Comment by lucideer | Hacker News Reader

Comment by lucideer | Hacker News Reader

> imagine you make a tab-completed typo when deleting a row. Yeah, you've just deleted an arbitrary row somewhere in your DB

This line seems to be the sole justification for the hyperbolic title. You might do tab-completed typo...

There's three justifications listed - the above (fairly minor, imo) one, information disclosure, and entity enumeration (which in this context is just another term for information disclosure).

The part on information disclosure has this line:

> all it takes to know your user count is to create an account. A number of social networks boasting impressive user bases were pwn3d this way

What? I would love a reference or explanation here. Who has been "pwn3d" by exposing their user count?

The "security through obscurity is bad" rhetoric has been rightly debunked plenty at this stage - obscurity is a valid component of layered security, but obscuring your table row count seems... odd. Why would that be a secret?

If you're worried about people being able to enter primary keys into a URL to access/scrape arbitrary records, you need better auth.

Strikes me as extremely reckless to edit a production database live with some tab completing editor. Is it really the norm to do that?

I don't know if its the norm but we do it here. Right click table, edit top 200 rows to add a new row.

We, unfortunately, edit the live db all the time.

It would seem to me that you should strictly control what software can edit the db. If you need some special feature, build it into your app and test it first. A general purpose editor can destroy the consistency of your entire database, or parts of it which you won't know about but your users will!

Yes, I understand it's a disaster waiting to happen. I mean if we want to edit a stored proc in the db, right click it in SSMS, script to modify, make the change, F5.

Hope everything doesn't blow up.

It's not ideal.

Why wouldn't you do that in the dev database, then push to test, then push to prod?

We dont' have a dev / test / live database.

All dev and testing is dont against the live database. YOu just have to be very, very, very careful.

It's something we are trying to implement now, honestly. It's on the TODO list.

The problem I'm having is where do you start? How do you simulate the data flowing through live in the test / dev enviornment.

Upvotes for honest anecdata and asking for advice!

> How do you simulate the data flowing through live in the test / dev enviornment.

Most don't, rolling with the schema and 'minimum viable' data flow instead.

Make darn sure your backups work by testing restores regularly. Restoring a production backup elsewhere may be an option if it's possible to avoid sensitive data (scrubbing afterward introduces risk of missing something, and should be scripted/repeatable).

Exactly matching production data flow is not as important as avoiding accidentally hosing the prod db.

Let me tell you from my experience. One time I was editing code on the live server using SFTP, before I knew about version control. And the whole thing was deleted, with no way to get it back.

It doesn't take that long to put some safeguards.

Here is the thing: WHENEVER you say "you have to be VERY careful" or blame someone for making a mistake, that's a place you need to put more checks. The computer should check routine things, not people.

"The problem I'm having is where do you start? How do you simulate the data flowing through live in the test / dev enviornment."

I am guessing you use MySQL so simply set up MYSQL REPLICATION and test all your stuff on the replica database first. Actually you should periodically dump the replica and test on a snapshot, so you can mess up the snapshot.

Main db -> Replica -> Snapshot.

It's a SQLSERVER, which at this point is about 200GB. Can I say just replicate the schema and then run a script to populate some test data. Or just move over a subset of the main DB?

Got any good articles on how to setup test environments. I would then need all the dev code to point to the test one, not the live db and any Web APIs to be able to switch to point to the test db (which must mean running 2 web apis, a live and a test one...)

Seems like it gets very complicated, but probably worth figuring out.

We don't even have CI yet.

Yes, typically when testing web applications, you have a second instance of the application running on a different machine than the production server, configured to run against a different database server as well. The exact details of how to do this well depend on how your application is written and its requirements.

If all you want to do is functional testing of the application by yourself, then it is OK to deploy a copy of the software on your desktop along with a test database. I do this for the application I work on, and when I need to test against MSSQL, the Express edition is good enough.

If you need to do load testing or integration testing or other more complicated forms of testing, you usually try to duplicated the expected production environment as well as you can. This may not be possible, so you may have to make decisions about what's most relevant and simply accept those tradeoffs.

