From: Laurenz Albe <laurenz.albe@cybertec.at>
To: David G. Johnston <david.g.johnston@gmail.com>
Cc: PostgreSQL Documentation <pgsql-docs@lists.postgresql.org>
Subject: Re: Another user complaint regarding visibility of pg_catalog data
Date: Wed, 08 Nov 2023 15:04:31 +0100
Message-ID: <4df5fbc8adbe770da13db92bc5cc48f948636640.camel@cybertec.at> (raw)
In-Reply-To: <CAKFQuwYdv1ALxZhS4fy+QTfJ3zp9e7fBk2VfV8YTeOyPEAQCnA@mail.gmail.com>
References: <CAKFQuwb0f30_zD3Dw2sfGuSppSox0mTpAy_V4KCGda_JedQmZQ@mail.gmail.com>
<d9d5b22443716abe461ce1b52330ef4139fd3e2d.camel@cybertec.at>
<CAKFQuwYdv1ALxZhS4fy+QTfJ3zp9e7fBk2VfV8YTeOyPEAQCnA@mail.gmail.com>
On Wed, 2023-11-08 at 05:31 -0700, David G. Johnston wrote:
> On Wednesday, November 8, 2023, Laurenz Albe <laurenz.albe@cybertec.at> wrote:
> > When people ask my "why?", I tend to answer "why not?". It is not a security
> > problem, in my opinion. Every user is allowed to know that I have a table
> > "purchase" with a column "credit_card_nr". As long as the permissions are set
> > correctly, that is no problem. Any attempt to hide that information is at best
> > "security by obscurity".
>
> The typical answer is some variant of trade secrets. Though wanting to store
> private info in a comment has some merit too.
Don't keep your trade secrets in database identifiers or database function code.
But if somebody is nervous about that, they can have their own database.
Why share a database with users you don't trust?
Yours,
Laurenz Albe
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Reply to all the recipients using the --to and --cc options:
reply via email
To: pgsql-docs@postgresql.org
Cc: laurenz.albe@cybertec.at, david.g.johnston@gmail.com, pgsql-docs@lists.postgresql.org
Subject: Re: Another user complaint regarding visibility of pg_catalog data
In-Reply-To: <4df5fbc8adbe770da13db92bc5cc48f948636640.camel@cybertec.at>
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
This inbox is served by DDX for PostgreSQL; see mirroring instructions
for how to clone and mirror all data and code used for this inbox