afongen

Earlier this year David Litchfield published a paper about what he calls lateral SQL injection (PDF), in which he demonstrates how to exploit PL/SQL procedures that don’t take user input. It’s a rather clever bit of work that shows that data types such as DATE and NUMBER, normally considered safe from injection, are in fact not.

But what caught my attention was his inspiration:

Whilst watching an episode of ‘Bones,’ something happened in it that made me think of not accepting something believed to be true, i.e., in this case that it’s not possible to SQL inject via DATE or NUMBER data types.

I love it.

Here’s a tip. When telling one’s spouse about a story in the Onion, make sure they’re awake enough to notice that you said it’s from The Onion.

I started telling Kiara about this guy who was caught in a scented candle store during a mall shooting.

“I looked around at where I was and told myself there was no way in hell I was going to let them find me curled up behind a floor display of Midnight Jasmine Housewarmer jar candles.” …

Much of Mull’s desperate plight was captured on mall security cameras. In the grainy footage, he can be seen inching his way slowly over the blood-slicked floors and past the contorted bodies of other victims before collapsing unconscious in the entrance of The Sharper Image.

She looked at me, horrified. “Oh my god, is his wife alright?”

That’s when I realized that she had been asleep when I started talking and missed the crucial bit.

Then again, maybe it’s just safest not to share stories like this, period.

Saint Paul College has been named a Sun Center of Excellence. My favorite part? The URL:

http://www.sun.com/products-n-solutions/edu/programs/coe/

There are so many other things they could have done instead of “products-n-solutions” that would have been more likely.

• productssolutions
• productsandsolutions
• products-solutions
• products
• solutions

Their services and solutions page has “servicessolutions” in the URL. If you try to go to http://www.sun.com/products-n-solutions/ you get redirected to http://www.sun.com/products/index.jsp. (Bravo for that! It could so easily have returned a 404 File Not Found. Pity about the “index.jsp” bit, though.)

And of course, any of that could have been capitalized, but with Sun’s Unix roots, we can hardly expect that, can we?

But no. It reads “products ‘n’ solutions.” How terribly colloquial.

Small things delight me. What can I say.

This xkcd has left me rolling on the floor laughing:

Update: it hadn’t sunk in that I had a fixed-width design until the image of the comic was borked. It has now been resized, and I’m likely to go looking for another design.

I didn’t notice right away, but someone did: Flickr is available in Pirate. Today, at least.

Nice. Almost makes me want to wallow in self-pity. Flickr does this, Bloglines has their plumber, Twitter of course had their lolcats. And me? I catch flack for using the word “oops” in an error message.

No, really. It was very controversial.

I won’t lie to you, though, I actually considered celebrating Talk Like a Pirate Day in our course registration app in exactly the same way Flickr has done. I thought better of it, though. However tempting it might be, I’ve found it best not to tick off college registrars. :)

This has been floating around the back of my brain for months and is just dying to get out. Please do not consider it Microsoft bashing: it’s just funny.

During a bit of a crisis last fall, a few of our network and server admins were gathered around the phone on a support call with Microsoft.

“Sorry if we don’t do this right,” I heard one of them say. “We’ve been a Novell shop for 20 years and have never had to call tech support. We don’t know how.”