News for hackers. Stuff that matters.
Re:Select Code_execution from * Using SQLite; (2019) by masklinn on Saturday June 13, 2020 @04:14PM (#23512310)
> Combined with the correctness fuzzing results by SQLancer [1] where SQLite had 179 issues revealed (vs. 11 in PostgreSQL), I think the 100% coverage is a lot less meaningful than I had thought.

That's really not a honest view of it, the SQLancer page specifically notes:

> The SQLite3 developers were most responsive and very appreciative of our bug reports. They fixed the bugs we reported at an impressive speed, which is why we concentrated on testing this DBMS.

They don't provide run times, but they're empathetically stating most of their runtime is on SQLite. For instance they only have 5 issues for MariaDB because… they stopped testing it as the devs were not responsive.

Re:Select Code_execution from * Using SQLite; (2019) by ysleepy on Saturday June 13, 2020 @06:14PM (#23513271)
I am aware.

The thought I had could maybe better expressed as:

"If even SQLite, with its almost unsurpassed testing, has so many 'issues', then that approach of testing cannot be seen as a strong indicator of correctness."

Which is sort of a truism, but seeing the trend of more and more unit tests instead of also investing in other strategies made me blurt that out.

That said, I will continue to use sqlite without hesitation, the robustness is just soothing in a world of terrible libraries.

We can argue about the weak typing though :P

Re:Select Code_execution from * Using SQLite; (2019) by pdimitar on Sunday June 14, 2020 @06:00AM (#23516409)
I love sqlite but I wish they invested in a strict mode. Although thinking about it that's not really "a strict mode of the existing sqlite3" and it's more likely to be "an entirely different library altogether, with some shared code"...

I am basically after an embedded Potgres I suppose. I really wish sqlite went into that space. Or anyone else, really.