News for hackers. Stuff that matters.

A comment on ACIDRain: Concurrency-Related Attacks on Database-Backed Web Applications (2017) [pdf].

Re:ACIDRain: Concurrency-Related Attacks on Database-Backed ... by sitkack on Tuesday May 28, 2019 @02:51AM (#20027793)
This is awesome! This is another brick in the road to requiring formal methods. Hmm, typed multiple database-call transactions.

Are there type safe database libraries for Idris or Rust?

[ Parent | on HN ]
Re:ACIDRain: Concurrency-Related Attacks on Database-Backed ... by namibj on Tuesday May 28, 2019 @11:37AM (#20031181)
There is something based on Bloom IIRC, but the whole concept should be well-described and discoverable from the Keeping CALM paper: https://arxiv.org/abs/1901.01930
[ Parent | on HN ]
Re:ACIDRain: Concurrency-Related Attacks on Database-Backed ... by pyrale on Tuesday May 28, 2019 @03:03AM (#20027862)
Not what you ask, but squeal is a typed SQL wrapper for Haskell.
[ Parent | on HN ]
Re:ACIDRain: Concurrency-Related Attacks on Database-Backed ... by LunaSea on Tuesday May 28, 2019 @05:48AM (#20028590)
It's really just an ORM if I'm looking at the project.
[ Parent | on HN ]
Re:ACIDRain: Concurrency-Related Attacks on Database-Backed ... by pyrale on Tuesday May 28, 2019 @12:43PM (#20031828)
The ORM part is a thin wrapping that is there to explain Haskell enough to have type-checking. The goal is really to have Haskell type-check the requests you make.
[ Parent | on HN ]
Re:ACIDRain: Concurrency-Related Attacks on Database-Backed ... by LunaSea on Tuesday May 28, 2019 @05:08PM (#20034434)
Yup and I think it's a noble goal but it's still implemented in a way where you're not writing SQL but some kind of other syntax.

Also the issue is that it's trying to be database agnostic which means that you can't use any of the cool features from your database of choice.

[ Parent | on HN ]