Re: Obfuscated stored procedures (was Re: Oracle and Postgresql)

On Sep 15, 2008, at 7:19 PM, Tom Lane wrote:
> The problem is that the people who ask for this type of feature are
> usually
> imagining that they can put their code on customer-controlled machines
> and it will be safe from the customer's eyes.

That's a broken expectation. All that can realistically be expected
is database/catalog-level constraints.

> Well, it isn't, and I don't think Postgres should encourage them to
> think it is.

Adding such a feature would NOT be encouraging them to think this -
the documentation could be very explicit about this fact. Maybe
that's what Oracle is selling, and that's crappy of them, but that
doesn't mean we should use that as justification to not add a more
appropriate implementation.

As for the expectation above - could pl/pgsql be made compilable? It
would seem easy to translate pl/pgsql code into C and compile a C
function. That *could* go onto customer-controlled machines and be
safe from the customer's eyes.

FWIW, I think most people who want to hide code aren't concerned about
IP, they're concerned about clients seeing embarrassingly bad/sloppy
code. But there *are* some very real and legitimate needs for this,
though it's a small minority of those who think they do.

Cheers,
--
Casey Allen Shobe
Database Architect, The Berkeley Electronic Press