4 ms·

I thought sqlite was very resilient and have a hard time understanding how an sqlite file can be corrupted. Are they manipulating the sqlite file outside of sql

by 0x0 6y ago

I thought sqlite was very resilient and have a hard time understanding how an sqlite file can be corrupted. Are they manipulating the sqlite file outside of sqlite APIs? Are they mixing up file descriptors and writing garbage into an sqlite handle?

dssound 6y ago
I had issues with corruption during a Xamarin project - its easy to do with bad coding but if proper practices are made then it shouldn't occur much.
primeos 6y ago
They encrypt the DB via SQLCipher: https://github.com/sqlcipher/sqlcipher https://github.com/sqlcipher/sqlcipher Not sure how reliable and resilient SQLCipher is but that might (significantly?) increase the risk for a bug/corruption to occur. And the encryption certainly makes the analysis more difficult (while, at least on GNU/Linux, I don't see any advantage as the encryption key is stored unencrypted in ~/.config/Signal/config.json - not sure if other Desktop platforms support secure keystores like on Android and iOS). I briefly tried to analyze my corrupted DB but quickly gave up as I'm not familiar with SQLCipher and basically only got a generic "Error: file is not a database" error message when trying to decrypt it (and there's no plaintext header IIRC so it looks just like random data). I also had multiple backups of the SQLCipher DB that I could successfully access manually but I was unable to use them for Signal-Desktop (not sure if this was due to some other Electron DBs/state, the stateful Signal protocol, or something else - IIRC the only hint was the "Database startup error: Error: SQLITE_NOTADB: file is not a database" message that didn't really help much).
- RJIb8RBYxzAMX9u 6y ago
  How does it differ from the 1st party encryption[0]? I couldn't find any comparison in SQLCipher's readme. [0] https://www.sqlite.org/see/doc/trunk/www/readme.wiki https://www.sqlite.org/see/doc/trunk/www/readme.wiki
  - kbumsik 6y ago
    The official SQLite Encryption Extension is not free (one-time $2000 + optional support) and do not allow re-distribute the source code. SQLCipher has open-source communitiy edition.
dj_mc_merlin 6y ago
"How To Corrupt An SQLite Database File": https://www.sqlite.org/howtocorrupt.html https://www.sqlite.org/howtocorrupt.html
- appleflaxen 6y ago
  the SQLite documentation is incredible. the dev team is so thoughtful and reflective, and shares not only the code/application, but their understanding. As popular as it is, it's still underrated.

by 0x0 6y ago

dssound 6y ago

I had issues with corruption during a Xamarin project - its easy to do with bad coding but if proper practices are made then it shouldn't occur much.

primeos 6y ago

They encrypt the DB via SQLCipher: https://github.com/sqlcipher/sqlcipher https://github.com/sqlcipher/sqlcipher Not sure how reliable and resilient SQLCipher is but that might (significantly?) increase the risk for a bug/corruption to occur. And the encryption certainly makes the analysis more difficult (while, at least on GNU/Linux, I don't see any advantage as the encryption key is stored unencrypted in ~/.config/Signal/config.json - not sure if other Desktop platforms support secure keystores like on Android and iOS). I briefly tried to analyze my corrupted DB but quickly gave up as I'm not familiar with SQLCipher and basically only got a generic "Error: file is not a database" error message when trying to decrypt it (and there's no plaintext header IIRC so it looks just like random data). I also had multiple backups of the SQLCipher DB that I could successfully access manually but I was unable to use them for Signal-Desktop (not sure if this was due to some other Electron DBs/state, the stateful Signal protocol, or something else - IIRC the only hint was the "Database startup error: Error: SQLITE_NOTADB: file is not a database" message that didn't really help much).

RJIb8RBYxzAMX9u 6y ago
How does it differ from the 1st party encryption[0]? I couldn't find any comparison in SQLCipher's readme. [0] https://www.sqlite.org/see/doc/trunk/www/readme.wiki https://www.sqlite.org/see/doc/trunk/www/readme.wiki
- kbumsik 6y ago
  The official SQLite Encryption Extension is not free (one-time $2000 + optional support) and do not allow re-distribute the source code. SQLCipher has open-source communitiy edition.

dj_mc_merlin 6y ago

"How To Corrupt An SQLite Database File": https://www.sqlite.org/howtocorrupt.html https://www.sqlite.org/howtocorrupt.html

appleflaxen 6y ago
the SQLite documentation is incredible. the dev team is so thoughtful and reflective, and shares not only the code/application, but their understanding. As popular as it is, it's still underrated.