6 ms·

It’s astonishing that handling and/or storing strings correctly is so hard, people actually suggest it’s somehow better to “just” stop such strings at administr

It’s astonishing that handling and/or storing strings correctly is so hard, people actually suggest it’s somehow better to “just” stop such strings at administrative level. I find it harmful assuming that some externally-sourced data will match any arbitrary format (e.g. contain only allowed characters), even if it’s really supposed to be so. (Inverse for outputs - one has to conform as strictly as they can.) Ignoring this leads to mental dismissal of validation and correct handling, and that’s how things start to crack at the seams. I have seen too many examples of “this can never be… oops”. Add: Best one can safely assume when handling a string is that it’ll be composed of a zero or more octets (because that’s what typically OS/language would guarantee). Languages and frameworks usually provide a lot of tooling to ensure things are what they expected to be. Ignoring the failure modes (even less probable ones, like a different Unicode collation than is conventional on a certain system) makes one sloppy, not practical.

IanCal 2y ago
And assuming all your consumers are not sloppy is impractical. We sanitise input all the time. This is not particularly unique. There isn't a great loss in this restriction of company names.
- Dalewyn 2y ago
  >We sanitise input all the time. No we don't. Companies like the aforementioned were made illegal because nobody sanitizes input. SQL query injection and other forms of malformed data entry is still one of the most common attack vectors in the year 2024.
  - rapind 2y ago
    Isn't making it illegal a way of sanitizing it though?
    - ctenb 2y ago
      No
    - sicariusnoctis 2y ago
      Will making (non-)computer viruses illegal sanitize the world of them?
      - rapind 2y ago
        Bad analogy. In the company name case, there’s a registry (list) with a gatekeeper (filter) in front of it rejecting very simple inputs (small strings) that don’t conform to their standards. You literally can’t get your company name on this list if you don’t pass muster. One might even say the list is “sanitized”.
  - hnfong 2y ago
    You probably want to say "correctly handle arbitrary input" than "sanitize" inputs. If everybody sanitizes their inputs (in undefined ways) then companies like the one mentioned would be randomly blocked from administrative processes. This is not what we (as a society) want. If Bobby Tables isn't a valid name the legislation should make it invalid, instead of rubber stamping it at the government registry and let poor Bobby get random errors when making requests to various public bodies. ("Sorry, our school does not admit persons with semicolons in their names.")
    - robertlagrant 2y ago
      Sanitising inputs would mean Bobby Tables would be able to use their name just fine.
resonious 2y ago
> It’s astonishing that handling and/or storing strings correctly is so hard Is it astonishing? "Don't sanitize your own strings; always use a library" is common advice for handling SQL and HTML, which implies to me that it is in fact pretty hard to do correctly.
- jvanderbot 2y ago
  I'm genuinely curious - where does this end? I once was curious about whether I should sanitize dynamodb inputs, and was surprised to see zero guidance for or against. How about things like parsing strings for serializing to binary storage? Can everything be an injection attack?
  - 3np 2y ago
    I think it's safe to put arbitrary data in DynamoDB (just use the proper API instead of concatenating it directly into a command string...) It's the systems interacting with it you have to be careful about. In general, there is no silver bullet beyond "understand your systems capabilities and limitations". Formal verification also comes to mind. > Can everything be an injection attack? What does this question even mean? I guess we must say "for any system accepting arbitrary input: yes". Not even sure if the "arbitrary" qualifier is necessary.
  - jakimfett 2y ago
    > where does this end? It never does, because abstractly speaking, there is no such thing as a secure computing system. This goes double for any computer that is switched on. Practically speaking, it depends on how critical your application might be. If you're storing values for neurosurgery or automated dispersal of life-saving (or potentially life-ending) medication, you'd better be sanitizing on the way in, validating on the way out, and have some additional layers like audits and comparisons to known good values at rest. Look into defense in depth, and never trust the computer to make a decision, because the computer cannot be held accountable. If you're storing quiz results for someone's favourite colour, or it's not internet connected, you can probably be a bit less paranoid about it. > Can everything be an injection attack? But yeah, anything and everything could be an injection attack if the attacker is determined enough. It's just a matter of how difficult you want to make it for them.
andylynch 2y ago
Agencies like this /already/ have plenty of other restrictions on what names are permissible, this is just a new one. Most are to do with ones which could be misleading, eg you can’t have ‘bank’ in the name unless you are, well, an actual bank.

