Message-ID: <4df5fbc8adbe770da13db92bc5cc48f948636640.camel@cybertec.at>
Subject: Re: Another user complaint regarding visibility of pg_catalog data
From: Laurenz Albe <laurenz.albe@cybertec.at>
To: "David G. Johnston" <david.g.johnston@gmail.com>
Cc: PostgreSQL Documentation <pgsql-docs@lists.postgresql.org>
Date: Wed, 08 Nov 2023 15:04:31 +0100
In-Reply-To: 
 <CAKFQuwYdv1ALxZhS4fy+QTfJ3zp9e7fBk2VfV8YTeOyPEAQCnA@mail.gmail.com>
References: 
	<CAKFQuwb0f30_zD3Dw2sfGuSppSox0mTpAy_V4KCGda_JedQmZQ@mail.gmail.com>
	 <d9d5b22443716abe461ce1b52330ef4139fd3e2d.camel@cybertec.at>
	 <CAKFQuwYdv1ALxZhS4fy+QTfJ3zp9e7fBk2VfV8YTeOyPEAQCnA@mail.gmail.com>
Content-Type: text/plain; charset="UTF-8"
Content-Transfer-Encoding: quoted-printable
User-Agent: Evolution 3.48.4 (3.48.4-1.fc38) 
MIME-Version: 1.0
Archived-At: 
 <https://www.postgresql.org/message-id/4df5fbc8adbe770da13db92bc5cc48f948636640.camel%40cybertec.at>
Precedence: bulk

On Wed, 2023-11-08 at 05:31 -0700, David G. Johnston wrote:
> On Wednesday, November 8, 2023, Laurenz Albe <laurenz.albe@cybertec.at> w=
rote:
> > When people ask my "why?", I tend to answer "why not?".=C2=A0 It is not=
 a security
> > problem, in my opinion.=C2=A0 Every user is allowed to know that I have=
 a table
> > "purchase" with a column "credit_card_nr".=C2=A0 As long as the permiss=
ions are set
> > correctly, that is no problem.=C2=A0 Any attempt to hide that informati=
on is at best
> > "security by obscurity".
>=20
> The typical answer is some variant of trade secrets.=C2=A0 Though wanting=
 to store
> private info in a comment has some merit too.

Don't keep your trade secrets in database identifiers or database function =
code.

But if somebody is nervous about that, they can have their own database.
Why share a database with users you don't trust?

Yours,
Laurenz Albe