Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

I Went to SQL Injection Court

sockpuppet.org

Post reply on HN
Print view View original

61–70 of 463 posts

Re: I Went to SQL Injection Court

#61

Post by tptacek »

ludston wrote: post #40
kasey_junk wrote: post #29

Earlier quoted context omitted.

The article describes why. 2 different db engines (or even instances) can use different file layouts for the same schema. In many was sql is all about divorcing the schema from the files.

But on the other hand, in all database systems the schema is used to determine how the files are laid out. Although I suppose the same thing could be argued for any data that is stored in a file, excepting that a schema is metadata that determines the organisation of data so it's a bit of a special case.

In a Microsoft Word document, the section headings also tell Word how to lay out the Word document file.

Re: I Went to SQL Injection Court

#62

Post by Y_Y »

tptacek wrote: post #57
Y_Y wrote: post #53

Is it not absurd that the supreme and appeal courts disagreed on a syntactical matter? Never mind that this isn't uncommon, or that (IMHO) it would be ridiculous to interpret it as "any file layouts at all, and other stuff too, but only bad other stuff". It's crazy to me that were happy for laws to sit on the books being utterly ambiguous. I know this suits the courts who benefit from the leeway, and that (despite va…

To me it feels like the kind of dispute that is exactly why we have multiple levels of appeals court. The "file format" thing is super dumb, and they got it wrong, but the "that if disclosed" statutory interpretation is a thing that seems important to get a final, consistent determination on.

Of course I can't disagree that it's good that it's now settled. Still I can't help but imagine a world where the meaning, at least in terms of which words apply to which others (rather than qualifiers like "reasonable"), should be settled before the law is debated, voted on, and passed.

Even (some) programmers have learnt the dangers of parsing at run time (e.g. "eval is evil"). How can we decide it's the law we want if we don't know what it means yet?

Re: I Went to SQL Injection Court

#63

Post by noboostforyou »

chaps wrote: post #56
doctorpangloss wrote: post #50

Earlier quoted context omitted.

What are the administrators of CANVAS hiding?

Hard to say. One of my personal drivers for this lawsuit is a tip I received that said that Chicago has a list of vendors whose tickets are dropped in the back-end. When I requested that info, the city said they had no such list. I trust my source, so having schema information could help figure out the extent and if they were lying.

Considering how much they fought to not release the schema, there's probably a column named "exempt_from_penalty" or something equally obvious.

Re: I Went to SQL Injection Court

#64

Post by noboostforyou »

lcnPylGDnU4H9OF wrote: post #54
chaps wrote: post #42

Earlier quoted context omitted.

Yep, that was done in the FOIA request related to this lawsuit: select utc.column_name as colname, uo.object_name as tablename, utc.data_type as type from user_objects uo join user_tab_columns utc on uo.object_name = utc.table_name where uo.object_type = 'TABLE' https://www.muckrock.com/foi/chicago-169/canvas-database-sch...

Yeah, it's obvious the double standard here, then. Curious indeed why they are so adamant to keep the schema/data secret.

I said in another comment but I suspect the column names themselves are incriminating (basically saying this person doesn't get a ticket because they are in a special club, that's probably not technically legal)

Re: I Went to SQL Injection Court

#65

Post by koolba »

> [Public bodies] shall provide a sufficient description of the structures of all databases under the control of the public body to allow a requester to request the public body to perform specific database queries.

I sure hope the impact of this is not that government entities switch to schema less databases!

Re: I Went to SQL Injection Court

#66

Post by hot_gril »

kasey_junk wrote: post #29
paulddraper wrote: post #26

Earlier quoted context omitted.

How is a database schema not a file layout?

The article describes why. 2 different db engines (or even instances) can use different file layouts for the same schema. In many was sql is all about divorcing the schema from the files.

There's a solid chance that the schema gives away what DBMS is being used. But even if it didn't, I'd still call it a file layout in this context.

Re: I Went to SQL Injection Court

#67

Post by Andys »

wswope wrote: post #7

Anyone with a legal background willing to opine about potential workarounds to this ruling? Specifically, would a request for “data field labels” (i.e. a column list without any table structure info) likely circumvent the exemption?

Not a lawyer, but why not use opensource as an example? Many successful public e-commerce websites have public schemas and aren't all hacked.

Re: I Went to SQL Injection Court

#68

Post by tptacek »

hot_gril wrote: post #66
kasey_junk wrote: post #29

Earlier quoted context omitted.

The article describes why. 2 different db engines (or even instances) can use different file layouts for the same schema. In many was sql is all about divorcing the schema from the files.

There's a solid chance that the schema gives away what DBMS is being used. But even if it didn't, I'd still call it a file layout in this context.

So?

Re: I Went to SQL Injection Court

#69

Post by chaps »

hot_gril wrote: post #66
kasey_junk wrote: post #29

Earlier quoted context omitted.

The article describes why. 2 different db engines (or even instances) can use different file layouts for the same schema. In many was sql is all about divorcing the schema from the files.

There's a solid chance that the schema gives away what DBMS is being used. But even if it didn't, I'd still call it a file layout in this context.

The DBMS is almost definitely going to be mentioned in RFP or specification documentation. As it was in this lawsuit.

Re: I Went to SQL Injection Court

#70

Post by paulddraper »

hyperpape wrote: post #59
paulddraper wrote: post #26

Earlier quoted context omitted.

How is a database schema not a file layout?

It literally does not describe a file, and does not literally describe the data layout of anything on disk (though with enough knowledge, you may be able to infer facts about probable layouts).

> does not literally describe the data layout of anything on disk

Huh? Depends on the DMBS, but each InnoDB table is a file.

And the schema determines the file structure.

Post reply on HN