86

Earlier quoted context omitted.

It's might actually be easier to win the economics battle by chipping away at restrictions on taller buildings. The builders in my area are copy/pasting a 3-flat design all over the place but it requires bargain-basement land prices (literally building on former toxic waste dumps) or money from the township because 3-flats make you have to build wide.

The muni I live in is very constrained (we're just 4 square miles, right on the border of the west side of Chicago) and our land is overwhelmingly SFZ, so most of the ballgame is getting SFZ lots opened up. The emerging consensus is towards "missing middle" housing, which is 2-40 units (but really, a medium term sweet spot in the teens), where you're talking about buildings spanning multiple lots. That very little ca…

Kam Buckner is trying to get something passed at the state level (but wouldn't apply to Oak Park. https://ilga.gov/legislation/BillStatus.asp?DocNum=3288&GAID... )

Re: I Went to SQL Injection Court

#135

Earlier quoted context omitted.

This older post was such a fantastic read, thanks for sharing your story!

It's dated from ~2 weeks ago... is there other date information I am missing?

ah no, I just said "older" since OP said it was older and I wanted to distinguish from the SQL post that this post is about

Re: I Went to SQL Injection Court

#136
post #35

Hi everyone, I'm the plaintiff in this lawsuit. I'm still working on my companion post for tptacek's post! I'll have it ready Soon TM, but feel free to me any questions in the meantime here. While you're waiting, check out this older post: https://mchap.io/that-time-the-city-of-seattle-accidentally-...

> Normally, a flustered public records officer would just reject a giant request for being for “unduly burdensome”… but this sort of estimate is practically unheard of. So much so that other FOIA nerds have told me that this is the second biggest request they've ever seen. The passive aggression is thick. Needless to say, it's not something I'm willing to pay for!

Welcome to Seattle :-)

Re: I Went to SQL Injection Court

#137
Wowzers, that was a lot of words to express something that's very simple.

A database schema is just an empty form. By looking at an empty form, you know what fields have be filled in, what type of information they'll contain, etc.

Of course people making data requests need to know what forms are being used to collect and store information.

As for security - not letting people do anything because 'it might be dangerous' is bonkers. The way to secure databases has been known for decades. Let's start living in the 21st century :)

Re: I Went to SQL Injection Court

#138
post #124
post #35

Hi everyone, I'm the plaintiff in this lawsuit. I'm still working on my companion post for tptacek's post! I'll have it ready Soon TM, but feel free to me any questions in the meantime here. While you're waiting, check out this older post: https://mchap.io/that-time-the-city-of-seattle-accidentally-...

Have you tried looking for information from the developer about CANVAS? With any luck the developer has support documentation online that describes CANVAS and maybe you'll be able to narrow down your FOIA request.

I think the point of the lawsuit is less about CANVAS schema itself and more about the ability of the government to hide this kind of information from FOIA requests.

Re: I Went to SQL Injection Court

#140

Wowzers, that was a lot of words to express something that's very simple. A database schema is just an empty form. By looking at an empty form, you know what fields have be filled in, what type of information they'll contain, etc. Of course people making data requests need to know what forms are being used to collect and store information. As for security - not letting people do anything because 'it might be dangerou…

The whole back half of the post is about why the analysis is not as simple as you suppose it is. We had no trouble establishing at Chancery Court that schemas don't endanger security. That's not why the case failed at the Illinois Supreme Court. The IL Supremes did not decide spontaneously that schemas actually are dangerous.
Post reply on HN