News for hackers. Stuff that matters.

A comment on DBSlayer - SQL over JSON for easy scaling-- from the folks at NYTimes.com.

Re:DBSlayer - SQL over JSON for easy scaling-- from the folk... by tlrobinson on Saturday October 13, 2007 @01:40PM (#67341)
It's cool that NYT is releasing some of their code as open source projects, but I'm not sure I understand this particular project. The first thing I thought of when I heard "SQL" and "JSON" in the same sentence was "oh please don't let this be some client side JavaScript SQL thing"... it basically exposes your database as a HTTP service: you send it SQL in a HTTP request and it returns JSON in a HTTP response. Where's the authentication? What's stopping someone from doing "http://myserver.com:9090/db?DROP%20TABLE%20articles" or something?
[ Parent | on HN ]
Re:DBSlayer - SQL over JSON for easy scaling-- from the folk... by jsjenkins168 on Saturday October 13, 2007 @02:59PM (#67367)
This is basically just a database proxy, but allows the responses to be transmitted as JSON, which is cool because it can interface with just about any other server backend that supports HTTP requests and can parse JSON.

I can't find any indication of being able to authenticate with the HTTP request. So I assume this means you would need to ensure the connection between the web server and DB proxy services were locked down, meaning no access outside of the subnet between the severs. I guess since the service pools connections to the actual DB that is where the authentication to the DB is handled. However like you say if someone could get access to the DBSlayer they could get access to all of your data, if this were the case. An option would be to just use SSL if it were supported. There is a bit more overhead with this, but if you are not needing to make tons of frequent queries it should be fine and sufficiently secure. I cant find any info on if SSL is supported..

Still though, if it could be made secure I like this because it is so universal.

[ Parent | on HN ]
Re:DBSlayer - SQL over JSON for easy scaling-- from the folk... by SwellJoe on Saturday October 13, 2007 @04:05PM (#67406)
My assumption is that it is for read only access to specific tables, which is perfectly sensible and safe.
[ Parent | on HN ]