Thread

1. mikestew · 1790117337 · focus · HN ↗

   Here’s my problem with reviving FoxPro in any form: there’s a huge security hole in the Database Container (DBC) design. For DBCs to be useful, they must be read/write to all users (there is no permissions scheme). DBCs have stored procedures that can run any FoxPro code, including Win32 calls made from the FoxPro runtime. The stored procedures are stored as plain text in a “memo” field. Do you see where this is going? With a little technical knowledge, one can modify that INSERT trigger to whatever you like. EDIT: as the DB is just files in the file system, modifications can be made using a text editor, bypassing any checks in the FoxPro runtime. FoxPro just executes what it finds in there.

   My recommendation is to get rid of the DBF/DBC files and move to a SQL DB of some flavor ASAP. If you have the source code, use ODBC or OLE DB to point to a server.

   Source: filed that bug over 20 years ago when I worked on the Fox team. No, it wasn’t going to get fixed without rewriting large parts of how the DB engine worked.

   1. EvanAnderson · 1790118506 · focus · HN ↗

      One of the Ohio Secretary of State's "certified" (wrong terminology, but you get the idea) voter registration databases used by various county Boards of Elections is written in VFP. The software maintains the list of voters, their addresses, and scans of signatures.

      Recently it had TOTP 'MFA' added to comply with a Secretary of State mandate.

      Anyone who uses the software can just open the database files directly. They're just DBF files in a shared folder on a file server. All the users have to have read/write access to the files or the application won't work.

      I hang my head.

      1. marcus9999 · 1790129991 · focus · HN ↗

         seen this exact pattern in small business FoxPro setups too, DBFs on a share are one dropped SMB connection away from a corrupted index. if you're stuck maintaining something like this the least bad move is nightly copies of the whole folder to a second box, and actually opening that copy in the app now and then instead of just checking that the file sizes match.

         1. monster_truck · 1790183230 · focus · HN ↗

            This is an _excellent_ example of what anyone who has been professionally responsible for backups means when they say "it's not a backup until you've restored from it, booted into it, opened the app, and accessed the data"

            There's still so much software out there that is an absolute lynchpin to a business that will never have the kind of durability/compatability many take for granted. The only thing that has changed in the past 2 decades is the operating system running the VM. In 2026 they are still yelling across the office or exchanging phone calls when one has finished and signed out so that the other can sign in and pull the updates.

            It often isn't taken seriously or is written off because it's a "small business", but those 2-8 people run a book of business that clears this comment thread's lifetime earnings annually.

Unofficial Hacker News client; not affiliated with Y Combinator.