Blog

Today over lunch I was recounting my first hour on the World Wide Web. I was in middle school (I'm 28 now) and we had visited a friend's house. He told me if I was good he would give me one free hour on The Web.

It has been mentioned in several places that MySQL 5.0.1 has a NO_BACKSLASH_ESCAPES mode it can be run in to prevent backslashes from being an escape character. Thanks to Azadi Saryev for pointing it out on my blog and Mark Krugers as well. Jake Munson even posted instructions for applying the setting to your SQL server at startup. For the record, you can also use this setting on a specific data source.

I've been staring at my computer monitor trying start this paragraph for about 10 minutes now, so I'm just going to start typing. I've been thinking about system design. Organization versus performance. Design patterns versus efficiency. We adopt some code without thought to its performance because we're talking about milliseconds, and the readability, organization, and structure gains our apps enjoy are well worth it. I'm not sure that is always the case though, and we don't notice it until too late.

Well, after a brief hiatus, the SQL Injection attacks have reconvened with a small change. They have modified the capitalization of a couple words in the URL. "DECLARE" has become "DeCLARE", and "EXEC" has become "ExEC". This is obviously to get around people who employed case-sensitive filtering mechanisms.

My partner in grime, Wes Bondy, has been filling my garage up with old car parts since-- well, since I've had a garage. If it was made in the 20's or 30's, came off a pickup truck, or has Hudson, Federal, Mack Jr., Diamond T, Stewart, or Studabaker stamped on it, we're interested in it. Today, after finally getting our Ford Ranger donor stripped down to the frame, we accomplished a mockup of what our first Rat Rod will look like-- the Federal Express. Oh Lord, haste the day. Check it out at http://www.diamondtbucket.com/index.cfm?do=projects

On my home PC I have the developer edition of ColdFusion 8 installed along with Apache Web Server and MySQL 5. Apache and MySQL are pretty lightweight, but ColdFusion can get a little bulky when it comes to memory. I don't use my personal Dev sites all the time, so I like to turn it all off when I'm not using it. I only have 1 gig of RAM in this PC after all.

So I clicked my Microsoft Word 2003 icon just now with my hand resting on the keyboard. After a second this message popped up: "Word has detected that you are holding down the CTRL key. Do you want to start Word in safe mode?" How did it know that?? It must have been looking through my monitor! Now I'm afraid to type anything bad about Microsoft. WORD IS WATCHING!!

So as the SQL injection attacks have rained down on my server for the past few days, my logs have been steadily filling up with data about the requests. Frankly, the data probably can't be trusted, it's all totally un-scientific, and doesn't really lead me any closer to the people responsible for the attacks. Regardless, I think it's pretty interesting. I've compiled some graphs and stats here.

I love infinite loops. They're sort of the black hole of programming. No one really knows what you code does when it reaches the last iteration of an infinite loop, but I speculate it has something to do with String Theory and unbounded time and space increasing proportionately to the rate of dense matter being compressed by gravitational forces so strong even light can't escape. Well, that's what I came up with off the top of my head anyway. Speaking of infinite loops, I found one happening on my server today.

So, I assume you've heard the latest buzz about DNS Cache Poisoning and the subsequently released patches. It's rather interesting, and a bit unnerving that the "patch" for now simply makes the exploit harder to pull off-- not impossible. I guess that's basically because the patch simply makes name server requests more randomized. Anything more would require an overhaul to the DNS protocol itself.