News for hackers. Stuff that matters.
Re:SAML Is Insecure by Design by dboreham on Thursday August 05, 2021 @08:58PM (#28082058)
Oh wow. I'd never looked close up. That's fascinating, and a term of art I expect to use in the future.

Btw I think your SQL example is called "EAV Schema" and does have a legitimate purpose once in a while.

Re:SAML Is Insecure by Design by eli on Thursday August 05, 2021 @09:45PM (#28082370)
I think it was coined here https://thedailywtf.com/articles/The_Inner-Platform_Effect (Haven't thought about that website in a while)

I've always wondered why more people didn't actually issue DDL for these kinds of databases. Like if you want to let your user define their own custom fields, just take what they enter and actually CREATE TABLE / ALTER TABLE to build the the tables they need. And then more or less you could just write regular queries.

Re:SAML Is Insecure by Design by ThePadawan on Friday August 06, 2021 @01:03AM (#28083502)
I've worked on a system like that, writing software on a project base for enterprise clients.

Turns out sysadmins get REALLY nervous when you tell them your application needs permission to use DDL at runtime. It required a lot more filling out forms.

Re:SAML Is Insecure by Design by KptMarchewa on Friday August 06, 2021 @04:59AM (#28084784)
"Just" don't use the same database that the application is using for it's internal data.
Re:SAML Is Insecure by Design by tremon on Friday August 06, 2021 @07:25AM (#28085658)
You can scope the DDL permissions to a single schema while still using the same database (and benefit from all the transactional guarantees a single database offers).
Re:SAML Is Insecure by Design by KptMarchewa on Friday August 06, 2021 @07:44AM (#28085796)
Yes, if database supports it (I guess every major ones now do) then it's great. Postgres's transactional DDL seems like great fit.
Re:SAML Is Insecure by Design by ThePadawan on Friday August 06, 2021 @07:12AM (#28085566)
I'm sorry, I don't follow.

I was talking about an application and its accompanying database, which would still be paid for and administered by the customer, not a database outside the application which it would be accessing.

That still raised many eyebrows.

Re:SAML Is Insecure by Design by mooreds on Friday August 06, 2021 @07:27AM (#28085673)
I think the GP was assuming the reason sysadmins worry about running DDL is the danger of overwriting/modifying tables the application depends on.

If this is the main concern, you could have two databases (or schemas, if your database supports it).

One for application configuration/storage that the application never runs DDL on and another for user data, where the tables can be created/modified dynamically.

That separation means that, at worst, user data is screwed up if there's a bug in the DDL generation, but the application should still be able to run.

At least, that was my read.

Re:SAML Is Insecure by Design by michaelwda on Thursday August 05, 2021 @11:11PM (#28082896)
This is how arcgis works and it really sucks when your tier 1 starts adding columns to your schema because they made a typo.
Re:SAML Is Insecure by Design by hobs on Thursday August 05, 2021 @11:08PM (#28082865)
Some people do that, and at one point it was much faster to do that so it was more common, but as databases have generally gotten faster that kind of optimization is less interesting to people.
Re:SAML Is Insecure by Design by ric2b on Monday August 09, 2021 @08:59PM (#28124149)
I assume performance is a lot less predictable with that method, no?
Re:SAML Is Insecure by Design by paulmd on Thursday August 05, 2021 @09:16PM (#28082166)
these days if you are modeling the "sparse, high-dimensional data" of the kind that EAV schema does well, you probably should be reaching for JSON columns instead of EAV schema.
Re:SAML Is Insecure by Design by jiggawatts on Thursday August 05, 2021 @11:06PM (#28082855)
Some databases support "sparse columns", which use EAV under the hood but are better optimised: https://docs.microsoft.com/en-us/sql/relational-databases/ta...
Re:SAML Is Insecure by Design by Serow225 on Friday August 06, 2021 @01:54AM (#28083768)
Thanks, I forgot about that! :)
Re:SAML Is Insecure by Design by smitty1e on Friday August 06, 2021 @04:30AM (#28084584)
Isn't that the problem that these "columnar store" DBs address?

A bunch of dictionaries containing UUID/data, where each dimension is its own dict, and the dicts might or might not be running on the same system?

Re:SAML Is Insecure by Design by commandlinefan on Friday August 06, 2021 @05:09PM (#28092768)
> "EAV Schema" and does have a legitimate purpose once in a while

Well, technically, the database's own system tables have tables with such column names and responsibilities.