VBA Rubberducking

Duga

00:00

RELOAD!

[Minesweeper] Games Played: 42, Bombs Used: 26, Moves Performed: 5600, New Users: 11

RELOAD!

[rubberduck-vba/Rubberduck] 1 commits. 37 additions. 6 deletions. 5 issue comments

Duga

00:24

[rubberduck-vba/Rubberduck] jonathan-rizk assigned jonathan-rizk to issue #5281: Code Inspection Error: Test methods give the Procedure Not Used inspection

Duga

08:06

[rubberduck-vba/Rubberduck] Vogel612 commented on Rubberduck.Parsing/Annotations/ITestAnnotation.cs of pull request #5367: ProcedureNotUsedInspection ignores declarations that have ITestAnnotations

FreeMan

12:30

@this Bill Gates in 1981: '640Kb ought to be enough for anyone' or did he actually say that

I keep getting this error:

with this code: conn.ConnectionString = "ODBC;Driver=Microsoft OLE DB Driver 18 for SQL Server;" & _

Have I specified the Driver= portion wrong or do I need to install the SDK, too?

"and optionally installs the header files needed to develop an application that uses the OLE DB API."

this

13:07

You're mixing ODBC and OLEDB.

You really want it to be conn.ConnectionString = "Provider=MSOLEDBSQL;...."

No need for ODBC;

Did you read the article I linked you to?

@FreeMan Yeah I know about that - I think the most compelling argument is that even if he did say it, he would more likely have meant for that time, not for forever & more. Still, it's a funny quip to misquote. :)

FreeMan

@this Yeah, I've been reading finally found that...

Progress = Banging your head on a new post...

RTE: 80004005 Named Pipes Provider: Could not open a connection to SQL Server [53]

this

13:25

I guess your Server isn't in a URI format

FreeMan

@this also, which article? This one?

"Server='tcp:" & ServerID & ".database.windows.net,1433';"

this

IIRC, you're using Azure -- it ought to be Server=<some name>.database.windows.net,1433

hmm.

@FreeMan Yes

FreeMan

guess I should use better name formatting - that's a Const

this

the tcp: even makes it explicit.

what's the full connection string now?

FreeMan

@this I read it. Still not 100% on the difference between ADO and DAO and when/why one would use A v D... I've written everything in my project using ADO because... I did.

Grabbed some code from a Mug CR post from ages ago and it's in DAO, but if I can get the connection string working, I can rework his code to ADO, to match, or make the change everywhere. Not sure what the benefits of either option would be...

  conn.ConnectionString = _
    "Provider=MSOLEDBSQL;" & _
    "Data Source=Microsoft OLE DB Driver 18 for SQL Server;" & _
    "Server='tcp:" & ServerID & ".database.windows.net,1433';" & _
    "Initial Catalog='" & DBID & "';" & _
    "Uid='" & UID & "';" & _
    "Pwd='" & PWD & "';" & _
    "Encrypt='yes';" & _
    "Authentication='ActiveDirectoryPassword';"

this

13:29

uh, not aware Mug was using DAO. I thought he used ADO pretty much exclusively given that he's using Excel, rather than Access.

you're quoting stuff.

take out the quotes

(that is, the single quote marks)

FreeMan

Looking at this MS page (specifically here), I'm using the IDataInitialize::GetDataSource: formatting (it includes Provider=), for everything but the Encrypt string.

@this hrm... maybe I misread something. #NotTheFirstTime

  conn.ConnectionString = _
    "Provider=MSOLEDBSQL;" & _
    "Data Source=Microsoft OLE DB Driver 18 for SQL Server;" & _
    "Server=tcp:" & ServerID & ".database.windows.net,1433;" & _
    "Initial Catalog=" & DBID & ";" & _
    "Uid=" & UID & ";" & _
    "Pwd=" & PWD & ";" & _
    "Encrypt=yes;" & _
    "Authentication=ActiveDirectoryPassword;"

same error

this

@FreeMan you'll note that there are no quotes nowhere.

take out the Data Source. TBH I never use that.

FreeMan

something I read said " ' { were optional, so I thought I'd give it a try... (Somewhere being in the myriad MS docs pages I've read through in the last hour)

this

and to clarify DBID is a name, not a nmeric ID?

