gistfile1.txt

3:31 <dambalah> is riak susceptible to some kind of 'injection attack'? 
If so, what's an example and what do application developers 
need to do to prevent these? 

13:31 <aphyr> No. Yes. 

13:32 <dambalah> haha... best answer ever. 

13:32 <aphyr> Basically, it's vulnerable to injection attacks in 
the same sense that any protocol written by software which violates 
layer boundaries is. 

13:33 <aphyr> The protocol itself is fairly hard to fuck up, same as mysql. 

13:33 <aphyr> The problem would lie in your client. 

13:33 <aphyr> For example, if you chose to do something like write a mapreduce 
query in which you inserted an unescaped string... 

13:33 <aphyr> That string could execute as code and produce unexpected results. 

13:34 <aphyr> That's somewhat isomorphic to an SQL injection attack. 

13:34 <dambalah> makes sense 

13:34 <aphyr> And if your client fails to escape strings correctly, 
that can cause issues to. 

13:35 <aphyr> i.e., if the client library constructs HTTP URIs without 
escaping the key or bucket... 

13:35 <Vagabond> yeah, the code in a M/R you'd need to be careful about 

13:36 <aphyr> There's a pretty easy way to prevent 
that: pass user-supplied data as an argument to the MR function 
instead of embedding it in the source. 

13:38 <dambalah> thanks 

13:39 <aphyr> Really, the answer is: don't shoot yourself in the 
foot and you'll be fine. 

13:39 <Vagabond> an attacker would have to work a lot harder to do 
something like a SQL injection attack 

13:39 <aphyr> The whole genre of SQL injection attacks came about because 
millions of PHP programmers thought it was perfectly OK to do things like 
"select * from users where  user_id = $user" 

13:40 <Vagabond> well, SQL makes it easy to do 

13:40 <aphyr> Not if you use a proper library. 

13:40 <Vagabond> its not just PHP programmers that do it like that 

13:40 <aphyr> I don't think I've ever used an SQL interface in any 
language that didn't know how to do parameterized string substitution. 

13:41 <Vagabond> sure, but its 'harder' 

13:41 <aphyr> Oh, right, haha yeah I forgot. 

13:41 <* aphyr> goes back to sequel, the impossible-to-use toolkit. :) 

13:41 <Vagabond> personally, I use parameterized queries too 

13:42 <Vagabond> but lots of people don't even know they exist