The trojan Emoji

#1

Post by krogsgard » Fri, May 08, 2015, 8:23 PM UTC

Re: The trojan Emoji

#2

Post by Kortaggio » Fri, May 08, 2015, 11:13 PM UTC

For anyone interested in knowing how the UTF8 attack works, Mathias Bynens has a fantastic presentation which describes the technical details: https://www.youtube.com/watch?v=qFfjJ8pOrWY

Here's the slide deck: https://speakerdeck.com/mathiasbynens/hacking-with-unicode

Interesting anecdote from the talk: This isn't just unique to Wordpress. Spotify was vulnerable to this at one point.

Re: The trojan Emoji

#3

Post by feld » Sat, May 09, 2015, 2:48 AM UTC

It's sad to see this mistake being made repeatedly. It kind of works like this

  1) Small project started, MySQL is used because that's all the developer knows 
  or it's convenient
  2) Strict mode is never turned on; developer has no idea it exists
  3) App gets popular
  4) Too late to enable Strict

It's really the main reason why I don't recommend MySQL. Theres so many mistakes waiting to be made.

Re: The trojan Emoji

#4

Post by davidgerard » Sat, May 09, 2015, 10:44 AM UTC

Why why why did MySQL have to win the damn race. It's the PHP of databases: it more or less works, but you're relying on a cardboard skyscraper built on a foundation of poop. And this will come back to bite you.

Why MySQL Is Not My Favourite Database: https://reddragdiva.dreamwidth.org/593924.html

Re: The trojan Emoji

#5

Post by davidgerard » Sat, May 09, 2015, 10:48 AM UTC

feld wrote: post #3

It's sad to see this mistake being made repeatedly. It kind of works like this 1) Small project started, MySQL is used because that's all the developer knows or it's convenient 2) Strict mode is never turned on; developer has no idea it exists 3) App gets popular 4) Too late to enable Strict It's really the main reason why I don't recommend MySQL. Theres so many mistakes waiting to be made.

> 2) Strict mode is never turned on; developer has no idea it exists

MySQL has been my hair-tearing problem for many years - https://reddragdiva.dreamwidth.org/593924.html - and I had no idea it existed.

There's a secret "don't suck as much" switch? TURN IT ON!!

Re: The trojan Emoji

#6

Post by feld » Sun, May 10, 2015, 8:18 PM UTC

davidgerard wrote: post #5

feld wrote: post #3

It's sad to see this mistake being made repeatedly. It kind of works like this 1) Small project started, MySQL is used because that's all the developer knows or it's convenient 2) Strict mode is never turned on; developer has no idea it exists 3) App gets popular 4) Too late to enable Strict It's really the main reason why I don't recommend MySQL. Theres so many mistakes waiting to be made.

> 2) Strict mode is never turned on; developer has no idea it exists MySQL has been my hair-tearing problem for many years - https://reddragdiva.dreamwidth.org/593924.html - and I had no idea it existed. There's a secret "don't suck as much" switch? TURN IT ON!!

Wait until the developer learns they need to support unicode.