Re: pl/pgsql enabled by default

From: Mike Mascari <mascarm(at)mascari(dot)com>
To: Neil Conway <neilc(at)samurai(dot)com>
Cc: Andrew Sullivan <ajs(at)crankycanuck(dot)ca>, pgsql-hackers(at)postgresql(dot)org
Subject: Re: pl/pgsql enabled by default
Date: 2005-05-08 01:59:39
Message-ID: 427D728B.8020105@mascari.com
Views: Raw Message | Whole Thread | Download mbox | Resend email
Thread:
Lists: pgsql-hackers

Neil Conway wrote:
> Andrew Sullivan wrote:
>> This is not really analogous, because those are already on
> Security (in the limited sense of "disabling features by default") is
> not free; there is a tradeoff between security and convenience, security
> and administrative simplicity, and so on. Given that I have yet to see a
> single substantive argument for pl/pgsql being a security risk that has
> withstood any scrutiny, I don't see that the "security" side of the
> tradeoff has a lot of merit.

People who use views to achieve row security, which is a rather common
paradigm, cannot allow users to create functions with side effects.

Mike Mascari

In response to

Responses

Browse pgsql-hackers by date

  From Date Subject
Next Message Tatsuo Ishii 2005-05-08 02:01:10 Re: Invalid unicode in COPY problem
Previous Message Madison Kelly 2005-05-08 00:22:53 Invalid unicode in COPY problem