For the best experience on desktop, install the Chrome extension to track your reading on news.ycombinator.com
Hacker Newsnew | past | comments | ask | show | jobs | submit | history | more qxcv's commentsregister

They do, but what we're talking about here is an ORM, so there will always be machine generated SQL somewhere. Or do you believe that GP is suggesting that developers use parameterised SQL queries instead of an ORM?


Er, why can't the ORM use paramaterised queries?


The problem is that ORMs like ActiveRecord really are just domain specific languages for building queries. If these DSLs use inband are carelessly constructed (e.g. they use some form of inband signaling) you can do the injection attack against the actual ORM code and make it build queries the author of the code did not intend.


http://sqlalchemy.org/ is an ORM and does not have these security issues. So it can be done.


Searching for "sqlalchemy sql injection" brings up this: https://bugzilla.redhat.com/show_bug.cgi?id=783305


I did not say otherwise. I said that ORMs may be vulnerable if they are carelessly constructed.


And yet Google is still the easiest way to search for pirated content. I think that the most interesting part of this article is that the biggest alleged infringer, FilesTube, doesn't actually host any infringing files! It's simply a search engine which uses hyperlinks and iframes to embed results.


Apparently the rules are pretty simple; FilesTube gets indexed by Google[1], so it's a candidate for deindexing.

[1] I won't speculate about whether FilesTube is actually a search engine or a Mahalo-style SEO arbitrage play, since that's off-topic.


The pseudo-C used in the Quake 3 VM had no malloc()[0] and they wrote a frigging AAA game with it. I suggest you check out their source code[1].

[0] http://wiki.ioquake3.org/Getting_the_most_from_Quake3_C#No_M... [1] https://github.com/id-Software/Quake-III-Arena


This XKCD[0] explains the issue with Hurd perfectly, more-or-less echoing the ideas rogerbinns expressed. Note the mouseover text, which makes the observation that the Hurd loop is the loop in which you "code right" and the Android loop is the loop in which you "code fast".

[0] https://xkcd.com/844/


If it has GObject as a dependency, then it's not designed for "low-level systems programming". Hell, just having a GC more-or-less discounts it due to the associated problems with runtime size and performance[0]. As a general rule of thumb: if you can't write a kernel in it, it's not a systems language.

[0] It is possible to write a systems language with these features, but low-level systems stuff is not what Vala was designed for.


GObject itself is not a dependency, Inheriting from GLib.GObject provides support for features like introspection and better integration with the collections framework and GLib libraries. However, lightweight 'non-object classes' are supported but treated differently by the compiler. There is a slight variation in constructor syntax between plain objects and GObjects.

As far as I know there is no Vala runtime or garbage collector. Memory management is by automatic reference counting but there is support for manual C++-style pointer syntax with new and delete operators.

I agree that Vala was not specifically designed for 'low-level systems stuff' but I see no reason why this is not technically possible. The Vala compiler is a source-to-source translator to C and in my previous experience worked fairly well interfacing with fairly low-level C libraries like MPI and OpenCL. I assume that a kernel writer does not require much more than a limited subset of the language that supports C pointers, structs and arrays.


> And I wouldn't care less. It's not harming me in any way, like it's not also harmful if they drink a bottle of beer on their way home in the subway, which is totally accepted also.

To claim that second-hand smoke is not harmful is utterly absurd. The same goes for alcohol consumption in public places. It's fine to have a drink on the subway, but who takes care of the shattered glass the following day[0]? If you're lucky, the local government will use ratepayer money to clean it up. If you're not lucky, it stays there indefinitely.

Frankly, I think that those who drink or smoke in public are being totally inconsiderate of others.

[0]: This wouldn't be such a big deal if glass bottles weren't so popular. Unfortunately, they are.


So in your opinion everybody who drinks in public always makes a mess? I go to the lake with friends and drink often, but we clean up and put it in one of the public bins.

Also one could argue that if the park is publicly owned it should be publicly cleaned. If you dont want the park getting dirty you should let people in there.

> Frankly, I think that those who drink or smoke in public are being totally inconsiderate of others.

I think you can make a argument for smoking inside (or bars for example) but in a public park.

Also you have to understand berlin, even if smoking is not allowed in bars it is done in almost every bar, people seem to just have rejected the legislation.


> So in your opinion everybody who drinks in public always makes a mess? I go to the lake with friends and drink often, but we clean up and put it in one of the public bins.

I was a bit harsh on drinkers. It is more smokers whom I have a beef with. What I should have said is that I feel as though a consistent approach to regulation of where glassware can and cannot be used is required.

> Also one could argue that if the park is publicly owned it should be publicly cleaned.

Perhaps that might be possible where you live, but it would never happen in my city. Most people here (including myself, I admit) simply don't have the necessary motivation to pick up broken glass unless it's in a place where they can't afford to ignore it (a playground, for example). I cycle-commute each day, and there has been a broken bottle sitting on one of the roads I use for the better part of a few months. The road in question has relatively little vehicle traffic, but is next to a small University and is part of a major bicycle corridor used by hundreds of cyclists each day. It would be trivially easy for just about any of the people who pass it to try and dispose of it properly, but nobody ever does. Annoyances like broken glass, buckled footpaths, etc. tend to just be ignored until somebody gets hurt. I'm not convinced that it would be possible (at least, not in the short term) to get a large number of residents to voluntarily take responsibility for fixing problems which they did not cause.


