Re: @(#) Mordred Labs advisory 0x0001: Buffer overflow in

On Tue, 2002-08-20 at 19:59, ngpg(at)grymmjack(dot)com wrote:
> greg(at)CopelandConsulting(dot)Net (Greg Copeland) wrote
> > At some point in time, you have to stand and say, "the buck stops here."
> >
>
> I agree here, but at the same time you cannot put 100% of the
> responsibility on the developers. If you are the dba/sysadmin/whatever/etc
> then it is your responsibility. It is up to you to know about potential
> problems and have workarounds or whatever it is you need to do. I think
> that is one of the things that seperates a "good" admin from a "not-so-
> good" one.

I absolutely agree. I was not trying to say that bugs don't happen and
that sometimes those bugs may cause crashes. What I was trying to say
is what amounts to, "dr, when I move my arm like this, it hurts", and
the response is, "don't do that." Humor aside, surely there has to be a
happy medium in between. Perhaps, with a skewing toward fixing rather
than prescribing. ;)

>
> Afterall, when your boss calls you into his office monday morning and asks
> for a really good explanation for why the db was cracked, I dont think he
> is going to accept the excuse "this guy, you dont know him but his name is

I understand and agree with ya.

>
> That being said, I do agree the developers should give things like this
> more priority. But, its open source... so you either live with it or
> write your own patch.
>

Well, the priority portion was what I was shooting for. Perhaps it came
off being over zealous. I'm not really sure. I re-read it and I didn't
think so. But, I'm not you and you're not me...so, it's hard to say how
exactly it was received.

As for the open source comment, that fine and all...but...there are
companies which are paying for postgres' development too. Some of the
developers are being paid to do this. The "write your own patch" has
much more meaning on simple projects. For a project as complex as
postgres, simply asking for a patch is almost meaningless. Along those
lines, I have been reading (code and the list) and learning for sometime
now, as time allows. One day, I will contribute significant patches.
However, until that day comes, I would hope that observational
commentary is simply not invalidated just because they're not one with
the code yet.

Regards,

Greg Copeland