Computer
SpaceX Starship Hits Key Milestones Before Stunning Splashdown
Read more of this story at Slashdot.
Major US Online Retailers Remove Listings For Millions of Prohibited Chinese Electronics
Read more of this story at Slashdot.
Palmer Luckey's Anduril Launches EagleEye Military Helmet
Read more of this story at Slashdot.
Britain Issues First Online Safety Fine To US Website 4chan
Read more of this story at Slashdot.
Google's Nano Banana AI-Image Editing Is Coming to Search, NotebookLM and Photos
Read more of this story at Slashdot.
Dutch Government Takes Control of China-Owned Chipmaker Nexperia
Read more of this story at Slashdot.
Software Update Bricks Some Jeep 4xe Hybrids Over the Weekend
Read more of this story at Slashdot.
Carmakers Chose To Cheat To Sell Cars Rather Than Comply With Emissions Law, 'Dieselgate' Trial Told
Read more of this story at Slashdot.
TP-Link Makes History With First Successful Wi-Fi 8 Connection
Read more of this story at Slashdot.
China Is Shipping More Open AI Models Than US Rivals as Tech Competition Shifts
Read more of this story at Slashdot.
Three New California Laws Target Tech Companies' Interactions with Children
Read more of this story at Slashdot.
Does the Internet Have a Philly Accent? Why Too Much Time Online Can Make You 'Culturally Philadelphian.'
Read more of this story at Slashdot.
Earth's Climate Has Passed Its First Irreversible Tipping Point and Entered a 'New Reality'
Read more of this story at Slashdot.
The Pope Urges Vigilance About Who Controls AI
Read more of this story at Slashdot.
OpenAI, Broadcom Forge Multibillion-Dollar Chip-Development Deal
Read more of this story at Slashdot.
Hollywood Demands Copyright Guardrails from Sora 2 - While Users Complain That's Less Fun
Read more of this story at Slashdot.
Flatpak Doesn't Work in Ubuntu 25.10, But a Fix is Coming
Read more of this story at Slashdot.
CodeSOD: The File Transfer
SQL Server Information Services is Microsoft's ETL tool. It provides a drag-and-drop interface for describing data flows from sources to sinks, complete with transformations and all sorts of other operations, and is useful for migrating data between databases, linking legacy mainframes into modern databases, or doing what most people seem to need: migrating data into Excel spreadsheets.
It's essentially a full-fledged scripting environment, with a focus on data-oriented operations. The various nodes you can drag-and-drop in are database connections, queries, transformations, file system operations, calls to stored procedures, and so on. It even lets you run .NET code inside of SSIS.
Which is why Lisa was so surprised that her predecessor had a "call stored procedure" node called "move file". And more than that, she was surprised that the stored procedure looked like this:
if (@doDelete = 1) begin set @cmdText = 'mv -f ' + @pathName + @FileName + @FileExt + ' ' + @pathName + 'archive\' + @FileName + @FileExt + '.archive' end else begin set @cmdText = 'cp -f ' + @pathName + @FileName + @FileExt + ' ' + @pathName + 'archive\' + @FileName + @FileExt + '.archive' end insert into #cmdOutput exec @cmdResult = master.dbo.xp_cmdshell @cmdTextThis stored procedure was called from SSIS, which again, I want to stress, has the functionality to do this without calling a stored procedure. But this approach offers us a few unique "advantages".
First, it requires xp_cmdshell be enabled. This particular stored procedure is disabled by default, since it allows a user inside of SQL Server to invoke shell commands. Microsoft disables this by default, because it's a gaping security hole. Any security scanning tool you may run against your server will call it out as a big red flag. You're one SQL Injection attack away from an old rm -rf /.
Which, speaking of rm, you'll note the command strings they build to execute. mv and cp. Now, SQL Server can run on Linux, but this instance wasn't. No, the person responsible for this stored procedure also installed GNU Core Utils on Windows, just so they could have mv and cp to invoke from this stored procedure. Even better, they didn't document this dependency, so the first time someone tried to migrate the database to new hardware, this functionality broke and no one knew why.
At least the migration gave them a chance to update their SSIS packages to use the "File Transfer Task" instead of this stored procedure. But don't worry, there were plenty of other stored procedures using xp_cmdshell.
[Advertisement] Keep all your packages and Docker containers in one place, scan for vulnerabilities, and control who can access different feeds. ProGet installs in minutes and has a powerful free version with a lot of great features that you can upgrade when ready.Learn more.California Will Stop Using Coal as a Power Source Next Month
Read more of this story at Slashdot.
Why GPS Fails In Cities. And What Researchers Think Could Fix It
Read more of this story at Slashdot.