sehrope

7 ms·

1.
Postgres password encryption without leaking credentials(launchbylunch.com)
4 points by sehrope 3y ago|0 comments
2.
by sehrope 8y ago
The intended usage is that the client tells the server, " I want to load data from a file /path/to/data.txt on my local filesystem " in a SQL command. As part of the protocol for executing the query the server sends
3.
by sehrope 8y ago
> PostgreSQL 11 introduces SQL stored procedures that allow users to use embedded transactions (i.e. BEGIN, COMMIT/ROLLBACK) within a procedure. Procedures can be created using the CREATE PROCEDURE command and executed using the CAL
4.
How I Write SQL, Part 1: Naming Conventions (2014)(launchbylunch.com)
164 points by sehrope 8y ago|78 comments
5.
by sehrope 8y ago
UUIDs are fine too. What matters is how they're generated. If you're generating v4 UUIDs server side using the "uuid" NPM module then you're fine as internally it's using crypto.randomBytes(...)[1] with an alm
6.
by sehrope 8y ago
Hashing a value from Math.random() with a cryptographic hash (i.e. SHA256) doesn't make it cryptographically random[1]. If you want a random string get one directly via crypto.randomBytes(...)[2]: const id = crypto.randomBytes(32
7.
by sehrope 9y ago
What's the min version of the Postgres server this can be used with?
8.
by sehrope 9y ago
I've used WAL-E (the predecessor of this) for backing up Postgres's DB for years and it's been a very pleasant experience. From what I've read so far this looks like it's superior in every way. Lower resource usage,
9.
Remote code execution vulnerability in node-postgres(nodesecurity.io)
3 points by sehrope 9y ago|0 comments
10.
by sehrope 10y ago
Finally! Having dealt with many database drivers over the years, I can say first hand that closed source drivers are the bane of my existence. The only thing worse than running into a deep-in-the-stack bug in a database driver is one that
11.
Amazon RDS: Action Required for SSL Users by 23 Mar 2015(forums.aws.amazon.com)
4 points by sehrope 12y ago|0 comments
12.
by sehrope 12y ago
Does this allow users to execute custom SQL, in addition to ORM methods, and have it be part of the same transaction?
13.
by sehrope 12y ago
I played around with it quite a bit in early 2014 and even wrote a plugin for it. It gave me a better understanding of Docker and abstracting things into containers. The internals are all bash scripts so it's pretty easy to follow how
14.
by sehrope 12y ago
For me 600 iterations takes about 3ms (I guess my laptop is a bit faster). A decent range to shoot for is .5-1 sec. Test program: crypto = require 'crypto' password = 'testing' len = 128 salt = crypto.
15.
by sehrope 12y ago
From the link: ITERATIONS = 600 ... crypto.pbkdf2 pwd, salt, ITERATIONS, LEN, (err, hash) -> That's way too small for the number of iterations. Something like 100K would be a better choice. Alternatively here'
16.
by sehrope 12y ago
> ... and if streams become a better and better option as response sizes get larger and larger. The streams syntax is nicer looking in any case. fs.readFile(...) reads the entire contents of the file into memory. For small files that may
17.
Misfortune Cookie crumbles router security: '12 MILLION+' in hijack risk(theregister.co.uk)
5 points by sehrope 12y ago|0 comments
18.
by sehrope 12y ago
Any background on who's doing this or what the motivation is? The linked site doesn't have much content besides a link to the GitHub repo. EDIT: Even though it's not explicitly listed in the README or contributor list, the co
19.
by sehrope 12y ago
> If your app needs a relational database then use an in-memory db like hsql or cloud services like Heroku Postgres, RDS, Redis Labs, etc. However one risk with most in-memory databases is that they differ from what is used in production
20.
by sehrope 12y ago
LATERAL is awesome. It makes a lot of queries that required sub-select joins much simpler to write and later read. It's also great for set returning functions. Even cooler, you don't need to explicitly specify the LATERAL keyword.
21.
by sehrope 12y ago
Most Postgres clients have issues connecting to Amazon Redshift. The wire protocol is the same so basic interactions ( ex: connect via psql and run a SELECT ) usually works but things get hairy when you start doing more complicated things o
22.
by sehrope 12y ago
> In this trial, XFINITY Internet Economy Plus customers can choose to enroll in the Flexible-Data Option to receive a $5.00 credit on their monthly bill and reduce their data usage plan from 300 GB to 5 GB. If customers choose this opti
23.
by sehrope 12y ago
Oracle supported both full refresh and incremental refresh as of at least 10 years ago ( maybe longer ). Fast refresh requires creating "MATERIALIZED VIEW LOGS" on the source table(s) and covers most (but not all) aggregations&#x2
24.
by sehrope 12y ago
>> Seemed like a good idea until it dawned on me that this means the passwords are stored as plaintext. >There are several ways this can be done without that. >Easiest is if they store the date of the last password change or oth
25.
AT&T demands clarity: Are warrants needed for customer cell-site data?(arstechnica.com)
2 points by sehrope 12y ago|0 comments
26.
by sehrope 12y ago
> The old prototype machine had our AWS API access key and secret key. Once the hacker gained access to the keys, he created an IAM user, and generated a key-pair. Ouch! This is why you must practice the principle of least privilege wh
27.
Verizon: ISPs will sue unless government adopts weaker net neutrality rules(arstechnica.com)
2 points by sehrope 12y ago|0 comments
28.
by sehrope 12y ago
Now this is cool! (and I'm not saying that just because I was thinking about it yesterday[1]). It's amazing to see how with the multicorn[2] FDW it takes less than 40 lines of python to put this together. [1]: https:/&#x2F
29.
by sehrope 12y ago
This is pretty neat. I'm a big fan of SQL in general and being able to query system stats like this feels pretty natural to me. A long time back I created something similar to this atop Oracle[1]. It used a Java function calling out to
30.
by sehrope 12y ago
An interesting solution I've heard[1] to reform both copyright ( and possibly patent ) law is to require compounding annual fees to maintain them. For example if someone writes a new song or book, we could have a short "free"

More ›