FreeMan

badaboom!!!

removed the Data Source and it connected. Yes DBID is the name of the database, not a nmeric ID. :)

jclasley

13:35

That feeling when you hit it just right on the club baby! Congrats @FreeMan

FreeMan

@this You are correct - it's ADO. I totally misread and have no idea how/why...

jclasley

"Celebrate the victories when you have em" is my motto

FreeMan

@jclasley Amen!

this

you know, you could have made an UDL file, too.

FreeMan

celebration woulda been greater if I'd figured it out myself, but I don't mind getting a ~~little~~ whole lotta help.

jclasley

13:37

Nobody's every figured anything out by themselves

this

IIRC, that would give you the connection string in plain text

FreeMan

@this is that what file-DSNs are called now?

this

DSN = ODBC

UDL = OLEDB

FreeMan

ah...

more-or-less equivalent then...

this

you're dealing with two different technologies that has a large overlap. Try to not conflate them.

To make it even more complicated, you can use ODBC over OLEDB, which is why you will see confused code using ODBC in OLEDB/ADO context

and to emphasize... ADO builds on OLEDB; DAO on ODBC.

Would you like an alphabetical soup on the side, sir?

FreeMan

13:40

<-- is sadly still very much Mort when it comes to understanding this particular bit o' his world...

this

#BlameMicrosoft

FreeMan

ADO = ActiveX Directory Object(s), right? Didn't I read something (possibly from Mug and the source of my confusion) that ActiveX controls (especially within Excel) are fairly well borked and/or just a general mess to deal with and should be avoided?

@this always and forever!

this

sigh

FreeMan

takes that as a "no"

this

yes it has "ActiveX" in the name. No, it's not the same thing as ActiveX controls.

FreeMan

13:43

OK. will deflate the two in the mental space.

this

Notch another one for Microsoft's legendary naming skillz.

FreeMan

lol...

2 mins ago, by this

#BlameMicrosoft

this

BTW.

I was refreshing my memory - the reason why Data Source didn't work is because it had the wrong value and you were using the Server keyword.

FreeMan

and you wonder why VBA code is full of Dim sMyStrng As Stringand Dim ilolcat2 as int

this

Data Source and Server are actually the same thing.

FreeMan

13:44

@this not shocking news...

ah.....

this

See, Microsoft made it easy for us peons by providing a bajillion synonyms that are acceptable

FreeMan

I saw that Server and Address were more-or-less synonyms and that Address (IIRC) overrides Server, but I don't recall seeing anything about Data Source === Server

this

here's an exhaustive listing of keywords ... note it lists for ODBC then OLEDB.

FreeMan

@this but with just enough subtle differences to totally shoot yer foot off

this

> Data Source DBPROP_INIT_DATASOURCE The name of an instance of SQL Server in the organization.

FreeMan

13:46

which includes Server which

> The Address keyword overrides the Server keyword.

(so my memory was correct! Yay me!!)

Yes, that's one of the pages I read.

this

so you have at least three ways to specify the server's name. :)

FreeMan

notes that Data Source doesn't exist in either the ODBC or OLE DB section

this

It does.

not in ODBC

but in OLEDB

FreeMan

shouldn't it completely ignore... what?

this

I quoted it from that page. Use ctrl + F

FreeMan

13:49

ahh...

yeah, further down - there are 2 sections of keywords for each ODBC and OLE DB. I didn't scroll far enough.

sigh...

this

so it's a buffet of synonyms to go with your alphabetical soup!

FreeMan

> When not specified, a connection is made to the default instance on the local computer.

For more information about valid address syntax, see the description of the Server ODBC keyword, later in this topic.

so, I specified it, much wrongly, and really confused it and myself, and should have just left it off completely

this

Hence the named pipe error.

just as a FYI - if you don't provide a URI, the default is to use named pipes, not TCP

FreeMan

synonyms, antonyms, homonyms, humahyms... it's a mess

this

but named pipes can only work in local network (or is it local machine? never could remember)

so that's why server=foo => named pipes but server=foo.com => TCP. You can force TCP with server=tcp:foo

FreeMan

13:52

once again, thank you for your help!