I dont mean public in the sence that goverment (witch ones the land) has to clean the land.

Im totally ok for example with giving fines to people who do make a lot of shit around.

I just kind of think that a park where you can not sit around drink and smoke with your friends is kind of pointless.


He also said that there aren't any rails and it runs on the ground. At the moment, we have a Concorde without wings[0] (a lifting body Concorde, perhaps?) crossed with a railgun without rails. Sounds like vaporware.

[0]: It could still have wings but operate under ground effect, though it seems that it would be difficult to keep your leading edge intact travelling just above a hard surface "twice as fast as an airliner". "Twice as fast as an airliner" is Mach 0.85 * 2 = Mach 1.7 at FL360, which translates into Mach 1.5 at sea level. One useful thing we learn from this is that this system will basically have to be propelled by compressed air or electromagnetic force, since props don't work over Mach 1 and we don't have electric turbines.


Hmm, well I guess roads are cheaper than rails (i.e. rails along the entire route of the trip, not speed up rails like in a rail gun). And powering something from fixed locations (guns) is cheaper than bringing your engine with you.

So maybe it is like a train, one person per, but it runs on cheap road like track, and it's propulsion is provided by fixed stations. If each track was a straight run from station to station you could just ditch the wheels and whatnot and fire the thing between stations along the ground.

There's no way it could move so fast and still use car roads, unfortunately, so it will still have problems buying track space or building tunnels or building elevated paths. Too bad it runs on the ground.


> Hmm, well I guess roads are cheaper than rails [...]

We could look that up. But considering that roads and rails the world over are often build by governments or government owned corporations, I expect Elon Musk to have found a much cheaper way to build his infrastructure.


> Has there ever been attempt to implement it in openssl, gnutls, etc, so as to not depend on this ActiveX plugin?

SEED is implemented in NSS (Firefox's network security backend)[0] as of 2010. I'm not sure whether or not that removes the dependency on IE, though.

Edit: looks like it's implemented in OpenSSL as well[1].

[0]: https://bugzil.la/453234 [1]: https://www.openssl.org/docs/apps/ciphers.html#SEED_ciphersu...


The dependency on IE is also a result of Korean coders/designers relying on the quirks and bugs and specificities of IE6 for their websites. Even when it comes to non-e-commerce sites, many (most?) sites won't function properly if you don't use IE.

This is the end result of the encryption-thing, so getting rid of that would be a proper step forward, but wouldn't solve the problem itself. By now IE it's systemic :[


> Why do I need to pick someone who poorly represents my views and will probably vote against my interests, when I could easily vote on actual issues.

That's a great idea! In fact, I can see a business opportunity for an enterprising individual (or group of individuals, as it may be) under such a system: one could assemble a team of advisors who would analyse and debate legislation in order to decide on an optimal outcome for the country. Their advice could then be given to paying subscribers, who would vote in accordance with it, and thus pass legislation which benefits the country. If the subscribers disagree with the advisors, then they could subscribe to a different team of advisors after a period of time, and use that team's advice. This way, the subscribers get the benefit of deciding the country's future without the hassle of having to deeply analyse issues each-and-every time a new piece of law comes up. This is especially beneficial if they are not knowledgeable in or care little about a given field, but do not wish to leave legislation of that field to a small, entirely self-selected group of individuals (democracy is about representing the interests of the whole, after all).

Yes, I've got the basics all sorted out. To paraphrase Phil Karlton, the hard part is thinking up a name for the damn thing! I was thinking something edgy and retro like "The Parliament" or perhaps "Congress", but I'm open to other suggestions as well.


Err, no, that's not what I was thinking of at all. You're still wedded to the idea of political parties and representatives.

Maybe some people would do what you suggest. Others would not.

If you fundamentally disagree with direct democracy then that's fine, but painting at as no different from representative democracy, in which a person has no direct say, is just wrong.


Also, if voters find there's too much to vote on, perhaps that would be because there's far too much legislation.

At the moment it's so much that even the pople voting on it can't read all that much.


Yes, because that's working so well.


> why would a 14 year old want to make sure his age is on the post title?

Because they know that they'll be praised for it and probably manage to sell a couple of copies. It also makes sense as something to put on a higher-ed application or CV ("I can already write commercially successful pieces of software, I got X comment from Y developer and sold N units").

That said, you're probably right in suspecting that this is partially driven by someone other than OP. The landing page of MakeGamesWith.Us has Cheese Miners on the front page along with the text: "It's so easy we got high school students to do it".

However, regardless of OP's motivation, it is well worthwhile applauding them on a job well done at such a young age. There are nowhere near enough teenagers taking up programming[0], and I hope that success stories like this will encourage more young people to at least get their feet wet with this financially and mentally rewarding craft.

[0]: This is especially troubling given the ubiquity of free development environments and online instructional material.


Consider applying for YC's Summer 2026 batch! Applications are open till May 4

Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search:

HN For You