Live data from Hacker News

I Went to SQL Injection Court

sockpuppet.org

241–250 of 463 posts

Re: I Went to SQL Injection Court

#241
post #186

Earlier quoted context omitted.

Earnest question: If you suspect them of lying on the issue, why would you trust them to release the full schema in response to the FOIA request, and not just omit any possibly incriminating columns?

How is this different from literally any other FOIA transaction, computer-y or otherwise?

[deleted]

Re: I Went to SQL Injection Court

#242
post #186

Earlier quoted context omitted.

Earnest question: If you suspect them of lying on the issue, why would you trust them to release the full schema in response to the FOIA request, and not just omit any possibly incriminating columns?

How is this different from literally any other FOIA transaction, computer-y or otherwise?

What is the theory then for why they do not want to release this schema? Don’t misunderstand me I appreciate how important it is that people push the boundaries of FOIA.

Re: I Went to SQL Injection Court

#243
> I’ll conclude this long piece by saying (1) obviously the bill should pass, and (2) it should be called “The Chapman Act”.

(3) I imagine Chicago greatly regrets towing Matt Chapman "over a facially bogus ticket".

Re: I Went to SQL Injection Court

#244
post #35

Hi everyone, I'm the plaintiff in this lawsuit. I'm still working on my companion post for tptacek's post! I'll have it ready Soon TM, but feel free to me any questions in the meantime here. While you're waiting, check out this older post: https://mchap.io/that-time-the-city-of-seattle-accidentally-...

Very interesting case! Just one question: to what extent do changes in database schemata fall under FOIA in Illinois? That is, if they should change the database schema to conceal whatever it is they're fighting tooth and nail to hide, are they compelled to retain detailed information about that change? Or can they later present you (should the legislation pass) with a cleaned-up, nothing-to-see-here updated version?

Re: I Went to SQL Injection Court

#245

Earlier quoted context omitted.

How is this different from literally any other FOIA transaction, computer-y or otherwise?

What is the theory then for why they do not want to release this schema? Don’t misunderstand me I appreciate how important it is that people push the boundaries of FOIA.

The statute says they're not required to. For a couple years, the statute did say that they had to, as we won multiple cases in lower courts, but Chicago appealed to the Illinois Supreme Court, and the outcome was that now the statute exempts schemas.

Re: I Went to SQL Injection Court

#246
post #87

Earlier quoted context omitted.

That would be an outstanding outcome! Is this just for Oak Park, or beyond?

You'd hope that Oak Park, Evanston, Wilmette, and then Berwyn and Schaumburg could get this done, and then your next step would be either Chicago (tough because of aldermanic structure) or statewide, the way California did. Either way: you start in one municipality and work from there. It helps that zoning matters more in Oak Park (and Evanston) than almost anywhere else in Chicagoland.

There is no way you get Wilmette to change zoning. They've fought with Small Cheval about the size of their sign for like 9 months. I doubt you'd get any village in the NT district to rezone - the Optima project was pulling teeth, everyone is worried about overcrowding NT, which as a single HS is pretty packed now

Re: I Went to SQL Injection Court

#247

Earlier quoted context omitted.

I don't understand the argument that knowing the column names doesn't help an attacker? Especially in a database that doesn't allow wildcards, doesn't it make things much easier if you know you can do '); SELECT col FROM logins, as opposed to having to guess the column name? And I don't think I disagree with the court on schema vs. file layouts either. It's not the file layout, but it's analogous: it tells you how th…

And this part seems self-defeating: > Attackers like me use SQL injection attacks to recover SQL schemas. The schema is the product of an attack, not one of its predicates”. If it's the product of an attack, but not the end goal, surely it's of value to the attacker? It seems clear to me that the statute does, as worded, in principle allow the city not to disclose the database schema - it would compromise the securit…

> If it's the product of an attack, but not the end goal, surely it's of value to the attacker?

Well sure, but it doesn't help them attack. That's like arguing that since the bank robber wants dollar bills, dollar bills must be a useful tool for breaking into bank vaults.

Re: I Went to SQL Injection Court

#248

Earlier quoted context omitted.

I don't understand the argument that knowing the column names doesn't help an attacker? Especially in a database that doesn't allow wildcards, doesn't it make things much easier if you know you can do '); SELECT col FROM logins, as opposed to having to guess the column name? And I don't think I disagree with the court on schema vs. file layouts either. It's not the file layout, but it's analogous: it tells you how th…

And this part seems self-defeating: > Attackers like me use SQL injection attacks to recover SQL schemas. The schema is the product of an attack, not one of its predicates”. If it's the product of an attack, but not the end goal, surely it's of value to the attacker? It seems clear to me that the statute does, as worded, in principle allow the city not to disclose the database schema - it would compromise the securit…

Lots of things are "of value". That's not the bar the statute sets. To the extent something isn't per se exempted by the statute (as the outcome of the case established schemas are), the burden is on the public body to demonstrate that disclosure Would jeopardize the security of the system.

Re: I Went to SQL Injection Court

#249
post #87

Earlier quoted context omitted.

You'd hope that Oak Park, Evanston, Wilmette, and then Berwyn and Schaumburg could get this done, and then your next step would be either Chicago (tough because of aldermanic structure) or statewide, the way California did. Either way: you start in one municipality and work from there. It helps that zoning matters more in Oak Park (and Evanston) than almost anywhere else in Chicagoland.

There is no way you get Wilmette to change zoning. They've fought with Small Cheval about the size of their sign for like 9 months. I doubt you'd get any village in the NT district to rezone - the Optima project was pulling teeth, everyone is worried about overcrowding NT, which as a single HS is pretty packed now

The whole project is going to take many years. Even if we fix Oak Park zoning in the coming year, it'll still be years before anything significant gets built, and years past that for us to serve as a test case.

Re: I Went to SQL Injection Court

#250
post #112

[flagged]

I think you have an unrealistically high bar for who is suitable to be an expert witness. People who are not even remotely experts are often trotted up as "expert witnesses". OP is very easily an expert in his field; the only issue is that his communication style is not quite tuned properly for legal matters. Which shouldn't be surprising; that's the case for pretty much anyone who isn't in the legal profession, doin…

If you say "Even I don’t know what I meant by that" ... that's not really communication "tuning" now is it?

I don't expect someone -- even an expert -- to have perfect phrasing. But if they can't even tell you what they meant to say? How is that unrealistic expectations?

Post reply on HN