On Fri, Dec 21, 2012 at 10:20 AM, Ron Michael Zettlemoyer
<
ron.zet...@fynydd.com> wrote:
> So are SPARQL 1.1 updates actually in Stardog now, just disabled? Couldn't
> you allow an admin to enable it if they choose? :)
In a branch, but not in the released product.
> I was curious about that when you first mentioned it... Maybe I'm just not
> thinking of this the right way, but shouldn't preventing injection be a
> problem for the calling application to worry about?
Yes and no. It should be possible for the calling application to
prevent injection attacks in some way, ideally in a way based on
Stardog, so that we know it's done properly.
> Like if the account I
> connect to Stardog with has write permissions, I should be able to do
> whatever I want, and if my code is stupid enough to allow an injection
> attack from my users than that's my fault.
This is a reasonable position; it's not the one we've taken to date.
> What if your secure
> implementation considers something as an injection attack but it's something
> I am doing intentionally?
It will be disable-able in that case. Which, yes, is exactly like the
case now, but in re: security, we wanted to be very conservative and
very careful.
> I know that you've though all this through, I am just curious about it.
We don't have a release in mind yet but full Update support will be
available sooner than later.
Cheers,
Kendall