On: Rookie coding mistake prior to Gab hack came from site’s CTO

[oji0hub]

Who knows what was going on. In an ideal world we have the time needed to do things well. In reality, you've got twenty developers asking for something, users requesting features, various government agencies asking for documents, the lawyers inform you about some case and... oh your wife is calling on the other line because... etc etc etc.

[jdxcode → oji0hub]

I get so busy I rip out query builders to SQL concat strings all the time. /s

That’s like going 120mph and telling the cop you were just “distracted”.

You’re correct that we often make mistakes when we’re busy, but this isn’t that. This is OWASP #1 and the most plain example of it.

This is not a “mistake” that engineers make, this is unethical to allow this to go into production. He even has a stackoverflow answer where he explains this exact problem: https://stackoverflow.com/questions/11554015/syntax-sql-wher...

If you think I’m wrong, then what could an engineer be responsible for? Literally nothing ever?