Hacker News Reader

anothercaton Inside PostHog: SSRF, ClickHouse SQL Escape and Default Postgres Creds to RCE

Ah of couse! I forgot about the cloud hosted option.

anothercaton Inside PostHog: SSRF, ClickHouse SQL Escape and Default Postgres Creds to RCE

Does this require authenticated access to the posthog api to kick off? In that case I feel clickhouse and posthog both have their share of the blame here.

anothercaton SQLite or PostgreSQL? It's Complicated

Is it really duck typed if no static type checking is performed on the SQL? Duck typing to me seems to imply checking quacks and waddles at "compile" time. I would think it's at most loosely typed and at worst dynamically typed.

EDIT: Without the new strict mode of course, where it is not duck typed but typed by name.

EDIT 2: Actually maybe duck typing is fine to use for dynamic languages too. The affinity of INT keys and stuff is sort of duck typing I guess.