Live data from Hacker News

I Went to SQL Injection Court

sockpuppet.org

81–90 of 463 posts

Re: I Went to SQL Injection Court

#81
post #32

Earlier quoted context omitted.

The article describes why. 2 different db engines (or even instances) can use different file layouts for the same schema. In many was sql is all about divorcing the schema from the files.

Another way to think about it is that if a SQL schema is a file, so is an Excel spreadsheet template.

File or file layout? Cause both of these are probably stored as files, .sql and .xltx respectively.

Re: I Went to SQL Injection Court

#84

Earlier quoted context omitted.

> does not literally describe the data layout of anything on disk Huh? Depends on the DMBS, but each InnoDB table is a file. And the schema determines the file structure.

> but each InnoDB table is a file. A table isn't a schema, it is a component of a schema, and most databases don't use InnoDB.

> it is a component of a schema

So if you have the schema, you have the tables.

Re: I Went to SQL Injection Court

#85
post #68

Earlier quoted context omitted.

So?

So if you have the schema and the DBMS, you probably know how data is arranged in the files ("files" in the filesystem sense).

The parent asks "how is it not a file layout" not "can you guess the file layout?" given it.

I am a human, you know I have a kidney, but I am not a kidney.

Re: I Went to SQL Injection Court

#86
post #55

Earlier quoted context omitted.

My real goal is zoning. God speed to you sir! What is your goal wrt zoning?

The categorical elimination of single-family zoning along with any building envelope restrictions that would make as-of-right 3-flats uneconomical.

It's might actually be easier to win the economics battle by chipping away at restrictions on taller buildings. The builders in my area are copy/pasting a 3-flat design all over the place but it requires bargain-basement land prices (literally building on former toxic waste dumps) or money from the township because 3-flats make you have to build wide.

Re: I Went to SQL Injection Court

#87
post #55

Earlier quoted context omitted.

The categorical elimination of single-family zoning along with any building envelope restrictions that would make as-of-right 3-flats uneconomical.

That would be an outstanding outcome! Is this just for Oak Park, or beyond?

You'd hope that Oak Park, Evanston, Wilmette, and then Berwyn and Schaumburg could get this done, and then your next step would be either Chicago (tough because of aldermanic structure) or statewide, the way California did. Either way: you start in one municipality and work from there.

It helps that zoning matters more in Oak Park (and Evanston) than almost anywhere else in Chicagoland.

Re: I Went to SQL Injection Court

#88
I FOIA'ed >1M pages of docs for my project cleartap.com, a DB of water quality of the USA.

Most states would charge a small amount to gather the documents.

Michigan wanted $50K to for the FOIA request. I think because of the Flint lead crisis. They wanted me to go away.

Re: I Went to SQL Injection Court

#89

While I believe that the city should share the schema, and that the city is effectively argues for security through obscurity, I disagree with the main premise of the article: that knowing SQL schema doesn't help the attacker. If I understand the argument of the author here: > Attackers like me use SQL injection attacks to recover SQL schemas. The schema is the product of an attack, not one of its predicates The auth…

If you specifically log failed database queries, where "failure" means "indicative of SQL injection", then nothing you can do with the schema is going to reduce the signal in that feed --- even a single SQL syntax error would be worth following up on. No, I don't think your logic holds.

Re: I Went to SQL Injection Court

#90
post #53

Is it not absurd that the supreme and appeal courts disagreed on a syntactical matter? Never mind that this isn't uncommon, or that (IMHO) it would be ridiculous to interpret it as "any file layouts at all, and other stuff too, but only bad other stuff". It's crazy to me that were happy for laws to sit on the books being utterly ambiguous. I know this suits the courts who benefit from the leeway, and that (despite va…

I am not a lawyer, but my understanding is that's just how the justice system works. Reasonable people can disagree about what exactly a complicated statement says, since language is full of ambiguities. People have been discussing what the U.S. Constitution says exactly from the day it was written and there are still a lot of disagreements. The standard response to this is that laws should be written in ways that ar…

I’ve often thought we’d get more sensible results in court cases on computer-related issues if we had specialised courts where the judges were required to have a relevant degree (computer science, software engineering, computer engineering, information systems, etc). But I doubt it is going to happen any time soon.
Post reply on HN