Ida kept banging my head on this for hours (it's only been about 2 days so far)...

this

that said, it's obviously not enough has been said about the connection string format and ODBC/OLEDB.

FreeMan

connectionstrings.com is really helpful IF you know what to do with the info...

this

^

FreeMan

knowledge without wisdom is like the Internet

this

wait, the Internet isn't just knowledge without wisdom?

Cyril

14:12

...in today's adventure, we have reiterated the reasons we hate SharePoint...

1) locks on documents that have been checked in
2) server too busy messages
3) cumbersome hierarchy (that's particular to how this was set up in 2008)
4) saving a file has to (in order) save version locally, upload a history, upload version, upload workflow... and you don't get error messages from the uploading tool if your workflow doesn't save, meaning you can't access the version that was uploaded
5) (company specific) only one person in the organization can adequately care for the system and he's a consultant who has a backlog for 8 months

this

SharePoint is the place where dreams & hopes go to die.

how many lists / libraries do you have, approximately?

BigBen

^ this ^

Cyril

our subsite is ~465 GB with around 50k libraries, i think

this

do you know how many SQL tables there are to hold all that?

jclasley

Is there a way to set an '@ExcelHotkey for a key that is not alphabetical? i.e. space

Cyril

14:19

created in 2008 or 2006, migrated in 2010 USING THE SAME SETTINGS, migrated again in 2015 USING THE SAME SETTINGS, and cannot be restored or rebuilt... according to microsoft, because people kept migrating, our data is F'd

@this i think 1 for our subsite

this

even if you did migrated/rebuild, the answer would still be the same. AFAIK, the database structure hasn't changed.

2 tables, actually.

Cyril

might be 2... one table for templates and the other for actually storing

this

one table to define the lists, other to hold the list items.

LET'S DUMP OUR CRAP IN ONE GIANT BUCKET!!!!

It get even more fun - if the list is wide enough, that one "row" on the list becomes 2 or 3 rows in SQL.

Cyril

i'll see if i can find the email; microsoft stated that the older version of SharePoint this was originally built with did not contain the current metadata capabilities and they do not have a system to move from that older system to the enwest system

fixed 9 "columns" of metadata... cannot add another

this

ah, i see. But even with new metadata, it'd still be the same case; 2 crapatastic generic tables.

you just get a bit more metadata which really just adds to the problem.

Cyril

14:23

i was under the impression that, if you could have more metadata, you could create views off of that table, allowing faster searching/loading of data with the better indexing

this

in theory

Cyril

as in the current metadata does not allow for splitting to allow quicker indexing

this

it's still the 2 gigantic theory with a pseudo index.

that is, when you create a sharepoint index, your SQL basically becomes:

SELECT ... FROM theGiantCrapBucket AS d INNER JOIN theGiantIndexCrapBucket AS i ON d.GUID = i.GUID WHERE i.IndexGUID = <the index we want to use>;

Cyril

btw, i'm making a legal sized print out of your quote... "SharePoint is the place where dreams & hopes go to die." - B.C.
will display it prominently in my cube

@this yeha, that doesn't seem to help much lol

this

oh, btw, if you add a criteria, you're now applying it to the theGiantCrapBucket, so now you have a join & criteria on 2 large crap buckets.

Cyril

14:26

nice

this

So that's why SharePoint index is of.... limited use.

Cyril

i hear you

jclasley

Hard-hitting question for y'all: who is part of the reversed-spacebar gang?

Cyril

i feel like the best feature it has is the asset manager... the file management, not so much

this

@jclasley Poles?

On the account of them inventing the reverse polish notation.

jclasley

14:29

@this I don't understand your question hahaha

this

(as in, I have no clue)

FreezePhoenix

Hello!

jclasley

On mechanical keyboards you can flip your spacebar around so that insstead of sloping forward into the keyboard like all the the other keys (meaning your thumb rests on the edge) it slopes toward your hands, so your thumb rests on a nice gentle slope

Cyril

@this classic RP... "it will be easier" saves 1 keystroke 60% of the time

this

@jclasley sounds like something Poles would make. :-P

Seriously, #TIL

jclasley

14:36

95% of the time I have mine reversed, but every now and then I swap back, only to remember how much better the reversed orientation is

Cyril

back to sharepoint, those ~50k libraries... our "new" library template makes it better, utilizing subfolders rather than new libraries for EVERY document. i asked if they could transition to a new sharepoint, moving the individual library files/folders into subfolders of actual libraries. Because A) that metadata/Microsoft problem earlier, they can't do it... would have to be, primarily, manual effort.

