Spyke

Replies

Comment on

Is there something better than SQL?

SQL, where injection is still in the top 10 security risks

This is absolutely true, but it's not what it looks like on the surface, and if you dig into the OWASP entry for this, you'll see they talk about mitigation.

You can completely eliminate the possibility of injection attacks using well-understood technologies such as bind variables, which an ORM will usually use under the covers but which you can also use with your own queries. There are many, many database applications that have never once had a SQL injection vulnerability and never will.

The reason SQL injection is a widespread security risk, to be blunt, is that there are astonishingly large numbers of inexperienced and/or low-skill developers out there who haven't learned how to use the tools at their disposal. The techniques for avoiding injection vulnerability are simple and have been well-documented for literally decades but they can't help if a lousy dev decides to ignore them.

Now, a case could be made that it'd be better if instead, we were using a query language (maybe even a variant of SQL) that made injection attacks impossible. I agree in principle, but (a) I think this ends up being a lot harder than it looks if you want to maintain the same expressive power and flexibility SQL has, (b) given that SQL exists, "get bad devs to stop using SQL" doesn't seem any more likely to succeed than "get bad devs to use bind variables," and (c) I have too much faith in the ability of devs to introduce security vulnerabilities against all odds.

Comment on

*Permanently Deleted*

Reply in thread

I find that setup an obnoxious user experience. Instead of one hotkey that tells my password manager to fill out the login form, now I have to switch to my mail app, wait for the login email to arrive (if my mail provider or the site’s mail provider is having trouble, no login for me!) then back to my browser where I need to close the original tab because clicking the email link opened a new one.

If I am on a shared computer, now I need to either manually copy a long URL from my phone or read my email on that computer, a much bigger security risk than just entering a password and 2FA code.

Comment on

How some people afford to travel around the world for months without working?

Being rich is often the answer, but also, it is possible to travel much more inexpensively than most tourists do if you don’t care so much about comfort and predictability. Go in off seasons. Ride the cheapest class of public transport to get around. Couchsurf or stay in sketchy hostels. Cook your own food or eat where the locals eat instead of at the places where the staff speaks perfect English.

Do they already have savings enough to support until they retire?

No reason to assume they won’t get jobs after they’re done traveling.

Comment on

Is there something better than SQL?

it would be great to “just” have a DB with a binary protocol that makes it unnecessary to write an ORM.

Other people have talked about other parts of the post so I want to focus on this one.

The problem an ORM solves is not a problem of SQL being textual. Just switching to a binary representation will have little or no impact on the need for an ORM. The ORM is solving the problem that's in its name: bridging the conceptual gap between an object-oriented data model and a relational data model. "A relational data model" isn't about how queries are represented in a wire protocol; instead, it is about how data, and relationships between pieces of data, are organized.

So, okay, what if you get rid of the relational data model and make your database store objects directly? You can! NoSQL databases had a surge in popularity not too long ago, and before that, there have been lots of object databases.

What you're likely to discover in an application of any real complexity, though, and the reason the industry has cooled somewhat on NoSQL databases after the initial hype cycle, is that the relational model turns out to be popular for a reason: it is extremely useful, and some of its useful properties are awkward to express in terms of operations on objects. True, you can ditch the ORM, but often you end up introducing complex queries to do things that are simple in SQL and the net result is more complex and harder to maintain than when you started. (Note "often" here; sometimes non-relational databases are the best tool for the job.)

And even in an object database, you still have to know what you're doing! Storing objects instead of relational tuples won't magically cause all your previously-slow queries to become lightning-fast. You will still need to think about data access patterns and indexes and caching and the rest. If the problem you're trying to solve is "my queries are inefficient," fixing the queries is a much better first step than ditching the entire database and starting over.

Comment on

Do you donate to Wikipedia? Why or why not?

Yes, and I even have it as an automatic scheduled payment so I don't forget. Even with its flaws, it remains one of the shining gems of the Internet, and a resource I use frequently in both my professional life and my personal one. I remember how it was to suddenly want to learn more about a random topic before Wikipedia and I don't want to go back.

I also donate to The Internet Archive.

Comment on

How far would someone have to travel to be considered “Well traveled”?

Reply in thread

This is spot on. I would add one little wrinkle: you not only have to accept that not everything works like it does in your home country, but also that not everything should.

You can be the kind of expat who spends all day griping about how much worse things are in your new home than your old one, or you can be the kind who shifts their mindset such that the new country’s ways become second nature.

Comment on

Do employers actually know or care about lying on resume?

The current system of job seeking often requires to lie on resume.

This has not been my experience at all, but maybe it depends on what kinds of jobs you’re seeking.

In my line of work, detecting lies on resumes is one of the reasons we spend time interviewing candidates. If you are caught out in a lie, you can kiss any chance of an offer goodbye. As an interviewer I have never knowingly given a “hire” vote to a lying candidate and if I did, I wouldn’t have my job much longer.

Comment on

*Permanently Deleted*

What metric did they use to determine what “top 10%” means? Because that’s the part of this that seems most ridiculous to me given how situation-dependent most engineering decisions are. To illustrate with an extreme example: is “daily+ deployment frequency” a sign of an amazing engineering org if the thing being deployed is updates to your heart monitor firmware?

meta

Comment on

What are your thoughts on Beehaw defederating?

Reply in thread

Moderation is thankless work that comes with heaping helpings of scorn from the community. Even if you're doing it purely because you want to see the community succeed, you will be accused of doing it because you're a petty tyrant who likes to lord it over other people. Plus, of course, moderation itself is work and it's usually not very fun work. I've moderated online discussions before and it really wears you down after a while.

It doesn't surprise me that it's hard to find a lot of trusted users who also want to be moderators.

Comment on

Reddit is in danger of a death spiral

Reply in thread

GDPR protects things implicitly (albeit completely untested–perhaps even problematic)

I will grab my popcorn the first time someone seriously tries to pursue a GDPR erasure request for their fediverse content. I don't think it's even possible to honor such a request in theory, let alone in practice, given that nodes can come and go from the network and when they go, they could easily keep their local copies of everything.