Date: Wed, 23 Dec 2020 19:49:22 -0500
From: Bruce Momjian <bruce@momjian.us>
To: Tom Lane <tgl@sss.pgh.pa.us>
Cc: Steven Pousty <steve.pousty@gmail.com>, pgsql-docs@lists.postgresql.org
Subject: Re: Trusted versus untrusted Pl language
Message-ID: <20201224004922.GB13055@momjian.us>
References: <160875505390.674.9084620641912624635@wrigleys.postgresql.org>
 <20201223224140.GA13055@momjian.us>
 <CAKmB1PFuxkvA5-wD7KkW0yLp_4-+ieeVz7a2C5udg+GQVy9mgA@mail.gmail.com>
 <748034.1608770296@sss.pgh.pa.us>
MIME-Version: 1.0
Content-Type: text/plain; charset=us-ascii
Content-Disposition: inline
In-Reply-To: <748034.1608770296@sss.pgh.pa.us>
User-Agent: Mutt/1.10.1 (2018-07-13)
Precedence: bulk

On Wed, Dec 23, 2020 at 07:38:16PM -0500, Tom Lane wrote:
> Steven Pousty <steve.pousty@gmail.com> writes:
> > 3. An example of how to make a pre-installed untrusted langue into a
> > trusted language
> 
> Under what circumstances would that be a good idea?
> 
> I can't imagine that we'd really want to recommend end users doing
> that, but an example would surely be taken as a recommendation
> that it's okay to do it.

Right. The language has to provide some sandbox environment for us to
consider it safe, e.g. Perl, but not Python.  PL/pgSQL is safe since it
doesn't have any interface to external resources.

-- 
  Bruce Momjian  <bruce@momjian.us>        https://momjian.us
  EnterpriseDB                             https://enterprisedb.com

  The usefulness of a cup is in its emptiness, Bruce Lee