News for hackers. Stuff that matters.

A comment on We saved $50k/year with a Go microservice coded in a hackathon. Parent comment

Re:We saved $50k/year with a Go microservice coded in a hack... by voltagex_ on Tuesday April 10, 2018 @09:45PM (#16807367)
One of the things I've done to harden an app is to revoke all permissions other than EXEC on a particular schema, then make sure everything is done via paramatised stored procedures - no chance of SQL injection then.
[ Parent | on HN ]
Re:We saved $50k/year with a Go microservice coded in a hack... by flukus on Tuesday April 10, 2018 @10:13PM (#16807522)
But that creates situations like this where you have to jump through hoops to solve simple problems. You solved one potential issue at the cost of creating many more.

> no chance of SQL injection then.

You know you can have sql injection attacks inside stored procedures? If you think stored procedures are a panacea then you don't understand the problem you're solving.

[ Parent | on HN ]
Re:We saved $50k/year with a Go microservice coded in a hack... by voltagex_ on Tuesday April 10, 2018 @10:40PM (#16807617)
Perhaps I should have said "greatly reduced the risk of".

I'm not using something like Entity Framework and the CRUD apps I mostly wrote at work were well suited to a few simple sprocs.

The time it takes to write an ALTER script to change something pales in comparison to the two week change control process anyway...

[ Parent | on HN ]