Rookie coding mistake prior to Gab hack came from site’s CTO

Re:Rookie coding mistake prior to Gab hack came from site’s CTO by dj_mc_merlin on Tuesday March 02, 2021 @10:31PM (#26324398)

I take the same standpoint as you most of the time. But you can't fucking interpolate user input into SQL queries without physically cringing and call yourself an experienced engineer. Can you really pull up a code editor and write that out without your brain sounding off a thousand alarm bells that you're massively messing up something?

I can imagine myself doing this, having not slept in the last 20 hours, after 7 martinis and one especially long island. Maybe he did that too, but he should have the common sense as CTO of the company not to!

[ Parent | on HN ]

Re:Rookie coding mistake prior to Gab hack came from site’s CTO by oji0hub on Wednesday March 03, 2021 @03:07AM (#26325899)

Who knows what was going on. In an ideal world we have the time needed to do things well. In reality, you've got twenty developers asking for something, users requesting features, various government agencies asking for documents, the lawyers inform you about some case and... oh your wife is calling on the other line because... etc etc etc.

[ Parent | on HN ]

Re:Rookie coding mistake prior to Gab hack came from site’s CTO by jdxcode on Wednesday March 03, 2021 @01:13PM (#26332285)

I get so busy I rip out query builders to SQL concat strings all the time. /s

That’s like going 120mph and telling the cop you were just “distracted”.

You’re correct that we often make mistakes when we’re busy, but this isn’t that. This is OWASP #1 and the most plain example of it.

This is not a “mistake” that engineers make, this is unethical to allow this to go into production. He even has a stackoverflow answer where he explains this exact problem: https://stackoverflow.com/questions/11554015/syntax-sql-wher...

If you think I’m wrong, then what could an engineer be responsible for? Literally nothing ever?

[ Parent | on HN ]