Duga

[rubberduck-vba/Rubberduck] jonathan-rizk synchronized pull request #5367: ProcedureNotUsedInspection ignores declarations that have ITestAnnotations

[rubberduck-vba/Rubberduck] codecov[bot\] edited comment on pull request #5367: ProcedureNotUsedInspection ignores declarations that have ITestAnnotations

> # [Codecov](https://codecov.io/gh/rubberduck-vba/Rubberduck/pull/5367?src=pr&el=h1) Report
> Merging [#5367](https://codecov.io/gh/rubberduck-vba/Rubberduck/pull/5367?src=pr&el=desc) into [next](https://codecov.io/gh/rubberduck-vba/Rubberduck/commit/0c4bb18c0fbb147f0bafe3933dc70a557eb72777?src=pr&el=desc) will **increase** coverage by `<.01%`.
> The diff coverage is `100%`.

```diff
@@ Coverage Diff @@
## next #5367 +/- ##
=========================

Cyril

Our sharepoint is set up with an A-Z list of folders on the main subsite, then subfolders for clients with links to libraries in the subfolders (different entities)

Duga

[rubberduck-vba/Rubberduck] jonathan-rizk commented on Rubberduck.Parsing/Annotations/ITestAnnotation.cs of pull request #5367: ProcedureNotUsedInspection ignores declarations that have ITestAnnotations

FreeMan

I don't think my space bar would fit backwards. Then again, it's sloped nicely for my thumb to rest on anyway...

Cyril

14:39

those libraries then have links to other libraries (the quotations)

FreeMan

Cyril

in some cases, the quotation level library is removed because of the newer library template to keep everything at entity level

i believe mine is naturally sloped, so non-issue?

jclasley

Cyril

i don't use the straight rainbow color on it, though... i use the one that loops through the rainbow

jclasley

Here's the reversed spacebar. Your thumb rests sooo easily

this

14:44

This is my keyboard:

jclasley

I can't find a single image that accurately shows it haha but a google search will work for you

Cyril

@this is being a valet good money these days?

this

:D

jcrizk

@this i didn't know that shutterstock sold keyboards

this

You'd be amazed at what they sell. I hear they even sell human models!!!

Cyril

14:51

Harold.

FreeMan

@this I am so happy I'd already finished my coffee...

this

@Cyril #REF!

Vogel612

@this I like that this has become something of a meme in here

Cyril

@this google.com/…

"harold" is a model for shutterstock; that's not his real name, but is what the internet has decided to call him

they have "loaned" his likeness, aka shutterstock gets money when he does modeling because he got famous under them

this

ahh

Cyril

15:03

"Hide-the-pain-Harold" rough name lol

Duga

[rubberduck-vba/Rubberduck] build for commit 91218d05 on unknown branch: AppVeyor build succeeded

[rubberduck-vba/Rubberduck] codecov[bot\] edited comment on pull request #5367: ProcedureNotUsedInspection ignores declarations that have ITestAnnotations

FreeMan

@Cyril I've never seen that one before. #HappilySheltered

this

@Cyril now that I know, that makes my comment about them selling human models funnier.

FreeMan

#TIL I can't parameterize SELECT top ? * FROM...

Duga

> # [Codecov](https://codecov.io/gh/rubberduck-vba/Rubberduck/pull/5367?src=pr&el=h1) Report
> Merging [#5367](https://codecov.io/gh/rubberduck-vba/Rubberduck/pull/5367?src=pr&el=desc) into [next](https://codecov.io/gh/rubberduck-vba/Rubberduck/commit/0c4bb18c0fbb147f0bafe3933dc70a557eb72777?src=pr&el=desc) will **increase** coverage by `0.01%`.
> The diff coverage is `100%`.