EDIT: Don't worry about CI or anything else that fancy and complicated for now. You may not even need it; that depends on your team and how often your application changes. Just for now take the simplest steps you can until you get this basic stuff figured out first.

Here's two ideas:

1. Set up replication, with your test db the replication slave of your production database, such that changes in production are mirrored in testing nearly instantly.

2. Take your production database backups (you do have those, right?) and restore them to the test database. This is less fresh than a replication setup but if you're just doing functional testing it should be enough to say "Well, okay, this little change isn't going to blow everything up."

Not to excuse anything here, but you wouldn't believe how _insane_ some business environments are when it comes to databases. And yes, by that I mean those systems that you wouldn't believe anyone would ever want to risk losing.

Depending on what you're working on, chances are there even are people who use _security_ as an excuse to basically prevent any halfway useful emergency strategy one could think of when handling data impossible to pull off (oh the irony).

Availability is one leg of the CIA triad. Security is the justification for having backups and a recovery strategy, not an excuse for ignoring it.

In my job, I edit the production database live because adding a special feature (or even a bug fix) takes like a year to get deployed to production, even if it's as simple as a one line change.

If you're doing manual updates to a production DB, using START TRANSACTION and then checking the outcome of your changes before you use COMMIT stops typos becoming catastrophes.

There's some caveats with this approach, since your DB has to keep track of the split state since you've started the transaction, it's quite a lot busier. So don't keep transactions open for any long stretches of time ;)

In case it's not obvious: new auto increment IDs are skipped forever whenever a transaction is rolled back.

This isn't really an issue at all but can upset those with OCD-ish tendencies.

those with OCD-ish tendencies best hope they never lose any customers then.

UPDATE tbl SET deleted=1

This. There's so much in software development that relies on guarantees that can only be upheld by behavior like this that I _sincerely_ doubt that anyone having issues with skipped rows is in the right place.

There are arguments for and against any technique, but this one seems really ridiculous to me, especially if you consider what any "countermeasure" would do to the code (which is usually much more important than the data in the long run!).

Who has been "pwn3d" by exposing their user count?

It's less about direct "pwn3ge" than about business intelligence. The number of users could be sensitive information for some businesses, but it's not just users. Any item where your volume is valuable proprietary information, you better make sure you aren't exposing an auto-incrementing id. Number of accounts, number of daily orders, number of distribution centers, number of product models, these might be data points that a growing business would prefer not to expose to their competitors via, for example, URL query parameters. You should make competitors work harder for their intelligence.

I think "pwn3d" does but refer to a security issue in the article, but to social networks claiming to have millions of users and outsiders being able to proof that it's far less via user ids.

I don't understand how that would be proof.

Imagine that the social network does a rewrite, and rather than converting all the old accounts/data it just uses an additional flag to indicate which database to use. In that case a user id would not be globally unique for the website, but it would be unique for the specific database.

This is actually more likely than it sounds. The company can hire a fresh new team to make an experimental new site, and if it's a hit, they can make some ugly hack to do calls to the old website using web APIs to get any old users from that system. This way the new team doesn't need to learn and figure out how the old system was built, which likely lacks any documentation and where the original developers has left the company.

Without a full understanding of the layers of indirection it would be impossible to determine with certainty the number of users a social network has.

Social media networks claimed a number of users—falsely. Reporters created a couple accounts, got the true number, exposed the lies. Pwnage.

That seems a fairly terrible reason to advise against serial keys. That they expose fragrant lies about metrics made by incompetent marketing departments? Sounds like a feature.

here's an example of someone "pwn3d" by exposing their user count:

https://www.troyhunt.com/kids-pass-just-reminded-us-how-hard...

> all it takes to know your user count is to create an account

Also, this is only the case if your raw user IDs are visible. You only need a very basic encryption scheme to hide them. It can be as simple as taking two large prime numbers and sending (uid + x) % y to the user.

Basing user ids (as facebook did) on an autoincrementing number exposed when a user joined the site.

Mark Zuckerberg is famously 4 and you can find a lot of famous silicon valley types in the first million user ids :)

Reply on news.ycombinator.com