Michael Mior

193 reputation

bio	website	michael.mior.ca
	location	Toronto, Canada
	age	26
visits	member for	8 months
	seen	Mar 31 at 5:51
stats	profile views	3

I received my Masters from the University of Toronto researching database scalability in the cloud.

I'm now working as a Web Developer at Bunch working on frontend HTML/CSS/JS, backend PHP/Python/MySQL, and our iPhone app.

	193 reputation	bio	website	michael.mior.ca	visits	member for	8 months
9 badges		location	Toronto, Canada		seen	Mar 31 at 5:51

summary answers questions tags badges favorites bounties reputation activity

28 Actions

suggestions reviews revisions comments badges posts accepts all

Apr 13	awarded	Popular Question
Dec 21	awarded	Editor
Dec 21	revised	How can I explain SQL injection without technical jargon? fixed name of exploit
Dec 21	comment	How can I explain SQL injection without technical jargon? I don't really see the connection here.
Dec 21	comment	How can I explain SQL injection without technical jargon? While I find this rather amusing and the principle is accurate. This falls short in the sense that the person who wrote the words for the cake had the authority to issue somewhat arbitrary commands if desired. This isn't the case with SQL injection.
Dec 21	suggested	suggested edit on How can I explain SQL injection without technical jargon?
Dec 21	awarded	Critic
Dec 21	comment	How can I explain SQL injection without technical jargon? A more accurate analogy would be if the your boss left the account number blank, because he trusted you to fill it in. And then you filled in the account number with additional instructions.
Sep 16	awarded	Commentator
Sep 16	comment	OAuth access token vs session key I'm not dealing with a browser-based client, so CSRF doesn't come into play. Seems like there's an equal vulnerability when it comes to session hijacking/OAuth token hijacking.
Sep 16	comment	Can't explain data from side channel attack attempt Thanks for pointing out the bug. I translated from another code based that used some boolean macros and obviously made a typo there. I agree with what you have in your last paragraph. I was just expecting the possibility of some difference due to the fact that the character comparisons are no longer performed after the length of the second string exceeds that of the first.
Sep 15	asked	OAuth access token vs session key
Sep 14	awarded	Scholar
Sep 14	comment	Can't explain data from side channel attack attempt Thanks for your point about array access times. I'm not sure what you mean when you say it's not "linear." That seems to imply that array access is O(n), which of course isn't the case. Anyway, accepting this answer because it explains a lot :)
Sep 14	accepted	Can't explain data from side channel attack attempt
Sep 14	comment	Can't explain data from side channel attack attempt That was my assumption, which was why I tried this exercise. I'm not sure what you mean about `strlen` being a black box. The implementation is easily looked up. But I agree it's much easier to reason using the simple loop in your answer. As for the loop overhead, since it's constant, I assume it doesn't really matter. Removing it would certainly make the measurements more accurate, but I don't think it's necessary for correctness.
Sep 13	comment	Where to put private files on a shared web server Ah, I see what you mean. If you have some way of reading this file from your code, that's quite possibly safer. Although you presumably have no knowledge of where this file is stored, so who knows?
Sep 13	comment	Where to put private files on a shared web server @nodirtyrockstar Given that the info you're protecting isn't too sensitive, you're probably safe. Of course you should still make configure the server not to serve that file.
Sep 13	awarded	Teacher
Sep 13	comment	Where to put private files on a shared web server @nodirtyrockstar Then you're probably safe since the info you're protecting is public anyway (with the exception of password hashes). You may be able to ask your host to set the file permissions so the Web server can't read the file. Your biggest risk is probably not data theft, but someone messing with the DB. So just make sure you have regular backups.