```diff
@@ Coverage Diff @@
## next #5367 +/- ##
=========================

[rubberduck-vba/Rubberduck] build for commit 91218d05 on unknown branch: 61.67% (target 0%)

[rubberduck-vba/Rubberduck] build for commit 91218d05 on unknown branch: 100% of diff hit (target 60%)

[rubberduck-vba/Rubberduck] Vogel612 closed issue #5281: Code Inspection Error: Test methods give the Procedure Not Used inspection

[rubberduck-vba/Rubberduck] jonathan-rizk pushed commit 8781f560 to next: ProcedureNotUsedInspection ignores declarations that have ITestAnnotation annotations.

[rubberduck-vba/Rubberduck] jonathan-rizk pushed commit a9cdee7d to next: declarations of ProcedureNotUsedInspection ignore ITestAnnotations

[rubberduck-vba/Rubberduck] jonathan-rizk pushed commit 29ce25a7 to next: Merge branch 'InspectionsIgnoreTestAnnotations' of github.com/jonathan-rizk/Rubberduck into InspectionsIgnoreTestAnnotations

[rubberduck-vba/Rubberduck] jonathan-rizk pushed commit 57521e50 to next: removed unnecessary namespaces

[rubberduck-vba/Rubberduck] jonathan-rizk pushed commit 91218d05 to next: ITestAnnotation inherits IAnnotation

[rubberduck-vba/Rubberduck] web-flow pushed commit 7fbdab48 to next

this

15:07

@FreeMan you can parameterize the FETCH & OFFSET.

Cyril

@this quite

Duga

ProcedureNotUsedInspection ignores declarations that have ITest… (#5367)

ProcedureNotUsedInspection ignores declarations that have ITestAnnotations

FreeMan

@this I was just testing out my new SQL access code (i.e. stuff I "borrowed" from Mug) and wanted to shorten up what I knew would be a long query. I hard coded for testing purposes

#DumbQuestion: Why is it that sometimes I can make code changes in a module in the VBIDE, hit ctrl-S and watch the cursor spin (indicating some sort of activity), then go to the main Access window, hit ctrl-s and see no indication of any save activity (to be expected), the "disk save" icon is dimmed (to be expected), then close Access and it prompts me to save?

#DumbAnswer: #BecauseMicrosoft

But is there a better answer?

this

for the same object?

FreeMan

yes

this

15:18

hmm can't say that happened to me.

FreeMan

constantly

not consistently, though

at least several times a day

Also noticing that OASIS doesn't always notice when a file has changed.

these are set

this

I can't reproduce the dupe-save thing.

and did you see the dialog pop?

FreeMan

and I noticed a "task completed" dialogue after a ctrl-s in the ide

guess that would be it- it's automatically exporting when I save.

which is good

this

therefore the text file would have changed.

FreeMan

time stamp of file in win explorer is close enough...

@this I can't do it on command, but it happens regularly enough to be annoying.

this

15:23

wondering if it's due to the export

try and do it without the keyboard.

Cyril

@FreeMan I have experienced that before in Excel.

this

IOW, VBIDE is a bug

FreeMan

for example, I just did ctrl-s in the VBIDE, saw the popup from OASIS, and now the "save" icon is enabled in Access and in the Access menu

@this yeah

@this but... but.. I thought RD was fixing all of those.... #Whinging

hah! I clicked File | Save in Access (not the IDE) and it continued to be enabled!

Cyril

oftentimes the save from the IDE doesn't save at all, i can only do it from the main excel window.
my guess would be either A) Microsoft, or B) something within your module is volatile and the main window has "calculated" which prompts the Save dialogue because *something* happened

FreeMan

but, it didn't prompt to save when I did a C&R

@Cyril Yup - I gets that too.

Cyril

15:25

can only assume that volatile aspect applies to Access, as i dont have access

FreeMan

both Access & Excel. I'm whinging about Access 'cause that's what I'm working in today.

this

there are also metadata that might not be a part of the code module per se

after all, the VBA project is a one giant binary blob in the bowel of the document file.

FreeMan

"bowels" seems so very appropriate

this

VBIDE says "Ok! your code module's saved!"

Host says "Uh oh, I saved the changed but then I changed some hidden metadata, so I'm gonna to have to ask you to ~~come in Saturday~~ save again"

FreeMan

i.e. "I've written it to the document module somewhere", not "I've written the whole kit-n-kaboodle to disk"

this

15:28

yeah, pretty much.

and I'll forward you the memo on the TPC cover sheet again. You should keep up on the memos.

