From: Bruce Momjian <bruce@momjian.us>
To: Rui DeSousa <rui@crazybean.net>
Cc: Benedict Holland <benedict.m.holland@gmail.com>
Cc: Bear Giles <bgiles@coyotesong.com>
Cc: Evan Bauer <evanbauer@mac.com>
Cc: bejita0409@yahoo.co.jp, "pgsql-admin@lists.postgresql.org" <pgsql-admin@lists.postgresql.org>
Cc: pgsql-general@lists.postgresql.org <pgsql-general@lists.postgresql.org>
Subject: Re: How to revoke privileged from PostgreSQL's superuser
Date: Tue, 14 Aug 2018 15:51:09 -0400
Message-ID: <20180814195109.GA23497@momjian.us> (raw)
In-Reply-To: <A1A739E5-2ED5-4A85-A5B5-5699DB4F3C32@crazybean.net>
References: <913907.28546.qm@web103014.mail.kks.yahoo.co.jp>
<CALBNtw4NEWUvkPsUCDmOtpt391V_X+DpRGoTf76KMG16EkAPKQ@mail.gmail.com>
<26930.1533562986@sss.pgh.pa.us>
<ED9ED9F8-42CA-433E-8674-E4B5C72ED0EF@mac.com>
<CALBNtw4vUZWK6Fbi5sMrD5UCiDnS_-VFVT1JMWAcSrP8kLfxcA@mail.gmail.com>
<E41CE9B2-DAD7-4AF6-B5DB-E85737C4DA68@crazybean.net>
<CAD+mzow+g2MznJMjkGyWp_Lx7593m_poCkt=UmfOUg9vOqrbJw@mail.gmail.com>
<A1A739E5-2ED5-4A85-A5B5-5699DB4F3C32@crazybean.net>
On Fri, Aug 10, 2018 at 10:34:26PM -0400, Rui DeSousa wrote:
> With that logic then you should use flat files for encrypted data and
> unencrypted data. It’s what was done many moons ago; and its unstructured
> haphazard approach gave rise to RDBMS systems.
>
> You cannot say that encrypted data does not belong in a RDBMS system… that is
> just false. Hell, I’ve stored blobs in a RDMBS system which could have easily
> been stored in a different system if need be. It’s a design choice and what
> fits the application and budget needs.
>
> Encrypting sensitive information and storing in the database is a valid use
> case. It may be only a few columns that are encrypted or a complete document
> (blob); there is no need to increase complexity just to move those columns out
> of the database.
I think the point is that it makes sense to store data encrypted in a
database only if it is a payload on another piece of non-encrypted data.
You can't easily index, restrict, or join encrypted data, so it doesn't
have a huge value alone in a database.
--
Bruce Momjian <bruce@momjian.us> http://momjian.us
EnterpriseDB http://enterprisedb.com
+ As you are, so once was I. As I am, so you will be. +
+ Ancient Roman grave inscription +
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Reply to all the recipients using the --to and --cc options:
reply via email
To: pgsql-admin@postgresql.org
Cc: bruce@momjian.us, rui@crazybean.net, benedict.m.holland@gmail.com, bgiles@coyotesong.com, evanbauer@mac.com, pgsql-admin@lists.postgresql.org, pgsql-general@lists.postgresql.org
Subject: Re: How to revoke privileged from PostgreSQL's superuser
In-Reply-To: <20180814195109.GA23497@momjian.us>
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
This inbox is served by DDX for PostgreSQL; see mirroring instructions
for how to clone and mirror all data and code used for this inbox