SQLite as an Application File Format (2014)

Re:SQLite as an Application File Format (2014) by EvanAnderson on Saturday June 13, 2020 @07:50PM (#23513874)

I've never understood the "We can ship this but it's not contract" mentality. To my mind if you ship something it's contract. I think developers keeping that in mind would make the world full of more resilient code. You're making a contract w/ your future self, if nothing else.

To the point re: modifying internal state and screwing-up the application - If you're writing anything out to persistent storage you should assume that it's untrusted data when you read it back in. If for no other reason than physics itself is a malicious (or, at best, ambivalent) actor.

[ Parent | on HN ]

Re:SQLite as an Application File Format (2014) by hamburglar on Sunday June 14, 2020 @05:05PM (#23521370)

If your app ships with a dynamically loaded library and I dig through the exposed functions and find something undocumented that looks useful and I figure out how to use it, that's a contract to you? That's utterly insane.

Re: the concept of untrusted data, this is off in the weeds argument for argument's sake IMO. Do reasonable validations of the state data, sure, but picking nits about the nature of trust and internal application state is an infinite hole I'm not jumping into with you.

[ Parent | on HN ]

Re:SQLite as an Application File Format (2014) by catalogia on Saturday June 13, 2020 @11:44PM (#23514918)

Sometimes a programmer may like to create such a contract, if only with their future self, but have reason to fear their boss will force them to break that contract in some not unlikely future.

[ Parent | on HN ]