FreeMan

at least it prompts to save before exiting when it thinks it needs to. I'd rather have an extra "yes, please save my last 2 hours of work" than "oops, I forgot to save that for you"

this

^

FreeMan

you should keep up, they're TPS cover sheets now, not TPC cover sheets!

:)

Cyril

until you realize it's an old xls file and... well, no file recovery available

.ads works for Word, but i haven't found what works for Excel

this

Blargh. TPC feels right. IDK.

FreeMan

15:29

lol;

; added for the c# fans in the crowd

ok, gotta go design a dialogue box to have the user enter his/her network pwd so I can use it to connect to the Azure server so I can query this new DB.

then I should probably start parameterizing my queries.

99% of the stuff comes from inside the DB, some from choices entered in forms, none from free-form user entered data, so no sql injection possibilities, but still.

plus, there's only 2 of us using the DB, and if either goes Bobby Tables, we're both on the hook for fixing it up...

Duga

[rubberduck-vba/Rubberduck] rubberduck-vba-releasebot prereleased draft prerelease Prerelease-v2.5.0.5320

[rubberduck-vba/Rubberduck] rubberduck-vba-releasebot created draft prerelease Prerelease-v2.5.0.5320

[rubberduck-vba/Rubberduck] rubberduck-vba-releasebot published prerelease Prerelease-v2.5.0.5320

[rubberduck-vba/Rubberduck] rubberduck-vba-releasebot created tag Prerelease-v2.5.0.5320

[rubberduck-vba/Rubberduck] build for commit 7fbdab48 on next: 61.68% (target 0%)

[rubberduck-vba/Rubberduck] build for commit 7fbdab48 on next: 100% of diff hit (target 60%)

[rubberduck-vba/Rubberduck] build for commit 7fbdab48 on next: AppVeyor build succeeded

Cyril

specific to handling passwords, i've only tried once and I didn't hash the password in the dialogue box (let's you see all of what you typed), but i did jumble it with some asc() chr() before de-jumbling it in reverse (pretty much i took the unsecure version, secured it, then passed the secured version which was unsecured at the end location). is that appropriate?

FreeMan

ugh... and the other guy just had to call for hospice care for his wife. They're a young couple with a 9-y-o son. Cervical cancer (just like all the rest) really sucks...

Cyril

='/

FreeMan

makes all the rest of this stuff feel just as superficial as it really is.

Cyril

15:40

i'll rehash a quote from a dementia patient... i like the superfluous; the real things i can't remember well, and i'm afraid that what i think i remember is riddled with cancer. Superficial keeps me going.

with that said, all the best to them... very rough spot, particularly as it's hospice care ='/ only ~1/30 end up leaving hospice without dying

this

@Cyril why invent your own?

Just use a cryptographic hash function, done.

BigBen

^ completely agree.

Cyril

@this because i didn't know any better

this

There's plenty of VBA code out there to implement a cryptographic hash function.

so you can copy'n'paste your way around.

(TBH, I'd have zero idea of how to write one myself for that matter)

Cyril

"only tried once" was a big part of it. i ended up killing that project because it required a connector for SalesForce and I wasn't going to maintain my departments computers when IT refused to support "custom software" (their words) for what was expected to by used by our administrator and SalesForce itself

BigBen

15:44

There's plenty of insecure VBA code out there to implement... make sure it's a strong cipher, i.e. not RC4.

Cyril

when i was reading about it, i wasn't sure what type of decrypting happened at the SalesForce login... so i made one up that worked for the tests, prior to cancling/killing the project

this

@BigBen I hear ROT13 is great, though.

Cyril

guess i'll be looking into cryptographic has functions later this week

this

To clarify - if you're using a connector, a provider, a driver, whatever the password management is their responsibility.

Meaning, you pass it plaintext

Ideally, those should encrypt and protect the sensitive data.

You would need the cryptographic hash function if you are in fact implementing your password system because it doesn't exist or something.

