UPDATE outrage
SET criticality = 'kerfluffle'
WHERE vendor = 'sequoia' AND
type = 'leak' AND
humandate = '2009-10-21' AND
criticality = 'hoppitamoppita'4621051 >'njm }.dl\ <>
re: jsissom: you were able to load the .BAK? How? What version?posted by scalefree at 11:52 PM on October 20, 2009 [2 favorites]
There are 88 tables in the database. That's it. They deleted all of the stored procedures and triggers out of the database. They gave you exactly what you asked for - the data from the election - without any of their software. The $105 was probably the time it took to remove all the non-table objects from the database and backing it up.
So this is a data file, no source code included. Any strings you find are database pages that might have been used at one time by stored procs or triggers but are now marked as empty.
Sorry, I know you want a conspiracy or a story, but there just isn't one here.
I installed the latest version of SQL Server 2008 express and restored the backup to a database. At first it errored, but then I realized all it wanted was for me to specify a different file name for the two data files contained in the backup.posted by problemspace at 1:23 AM on October 21, 2009 [2 favorites]
What's interesting is that the Sequoia Voting Project site originally accused them of "vandalizing" the database backup but later reneged on that admitting it was a perfectly valid backup file. That was a pretty strong charge and I think the Sequoia Project site needs to watch what they claim.
[...]
One last note-- I took a quick look at the [WRITEIN] table to see the kinds of names people put in by hand. 22 people voted for "MICKEY MOUSE", 15 for "NONE OF THE ABOVE", and 7 for "POOH". (Whinnie the?) Other notable writeins included "BONO", "OBAMA", "SANTA CLAUS", "NO PREFERENCE" (anyone heard of him?), "DAFFY DUCK", "DONALD DUCK", and "F**K REPUBLICANS". (I added the asterisks) Way to go, Riverside County-- you sure showed them. :)
' A little function to generate properly quoted string
' literals for embedding in JET SQL statements - see rules at
' http://support.microsoft.com/kb/q147687/
Function q(s)
s = Replace(s, "'", "''")
s = Replace(s, "|", "' & Chr(124) & '")
q = "'" & s & "'"
if Left(q, 5) = "'' & " Then q = Mid(q, 6)
if Right(q, 5) = " & ''" Then q = Left(q, Len(q) - 5)
End Function
conn.Execute _
"UPDATE Students " &_
"SET " &_
"First_Name = " & q(firstName) & ", " &_
"Last_Name = " & q(lastName) & " " &_
"WHERE " &_
"Student_Code = " & studentCode
$db->prepare( <<"" )->execute( $first_name, $last_name, $student_code ); UPDATE Students SET First_name = ?, Last_name = ? WHERE Student_Code = ?(Your language may vary)
UPDATE Students SET FirstName = 'DanU+0027 WHERE studentCode = 10758;UPDATE Students SET FirstName = 'Dan' WHERE studentCode = 10758;Robert'); DROP TABLE Students;--'Robert''); DROP TABLE Students;--'O'Flaherty'O''Flaherty'
' A little function to generate properly quoted literals
' for embedding in JET SQL statements - see rules at
' http://support.microsoft.com/kb/q147687/
' Argument can be numeric or string.
' Result is always string.
Function p(x)
if isNumeric(x) then
p = x & ""
else
x = Replace(x, "'", "''")
x = Replace(x, "|", "' & Chr(124) & '")
p = "'" & x & "'"
if Left(p, 5) = "'' & " Then p = Mid(p, 6)
if Right(p, 5) = " & ''" Then p = Left(p, Len(p) - 5)
end if
End Function
...
conn.Execute _
"UPDATE Students " &_
"SET " &_
"First_Name = " & p(firstName) & ", " &_
"Last_Name = " & p(lastName) & " " &_
"WHERE " &_
"Student_Code = " & p(studentCode)
I agree with you that parameterized commands are the Right Thing, but I'm still not convinced they're the Only Thing.Parameterized commands are not the Only Solution, just the only reliable solution. Any sufficiently robust SQL-scrubbing mechanism ends up re-implementing parameterized commands.
Only if you believe that the machines are authenticated the way say there, which - if true - would be a far more meaty scandal than this data dump nonsense.Well, that's also the problem with closed-source trade secret code running our elections. I mean, maybe it's powered by the souls of delicious orphans! Who knows?
Does patent law trump the need for democratic elections?I don't really think the conversation can proceed productively if the disagreement runs that deep.
« Older What do Kudzu, the Northern Snakehead, St. ... | American Jews Rethink Israel:... Newer »
This thread has been archived and is closed to new comments
Someone at the FEC must have gotten into one to many flame wars with python users.
Is SQL really against the rules? That's interesting, seems like it would weed out a lot of hack programmers who can't write their own database engines or figure out BerkelyDB. It would of course make things more difficult to hack for hackers who can't figure out how to express themselves in machine code that they can inject (through a buffer overflow or whatever)
posted by delmoi at 9:53 PM on October 20, 2009