2 ms·

What I didn't put in my comment above was that a sufficiently competent engineer might be considered negligent if they failed to allow for say people typing any

What I didn't put in my comment above was that a sufficiently competent engineer might be considered negligent if they failed to allow for say people typing any old rubbish in. Have you ever jumped up and down on a bridge or other structure? You probably weren't deliberately testing its strength, just idly messing around. You certainly didn't want it to fail (but what if it did?) I'll put money on it that you have done this at some point in your life because we all have at some point. Were you a hacker? Are you a criminal? What makes adding 'or 1=1' a hack/crack and mucking about? and at what point is it criminal to not be able to filter out crap on input?

zokier 9y ago
The difference between jumping on bridges and SQLi is that at least in these parts of the world I would find it absurd to think that bridge would really fall by jumping on it; on the other hand anyone trying out SQLi knows that it can actually succeed, even with a quite high chance. Also we have building codes etc that regulate construction work, which gives me such confidence on bridges etc, but there is not equivalent for computers. Maybe there should be (that is another discussion) but that does not affect people doing things today. Furthermore, even in case of criminal negligence (/lack of due diligence or something along those lines) two wrongs do not make a right; abusing such negligence can still be illegal too.
- gerdesj 9y ago
  "Also we have building codes etc that regulate construction work" by that statement I'll assume American. Are you familiar with this: https://en.wikipedia.org/wiki/Millennium_Bridge,_London https://en.wikipedia.org/wiki/Millennium_Bridge,_London ? (also see Tacoma Narrows for the classic example - wind loading, rather than people but resonance is resonance). Bridges do fail when people jump up and down on them or at least cause resonance based effects by simply walking in lock step. You might be unfamiliar with resonance, which is a right bugger to deal with but Sir NF and co designed a bridge which was a suspension(ish) job but looked flat. It looks lovely but I recall looking at it and having misgivings (easy to say now). To me it screamed transverse loading, which isn't the normal thing that an IT bod shouts about. He (Sir Norman Foster) had a part to play in this beauty amongst others: https://en.wikipedia.org/wiki/Millau_Viaduct#/media/File:Viaduc_de_Millau_1.jpg https://en.wikipedia.org/wiki/Millau_Viaduct#/media/File:Via... - the WP article does not really do it justice at a glance. "Also we have building codes etc that regulate construction work ... but there is not equivalent for computers." - My point exactly. There should be, and then perhaps m'learned friends could then get involved to debate the matter with something to work with. At the moment it is bollocks.

zokier 9y ago

The difference between jumping on bridges and SQLi is that at least in these parts of the world I would find it absurd to think that bridge would really fall by jumping on it; on the other hand anyone trying out SQLi knows that it can actually succeed, even with a quite high chance. Also we have building codes etc that regulate construction work, which gives me such confidence on bridges etc, but there is not equivalent for computers. Maybe there should be (that is another discussion) but that does not affect people doing things today. Furthermore, even in case of criminal negligence (/lack of due diligence or something along those lines) two wrongs do not make a right; abusing such negligence can still be illegal too.

gerdesj 9y ago
"Also we have building codes etc that regulate construction work" by that statement I'll assume American. Are you familiar with this: https://en.wikipedia.org/wiki/Millennium_Bridge,_London https://en.wikipedia.org/wiki/Millennium_Bridge,_London ? (also see Tacoma Narrows for the classic example - wind loading, rather than people but resonance is resonance). Bridges do fail when people jump up and down on them or at least cause resonance based effects by simply walking in lock step. You might be unfamiliar with resonance, which is a right bugger to deal with but Sir NF and co designed a bridge which was a suspension(ish) job but looked flat. It looks lovely but I recall looking at it and having misgivings (easy to say now). To me it screamed transverse loading, which isn't the normal thing that an IT bod shouts about. He (Sir Norman Foster) had a part to play in this beauty amongst others: https://en.wikipedia.org/wiki/Millau_Viaduct#/media/File:Viaduc_de_Millau_1.jpg https://en.wikipedia.org/wiki/Millau_Viaduct#/media/File:Via... - the WP article does not really do it justice at a glance. "Also we have building codes etc that regulate construction work ... but there is not equivalent for computers." - My point exactly. There should be, and then perhaps m'learned friends could then get involved to debate the matter with something to work with. At the moment it is bollocks.