• 2 Posts
  • 26 Comments
Joined 1 year ago
cake
Cake day: June 15th, 2023

help-circle


  • SQL, where injection is still in the top 10 security risks

    This is absolutely true, but it’s not what it looks like on the surface, and if you dig into the OWASP entry for this, you’ll see they talk about mitigation.

    You can completely eliminate the possibility of injection attacks using well-understood technologies such as bind variables, which an ORM will usually use under the covers but which you can also use with your own queries. There are many, many database applications that have never once had a SQL injection vulnerability and never will.

    The reason SQL injection is a widespread security risk, to be blunt, is that there are astonishingly large numbers of inexperienced and/or low-skill developers out there who haven’t learned how to use the tools at their disposal. The techniques for avoiding injection vulnerability are simple and have been well-documented for literally decades but they can’t help if a lousy dev decides to ignore them.

    Now, a case could be made that it’d be better if instead, we were using a query language (maybe even a variant of SQL) that made injection attacks impossible. I agree in principle, but (a) I think this ends up being a lot harder than it looks if you want to maintain the same expressive power and flexibility SQL has, (b) given that SQL exists, “get bad devs to stop using SQL” doesn’t seem any more likely to succeed than “get bad devs to use bind variables,” and © I have too much faith in the ability of devs to introduce security vulnerabilities against all odds.


  • it would be great to “just” have a DB with a binary protocol that makes it unnecessary to write an ORM.

    Other people have talked about other parts of the post so I want to focus on this one.

    The problem an ORM solves is not a problem of SQL being textual. Just switching to a binary representation will have little or no impact on the need for an ORM. The ORM is solving the problem that’s in its name: bridging the conceptual gap between an object-oriented data model and a relational data model. “A relational data model” isn’t about how queries are represented in a wire protocol; instead, it is about how data, and relationships between pieces of data, are organized.

    So, okay, what if you get rid of the relational data model and make your database store objects directly? You can! NoSQL databases had a surge in popularity not too long ago, and before that, there have been lots of object databases.

    What you’re likely to discover in an application of any real complexity, though, and the reason the industry has cooled somewhat on NoSQL databases after the initial hype cycle, is that the relational model turns out to be popular for a reason: it is extremely useful, and some of its useful properties are awkward to express in terms of operations on objects. True, you can ditch the ORM, but often you end up introducing complex queries to do things that are simple in SQL and the net result is more complex and harder to maintain than when you started. (Note “often” here; sometimes non-relational databases are the best tool for the job.)

    And even in an object database, you still have to know what you’re doing! Storing objects instead of relational tuples won’t magically cause all your previously-slow queries to become lightning-fast. You will still need to think about data access patterns and indexes and caching and the rest. If the problem you’re trying to solve is “my queries are inefficient,” fixing the queries is a much better first step than ditching the entire database and starting over.







  • I think this is a more subtle question than it appears on the surface, especially if you don’t think of it as a one-off.

    Whether or not Scientology deserves to be called a “religion,” it’s a safe bet there will be new religions with varying levels of legitimacy popping up in the future. And chances are some of them will have core beliefs that are related to the technology of the day, because it would be weird if that weren’t the case. “Swords” and “plowshares” are technological artifacts, after all.

    Leaving aside the specific case of Scientology, the question becomes, how do laws that apply to classes of technology interact with laws that treat religious practices as highly protected activities? We’ve seen this kind of question come up in the context of otherwise illegal drugs that are used in traditional rituals. But religious-tech questions seem like they could have a bunch of unique wrinkles.


  • lobste.rs is an interesting case study. On the one hand, it sucked to want to join and be unable to! I was in that boat for a while. And it is also disappointingly low-volume; it can be hard to get much of a discussion going just because the user base is so small.

    On the other hand, when a discussion does get going, it has easily the highest signal:noise ratio of any technology message board I’ve ever participated in. Very few low-effort posts, and a high percentage of well-thought-out, respectful conversations.

    I’m not saying I think lemm.ee should follow this model, but it’s not without its merits.


  • koreth@lemm.eetoTechnology@kbin.socialThe end of the Googleverse
    link
    fedilink
    English
    arrow-up
    3
    ·
    edit-2
    1 year ago

    Your answer touches on something I can’t really relate to, which may be the key to my lack of understanding: people’s desire to get information in the form of videos rather than text. It just seems so much slower to me. I can skim 50 Google or Yelp reviews of a restaurant in the time it takes to watch a single short video review. I might watch one video along the way if I want a sense of the ambience of the place, or some other information that’s hard to convey well in writing, but that’s it.

    It does seem like it may be a generational thing, though. I’ve seen the same trend in my work-related searches: sometimes I search for technical information and instead of a blog post that takes me 30 seconds to digest well enough to tell if it’s even going to answer my question and that I can copy-paste example code from to play with, I get an hourlong YouTube video. This is a relatively new thing that has only become common in the last 5 years or so. I used to think it was purely about monetization (videos pay more than blog posts) but I see people, especially beginners, asking for technical information in video form. To me that’s like saying, “Please answer my question in the least convenient form possible.”

    Apparently this is my “kids these days, who can understand them?” topic.


  • koreth@lemm.eetoTechnology@kbin.socialThe end of the Googleverse
    link
    fedilink
    English
    arrow-up
    6
    ·
    edit-2
    1 year ago

    More recently, there’s been a shift to entertainment-based video feeds like TikTok — which is now being used as a primary search engine by a new generation of internet users.

    I must be an old fogey because I can’t understand how TikTok would be usable as a primary search engine unless all you ever search for is TikTok videos.

    If I’m part of the new generation of Internet users and I want to, say, see the menu of the restaurant where my date is taking me for dinner, or check my favorite band’s discography, or see if the reviews for the latest Netflix show are good, how do I do any of that on TikTok?

    Someone please explain how this works, assuming that statement in the article is true.










  • koreth@lemm.eetoStar Wars@lemmy.worldKENOBI - The Boonta Eve Redux
    link
    fedilink
    English
    arrow-up
    2
    ·
    edit-2
    1 year ago

    This does feel like a real improvement. Nicely done! In the unlikely event I’m introducing someone new to Star Wars in the future, I’ll be sure to point them at this edit instead of the whole series.

    One thing that’s probably unavoidable given the source material but bugged me a bit is that because each of the original episodes had a climax, the edit doesn’t have a story structure where the tension builds up steadily to a peak; it kind of alternates between hitting the gas and hitting the brakes.

    Also, minor nitpick: the miniseries was 6 episodes, but some of them were short so the runtime was more like 4.5 hours.