Cyril

copy

i was encrypting it from dialogue box to connector... guess that was a bit ridiculous/cumbersome

Vogel612

15:54

@this you basically look up the paper or the RFC and implement along

this

@Cyril not necessarily. I normally do implement my login dialog because their are fugly and confusing but it's really just a nice-looking veneer on the top.

@Vogel612 requires brain cells. :-D

Vogel612

pft. who needs those in the first place :D

FreeMan

@Cyril yeah, not sure why you did all that. I'll just build an Access form with a text box, set it to a Password field so the characters are hidden, then directly pass the plain text into the connection string. #Done

this

more importantly, discard that password after the connection string's made.

FreeMan

yeah

this

16:00

can't have people running around amok with plaintext passwords in their hands

FreeMan

holy carp... Password is hidden under Input Mask who'd a thunk that??

this

Microsoft?

FreeMan

when all else fails...

2 hours ago, by FreeMan

2 mins ago, by this

#BlameMicrosoft

I guess it makes sense, but it was the last place I looked. (and not because I found it there.)

Hosch250

16:17

@FreeMan "some from choices entered in forms" An attacker could probably inject garbage there. Harder for desktop apps, I assume, but trivial for HTML.

But if someone had deep knowledge of WPF or WinForms, for example, they could probably hijack something and inject bad data that would go in when you hit Submit.

this

but if the desktop's compromised, they can do much more than just putting in garbage in a password dialog

so they wouldn't really have to have a deep knowledge of WPF/WinForm; just start screwing around whatever they want to.

Hosch250

@this True.

Just saying that "some choices entered in forms" is NOT safe from a SQL Injection.

this

Yep

however, connection string isn't technically a SQL injection attack

Hosch250

@FreeMan So?

That's how password inputs always work. You need the plain text up to the point you hash it.

this

(it has the same problem, however. On web app, I'd hope you'd never be presented with a dialog to modify or set connection string)

Hosch250

16:24

^

I've seen 2 methods of getting the connection string on web apps.

this

@Hosch250 I think he meant that to make the textbox use password masking, you set the input mask property, not format property.

Hosch250

#1 is hard-code it.

@this Oh.

this

Arguably not the most intuitive place to set it

Hosch250

#2 is pull it from another DB who's connection string is hardcoded based on the URL the visitor comes from.

this

However, that's done, you best not expose that on the web app's layer.

Hosch250

16:25

So if you have a multi-tenant app, you check the URL and pull the connection string for that app from the master DB.

Nope. It's purely internal, hidden behind a firewall that blocks all external traffic.

And all internal traffic except specific ports.

this

and in the #2 scenario, one should be careful to not allow the URL to be injected

Hosch250

Yeah, you have to have CORS blocked.

The URL came from the HTTP request base URL (this was through ASP.NET).

So, it wasn't coming from some user-set value.

this

but could I spoof it, no?

Hosch250

Wouldn't CORS prevent that?

And either way, if you weren't coming into an existing site, it simply wouldn't let you in.

So if you tried to do not-a-site.coresite.com, you'd get a stock 404 page.

And if you did not-my-site.coresite.come, you'd just get prompted to sign in on that site's custom signin page.

this

I see. I am not 100% familiar with CORS (have only small exposure in javascript context), but I was thinking that if I logged in via my-site.coresite.com, then manipulated the HTTP at the low level so that my cookie & header or whatever would then belong to not-my-site.coresite.com

As such wouldn't be a request from iframe or AJAX for which I thought CORS help prevents.

Hosch250

16:37

Oh, the cookie/header just wouldn't be sent then.

this

but I can set it myself by copying the values, no?

Hosch250

How do you mean? It would just be an "invalid" value then?

That would be like trying to use my MS auth token on a G site?

this

I guess the key is that the authorization token has to be tied to the URL it originated and verified at the server

So that even if I tampered with the HTTP request, my authorization from my-site.coresite.com would not work on the not-my-site.coresite.com

Hosch250

Yes. So even two people with the same usernames and salted password hashes can't cheat.

IvenBach

3 rows of ducks now. Pond's getting popular.

Vogel612

16:53

@IvenBach it's just your screen being small :)

Hosch250

I don't even have 2 full rows on a 13" screen.

IvenBach

@Vogel612 :derp: Yes. Barely onto second row on a landscape monitor.

Transcript for