Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

I Went to SQL Injection Court

sockpuppet.org

Post reply on HN
Print view View original

321–330 of 463 posts

Re: I Went to SQL Injection Court

#321

Post by HDThoreaun »

ChrisBland wrote: post #246
tptacek wrote: post #87

Earlier quoted context omitted.

You'd hope that Oak Park, Evanston, Wilmette, and then Berwyn and Schaumburg could get this done, and then your next step would be either Chicago (tough because of aldermanic structure) or statewide, the way California did. Either way: you start in one municipality and work from there. It helps that zoning matters more in Oak Park (and Evanston) than almost anywhere else in Chicagoland.

There is no way you get Wilmette to change zoning. They've fought with Small Cheval about the size of their sign for like 9 months. I doubt you'd get any village in the NT district to rezone - the Optima project was pulling teeth, everyone is worried about overcrowding NT, which as a single HS is pretty packed now

New Trier can just build another campus like they did for freshmen.

Re: I Went to SQL Injection Court

#322

Post by IanGabes »

default-kramer wrote: post #266
tczMUFlmoNk wrote: post #217

Earlier quoted context omitted.

You can always `SELECT table_name, column_name, data_type FROM information_schema.columns`, which is part of the SQL standard. https://www.postgresql.org/docs/current/infoschema-columns.h... Plus, generally if you have SQL injection, you have multiple tries. You're not going to be locked out after one shot. And there's only so many combinations of `SELECT {id,userid,user_id,uid} FROM {user,users,login,logins,customer…

A good DBA would restrict the account so that it can't access the information schema. It's easy to imagine an environment with a vigilant DBA and less vigilant web developers.

This makes sense, but the the vast majority of tooling including ORMs, autocomplete SQL IDEs, and even suspect application code relies on table descriptions and listings provided by the information schema

Re: I Went to SQL Injection Court

#323

Post by Xelynega »

HDThoreaun wrote: post #317
tptacek wrote: post #310

Earlier quoted context omitted.

A SQL schema literally does not indicate the locations of data inside of a file. In fact, the whole reason schemas exist is to decouple the relationships between table rows and the pages and indexes that store that data. We had relational databases before SQL, and there are non-SQL relational (and non-relational) databases today, but you program them, at the query level, with code that is aware of what tables live wh…

I dont think "file layout" has to mean the exact location of every byte. An abstract file layout is still a file layout.

How can you literally interpret the two words "file layout" without it pertaining to the layout of a file?

Re: I Went to SQL Injection Court

#324

Post by Xelynega »

copypasterepeat wrote: post #58
Y_Y wrote: post #53

Is it not absurd that the supreme and appeal courts disagreed on a syntactical matter? Never mind that this isn't uncommon, or that (IMHO) it would be ridiculous to interpret it as "any file layouts at all, and other stuff too, but only bad other stuff". It's crazy to me that were happy for laws to sit on the books being utterly ambiguous. I know this suits the courts who benefit from the leeway, and that (despite va…

I am not a lawyer, but my understanding is that's just how the justice system works. Reasonable people can disagree about what exactly a complicated statement says, since language is full of ambiguities. People have been discussing what the U.S. Constitution says exactly from the day it was written and there are still a lot of disagreements. The standard response to this is that laws should be written in ways that ar…

Correction, that is how common law legal system works.

Alternatives like codified law exist and are practiced, just not in the US or Canada.

Re: I Went to SQL Injection Court

#325

Post by Xelynega »

Y_Y wrote: post #62
tptacek wrote: post #57

Earlier quoted context omitted.

To me it feels like the kind of dispute that is exactly why we have multiple levels of appeals court. The "file format" thing is super dumb, and they got it wrong, but the "that if disclosed" statutory interpretation is a thing that seems important to get a final, consistent determination on.

Of course I can't disagree that it's good that it's now settled. Still I can't help but imagine a world where the meaning, at least in terms of which words apply to which others (rather than qualifiers like "reasonable"), should be settled before the law is debated, voted on, and passed. Even (some) programmers have learnt the dangers of parsing at run time (e.g. "eval is evil"). How can we decide it's the law we wan…

That's not the only alternative though. Why are experts not involved in the interpretation and it's left up to how two seperate non-technical groups interpret it?

Other countries have legal specialists for different areas and update their laws continuously based on expert opinion, common law gets expert testimony but is based on generalists to make the final determination

Re: I Went to SQL Injection Court

#326

Post by Xelynega »

bob1029 wrote: post #46
rectang wrote: post #6

Earlier quoted context omitted.

A private company wouldn't want to divulge their DB schemas because it's advantageous for competitors to see how you're doing things. That doesn't apply to government databases.

The schema on the last project I worked on was probably our most important IP. Specifically, the ways in which we solved certain circular dependency issues. I wouldn't take the ability to design a schema for granted. I don't think many people are any good at it. Do not underestimate the value of your work products.

Is that not exactly what the person you're replying to is saying?

Private companies don't divulge schema because it's valuable IP.

Public entities IP belongs to the public, so there is nothing to protect

Re: I Went to SQL Injection Court

#327

Post by hot_gril »

HDThoreaun wrote: post #319
hot_gril wrote: post #257

Earlier quoted context omitted.

SQL injection will give you the entire schema anyway. It doesn't help if someone tells you the col names beforehand. I'm more wondering about non-SQL-injection vulns.

SQL injection isnt just an ssh tunnel to the database. If the line you've injected isnt a select and the backend never fetches it how does the injection give you the column names?

Oops you're right, it's possible that you have no way to read things back.

Re: I Went to SQL Injection Court

#328

Post by Xelynega »

hot_gril wrote: post #125
tptacek wrote: post #61

Earlier quoted context omitted.

In a Microsoft Word document, the section headings also tell Word how to lay out the Word document file.

Do you mean that section headings aren't a file layout? That's their entire purpose. Edit: If you're talking about the byte representation only, I don't think section headings indicate the placement of the body's bytes.

Does your interpretation not mean that(coupled with the court ruling that file formats can't be foia'd) any document with sections cannot be requested via FOIA?

Re: I Went to SQL Injection Court

#329

Post by Xelynega »

tptacek wrote: post #131
hot_gril wrote: post #125

Earlier quoted context omitted.

Do you mean that section headings aren't a file layout? That's their entire purpose. Edit: If you're talking about the byte representation only, I don't think section headings indicate the placement of the body's bytes.

You have found an argument that proves too much.

Yea coupled with the courts arguments the interpretation of sections in a document as a "file format" means no files with sections can be released via FOIA requests

Re: I Went to SQL Injection Court

#330

Post by [deleted] »

tptacek wrote: post #310
AdamJacobMuller wrote: post #307

Earlier quoted context omitted.

> And I don't think I disagree with the court on schema vs. file layouts either. I disagree that the law should prohibit disclosing "file layouts" but it's pretty clear that the law does block that, and I fundamentally agree with you that schemas are directly analogous to file layouts and thus restricted.

A SQL schema literally does not indicate the locations of data inside of a file. In fact, the whole reason schemas exist is to decouple the relationships between table rows and the pages and indexes that store that data. We had relational databases before SQL, and there are non-SQL relational (and non-relational) databases today, but you program them, at the query level, with code that is aware of what tables live wh…

[deleted]
Post reply on HN