3 ms·
Or SQLite, which I would recommend over some homebrewed text file format, see https://www.sqlite.org/appfileformat.html https://www.sqlite.org/appfileformat.htm
by okl 6y ago
Or SQLite, which I would recommend over some homebrewed text file format, see https://www.sqlite.org/appfileformat.html https://www.sqlite.org/appfileformat.html
- Aeolun 6y agoUnless you like your database to take types as a little more than suggestions.
- TeMPOraL 6y agoWe're talking about SQLite instead of text files, not instead of RMDBS. Plaintext files don't even have the concept of a type, they're just unstructured blob with a well-known mapping to printable characters. SQLite is a step up, because it lets you express structure and hint at the desired interpretation.
- madpata 6y agoText file formats have the benefit of being easier to kerge sometimes. SQLite files are binary and hard/impossible to merge.
- yencabulator 6y agoOpening untrusted SQLite files tends to not be safe: https://research.checkpoint.com/select-code_execution-from-using-sqlite/ https://research.checkpoint.com/select-code_execution-from-u...
- SQLite 6y agoThere was a bug in an older version of SQLite that CheckPoint was able to exploit. That bug has been fixed for a long time. It was fixed even before the referenced talk was given. They had to use an older version of SQLite in that talk so that the attack would work. The CheckPoint attack was a clever new idea, to be sure, and so more recent versions of SQLite have added new defenses to this kind of mischief, such that even if new bugs in SQLite are found, there will be defense in depth and attacks similar to the CheckPoint attack will still be unlikely. And yet for some reason, because we had that one bug, long ago, people keep saying that SQLite is "unsafe" years after the bug was fixed. Why is that? See https://www.sqlite.org/security.html https://www.sqlite.org/security.html for tips on safely opening SQLite database files that have been tampered with by a hostile agent.
- yencabulator 6y agoWell it's more a question of it being a much more complex interface than with a simpler format. Just about everyone runs a service that parses untrusted JSON, but I personally really wouldn't feel as safe running a service that consumes client-submitted SQLite databases. "It's possible to get it right" is not a great security boundary.