« first day (1275 days earlier)      last day (1383 days later) » 

12:29 AM
@m59 the attack doesn't sound viable. They'd have to know that the particular operation caused new rows to get created
I imagine that creating new posts would be more obvious
Also, unsigned integers go up to 4.2b
which is a lot. they'd ddos your server before they overran that
 
m59
Oh, so just don't put a limit on it?
and the attack would probably be as simple as:
var flag = 0;
setInterval(function() {
  var fn = flag ? post : delete;
  fn();
}, 5)

function post() {
  // ajax post to 'api/posts/1/comments/votes'
}
function delete() {
  // ajax delete to 'api/posts/1/comments/votesl
}
and any scrub could see the api address used just looking at the network tab.
 
 
2 hours later…
m59
2:24 AM
by limit, I meant: id INT(15) vs id INT
 
 
10 hours later…
12:40 PM
@m59 The 15 doesn't actually limit the value at all
@m59 Here are the min/max values of the numeric types - unsigned int goes up to 4294967295, no matter what "display width" you pick
@m59 sure, but making that attack would take knowledge about how you stored your data. If somebody wanted to do something like that, doing the same thing to create bogus posts or users would be a more obvious first choice
 
 
2 hours later…
2:29 PM
@TehShrike hey
 
@kabuto178 howdy
 
hehe going good so far
need some lunch though =\
 
 
1 hour later…
m59
3:59 PM
@TehShrike oh wow, that just blew my mind.
I've even read a tutorial online saying something wildly different.
Err... wait. That's only for INTs?
So, it's just inconsistent with the way other types work? On INT it's display width and on the others it is length?
 
 
2 hours later…
6:26 PM
@m59 Correct. Confusingly, it is a VERY meaningful number in DECIMAL and CHAR types, but not INT.
 
m59
7:20 PM
Confusion: just what every programming API needs :)
 

« first day (1275 days earlier)      last day (1383 days later) »