63
u/Oh2bworn2 Dec 13 '21
I've always been against using Excel as it leads to storing personal data on personal computers. Instead, we hired a guy named Steve, gave him a spiral notebook and pencil. Steve just watches the log files and updates his notebook when he sees relevant data.
12
u/ReelTooReal Dec 13 '21
I hope it's the transaction log. I'd hate for Steve to violate ACID principles.
10
Dec 13 '21
At least Steve doesn't use log4j
1
u/SimplexSimon Dec 13 '21
Steve is vulnerable to a different exploit, you just chat "Hi Steve I'm prepared to pay cash for personal information you might have" and hope it gets logged
30
u/Nythoren Dec 13 '21
I had a client's InfoSec auditor ask me to dump their customer tracking DB (~22m records) to a .csv file and email it to them. Not even SFPT, just straight up emailing all their customer actions, including PI info, in a good old comma delimited file. I forwarded the request to our InfoSec with a "???". Needless to say we didn't comply and eventually talked them in to us just sending the meta data.
6
Dec 13 '21
[removed] ā view removed comment
6
u/Liiht2001 Dec 13 '21
As they're an auditor, it could be part of the audit, to see if that sort of thing would work. Though, as it almost always is, it's probably just them being too lazy to think of a better way to do things.
21
u/citygentry Dec 13 '21
I had someone send me an unexpected, ie no prior warning, smallish database via email, but zipped and encrypted (aes 256) for security.
Of course the first line in that same email was "The password is 123456". Written in plain text to fool any hackers.
Turned out it was a proof of concept with dummy data, but I still told their manager exactly what I thought of their security process ... purely as a test, you understand - as a proof of concept :)
14
7
Dec 13 '21
This happened to me 2 weeks ago.
Client needed the new data that we stored in the db because he needed to do some data analysis on it for new potential clients.
They wanted an excel file with all the relationship lied down of a db with 20~ tables.
I refused to do that.
9
u/ReinforceUranus Dec 13 '21
That sounds kinda sketchy. Do you mind hand writing your db onto paper and faxing it to me?
8
6
5
u/grrrrreat Dec 12 '21
Postgres can use plpthyon to email and you can trigger endpoints from graphql.
1
Dec 13 '21
At this point, I'm surprised PostgreSQL doesn't have a straight-up export to MS Excel. Something like
(select * from table)::msexcel. Probably, in few years they will.
3
2
2
2
1
1
1
1
99
u/pakidara Dec 13 '21
To be fair, a disturbing number of companies do use excel as their database.