- cross-posted to:
- [email protected]
- cross-posted to:
- [email protected]
You must log in or register to comment.
I will always upvote Little Bobby Tables.
Thank you!
Suddenly, very relatable today…
I was just thinking how the developer of kbin made a post regarding a similar bug in kbin and some people made fun of him for missing something so obvious, and here we are 🤨
There’s only two kinds of people:
- Those who know no system is fool proof.
- Dumbasses.
I think everyone is on a journey from 2 -> 1, some just get there sooner than others :)
I’d call the second group fools because those are generally the ones that the system is trying to be safe against.
Foolproofness is an asymptote. It’s not achievable but we can always get closer.
If you are creating some software in 2023, it should not be vulnerable to SQL injection.
There’s no “but” or “unless”.
I really wished the presentation layer and session management had that kind of clear interfaces, instead we are stuck into only solving some 99.9% of CSS and 90% of CSRF. But SQL injection is 100% complete solved for good.
The best developers can admit they missed something, fix it, and move on to the next thing.
The difference is that here lots of people posted about it and action was taken. If this was corporate owned, any suggestions of a problem would have been removed or denied, and months later after it hits public media they would have admitted there might have been a problem, and here’s some free identity theft protection if you feel like you were affected.
True. Looking at lemmy GitHub, it looks like everyone is swamped.
How come?
Because there was a xss bug in Lemmy cause by not escaping some inputs
Because he doesn’t know the difference between an SQL injection and a Cross site scripting attack.
Or because both relate to not sanitizing your input
Yeah lol. What is up with the condescension?
Reddit migration side-effects.
Bobby Tables is probably old enough for his own kid, Cross Site Samantha. I bet she created a Lemmy account recently.
I had her naked vids on VHS in 1982 before I rode my dinosaur to GemCo.
I have a cousin whose driver’s license name is “FNU” which stands for first name unknown. This was due to some quirk in his immigration documents. I cannot imagine how much havoc this must cause.
Tickets were able to avoid him?
More-so he got every ticket filed under NULL.
As a data engineer for the past decade, Bobby Tables has been this shared cultural reference in my industry for years. I will always upvote Bobby Tables.
Thank you!
In the old days you could do a lot of damage to a lot of websites with this kind of trick…
Mind you, it’s only because nowadays libraries for processing web-requests and for feeding SQL queries to databases automatically do all kinds of escaping of special characters and sanitizing of inputs that things are a lot better: in my experience the “average” dev out there doesn’t really has much awareness about security-adjacent concerns like “sanitize inputs coming from the outside” (and no, you can’t trust Javascript on the browser for that) and, besides, tons of companies outsourced their code making work to places like India were far too many “devs” are people with zero skill for it who joined the Industry because demand was so big that anybody who knows the right side of the keyboard to type on is hired and then outsourced to some western suckers in management as a “senior developer”.
Haha the outsourcing stuff is kind of hilarious. They just usually churn and burn people through products and somehow they use it as a selling point… “Don’t like your team, you can easily adjust with new members equally skilled instantly!”
So they just move people through projects, and eventually they usually learn enough coding to remain.
From my own experience, which even included managing a small outsourced team in India, I concluded that whilst they do have as many good devs in that country as elsewhere, their own pay scale structure pushes the good ones into management (were they usually suck) to be able to get a raise, and due to the extra demand due to the outsourcing industry for developers over there, which is well above and beyond what most countries have, the normal proportion of naturally good devs is drowned in a sea of mediocre types who have no actual skill and would never had gone into IT otherwise. Also the best guys (and a few gals) usually leave to go earn a lot more in places like the US and UK.
In my own experience with this, we (a small very senior team based in London) were forced by management to use the work of the guys in India because the company had spent lots of money setting up a division there for it, and in practice we ended up spending just as much time fixing their code as we would have spent doing it right ourselves in the first place, so at least in my team the company was just wasting money.
Funnilly enough the few guys we had based in London that came from the Indian Subcontinent (so not just India but also Pakistan, Banglasdesh and even Sri Lanka) were significantly better than the guys from that outsourcing division in India.
Awesome!
Bobby Tables has at some point or another been a part of every online community backed by a SQL database.
I’ve not seen this one before, but it might be my new all-time favorite.
Really? That’s probably the most famous XKCD ever. It’s surprising that anyone who understands it has never seen it before.
Alt Text: Her daughter is named Help I’m trapped in a driver’s license factory.
Classic!
