Maybe more of a general coding question but how do...
# thinking-together
m
Maybe more of a general coding question but how do you y’all feel about database/stores that add fields to your documents that insert? E.g. you insert
{ name: 'Titanic', director: 'James Cameron' }
into
movies
and when you fetch it you get back
{_id: 1234, _col: 'movies', name: 'Titanic', director: 'James Cameron' }
Does that bug you? Don’t care? Are there any ways to get around this so there aren’t won’t ever have collections between user defined fields and internal metadata?
p
I feel that data and metadata should be strictly separated so that I don't ever accidentally corrupt metadata by using a field that I'm not supposed to. This is the same kind of in-band signaling that made the old phone system vulnerable to blue boxes and that created SQL injection vulnerabilities all over the internet.
m
Not sure I follow that last part
p
When you mix data with metadata, you make it possible for certain values of the data to accidentally or deliberately corrupt the metadata. With in band telephone signaling, telephone system devices communicated with each other using special tones that were sent over the same audio channel as the voice communications. This made it possible for people to manipulate the devices by playing tones into their telephone. The data is the voice communication, and the metadata is the phone system signaling information. By sending them in the same channel, it became possible for people to corrupt the metadata through carefully chosen values of data. People who construct SQL queries by including user supplied data, rather than using placeholders, create the risk that carefully chosen values of data, namely the thing being searched for or stored, can corrupt the "metadata," (okay, I'm stretching a little here, but the principle is the same.) that being the structure of the SQL query itself.
l
Not sure about the database case but I feel that too much implicit & hard to guess "magic" behaviour is generally a bad thing. – Shell script is really bad at that in syntax interpretation (parse time). – Python does a lot of implicit magic at runtime. Even seen a video mocking this for a laugh (with a cringe & tear). Personally I rather prefer more verbous expliciteness. Doing trice the work upfront instead of doing 30x the debugging work later. Well, exaggerating a bit. Maybe. I think progressive disclosure is what we need to get out of that misery conserving rut. But that needs structural-projectional editing. –For C&C++ go no further than: http://henning-thielemann.de/CHater.html