IanCal 2y ago

And assuming all your consumers are not sloppy is impractical. We sanitise input all the time. This is not particularly unique. There isn't a great loss in this restriction of company names.

Dalewyn 2y ago
>We sanitise input all the time. No we don't. Companies like the aforementioned were made illegal because nobody sanitizes input. SQL query injection and other forms of malformed data entry is still one of the most common attack vectors in the year 2024.
- rapind 2y ago
  Isn't making it illegal a way of sanitizing it though?
  - ctenb 2y ago
    No
  - sicariusnoctis 2y ago
    Will making (non-)computer viruses illegal sanitize the world of them?
    - rapind 2y ago
      Bad analogy. In the company name case, there’s a registry (list) with a gatekeeper (filter) in front of it rejecting very simple inputs (small strings) that don’t conform to their standards. You literally can’t get your company name on this list if you don’t pass muster. One might even say the list is “sanitized”.
- hnfong 2y ago
  You probably want to say "correctly handle arbitrary input" than "sanitize" inputs. If everybody sanitizes their inputs (in undefined ways) then companies like the one mentioned would be randomly blocked from administrative processes. This is not what we (as a society) want. If Bobby Tables isn't a valid name the legislation should make it invalid, instead of rubber stamping it at the government registry and let poor Bobby get random errors when making requests to various public bodies. ("Sorry, our school does not admit persons with semicolons in their names.")
  - robertlagrant 2y ago
    Sanitising inputs would mean Bobby Tables would be able to use their name just fine.

resonious 2y ago

> It’s astonishing that handling and/or storing strings correctly is so hard Is it astonishing? "Don't sanitize your own strings; always use a library" is common advice for handling SQL and HTML, which implies to me that it is in fact pretty hard to do correctly.

jvanderbot 2y ago
I'm genuinely curious - where does this end? I once was curious about whether I should sanitize dynamodb inputs, and was surprised to see zero guidance for or against. How about things like parsing strings for serializing to binary storage? Can everything be an injection attack?
- 3np 2y ago
  I think it's safe to put arbitrary data in DynamoDB (just use the proper API instead of concatenating it directly into a command string...) It's the systems interacting with it you have to be careful about. In general, there is no silver bullet beyond "understand your systems capabilities and limitations". Formal verification also comes to mind. > Can everything be an injection attack? What does this question even mean? I guess we must say "for any system accepting arbitrary input: yes". Not even sure if the "arbitrary" qualifier is necessary.
- jakimfett 2y ago
  > where does this end? It never does, because abstractly speaking, there is no such thing as a secure computing system. This goes double for any computer that is switched on. Practically speaking, it depends on how critical your application might be. If you're storing values for neurosurgery or automated dispersal of life-saving (or potentially life-ending) medication, you'd better be sanitizing on the way in, validating on the way out, and have some additional layers like audits and comparisons to known good values at rest. Look into defense in depth, and never trust the computer to make a decision, because the computer cannot be held accountable. If you're storing quiz results for someone's favourite colour, or it's not internet connected, you can probably be a bit less paranoid about it. > Can everything be an injection attack? But yeah, anything and everything could be an injection attack if the attacker is determined enough. It's just a matter of how difficult you want to make it for them.

andylynch 2y ago

Agencies like this /already/ have plenty of other restrictions on what names are permissible, this is just a new one. Most are to do with ones which could be misleading, eg you can’t have ‘bank’ in the name unless you are, well, an actual bank.