3 ms·
> If what you say about "requests" and "responses" is both true and dispositive of the issue of authorization, then you're saying that virtually every SQL injec
by Tloewald 10y ago
> If what you say about "requests" and "responses" is both true and dispositive of the issue of authorization, then you're saying that virtually every SQL injection vulnerability on the Internet is also an "authorized" form of access to people's backend databases.
I think there's a clear and obvious distinction between a maliciously constructed request and a normal request (e.g. the difference between inserting lockpicks in a door and inserting an actual, correct, legally obtained key in a door, or having at the door with a sledgehammer).
- tptacek 10y agoOk, then make that distinction, as clearly as you can. Like many here, I work on this specific problem for a living, and I don't think the distinction is easy to draw at all. Happy to learn something new!
- Tloewald 10y agoYou don't understand the difference between picking a lock and using a key? You do realize that the world isn't neatly defined - objects in the world don't have platonic labels assigned to them, a key vs lock picks is just as large or small a difference as a properly authenticated REST call vs some kind of exploit. Just as a lock smith might legitimately use lock breaking tools to open your door for you, the law understands that intent and method both contribute to understanding whether a criminal act as occurred.