Thread

1. mikestew · 1790117337 · focus · HN ↗

   Here’s my problem with reviving FoxPro in any form: there’s a huge security hole in the Database Container (DBC) design. For DBCs to be useful, they must be read/write to all users (there is no permissions scheme). DBCs have stored procedures that can run any FoxPro code, including Win32 calls made from the FoxPro runtime. The stored procedures are stored as plain text in a “memo” field. Do you see where this is going? With a little technical knowledge, one can modify that INSERT trigger to whatever you like. EDIT: as the DB is just files in the file system, modifications can be made using a text editor, bypassing any checks in the FoxPro runtime. FoxPro just executes what it finds in there.

   My recommendation is to get rid of the DBF/DBC files and move to a SQL DB of some flavor ASAP. If you have the source code, use ODBC or OLE DB to point to a server.

   Source: filed that bug over 20 years ago when I worked on the Fox team. No, it wasn’t going to get fixed without rewriting large parts of how the DB engine worked.

   1. userbinator · 1790122992 · focus · HN ↗

      there is no permissions scheme

      If you already have full access by design, then there's no "huge security hole" either.

      1. EvanAnderson · 1790123702 · focus · HN ↗

         Exactly. It's not a security hole. It's just the architecture of the program.

         It seems like many people have a hard time understanding this, including developers.

         Any attempt to add any kind of permissions, security, etc, without addressing the nature of the architecture (that the database engine runs in the same address space / security context as the UI) misses the point.

         1. Towaway69 · 1790147240 · focus · HN ↗

            Further along those lines, it was a different world when the code was created.

            Trust was a thing back then. Spam was something that came out of a tin and was made of dead animal. And passwords were limited to eight ASCII characters.

            And as such, bolting security onto something that was designed inherently to be security agnostic is going to be a recipe for failure.

            1. mikestew · 1790178784 · focus · HN ↗

               Trust was a thing back then.

               No, it wasn't. The reason I even raised this bug to begin with was not because of some nefarious $BAD_COUNTRY hacker getting yer dataz from far away, it's because you have to worry about your own users first. I'd guess that any consultant doing the kind of work FoxPro excelled at (LOB apps) has found some clever boy or girl who discovered they can poke at DBF files directly. Long before internet connectivity was common, one still had to worry about your own coworkers futzing things up.

Unofficial Hacker News client; not affiliated with Y Combinator.