From: Tom Lane <tgl@sss.pgh.pa.us>
To: Robert Haas <robertmhaas@gmail.com>
Cc: Chapman Flack <chap@anastigmatix.net>
Cc: Stephen Frost <sfrost@snowman.net>
Cc: Peter Eisentraut <peter.eisentraut@2ndquadrant.com>
Cc: pgsql-hackers <pgsql-hackers@postgresql.org>
Subject: Re: allow_system_table_mods stuff
Date: Mon, 24 Jun 2019 11:20:51 -0400
Message-ID: <13422.1561389651@sss.pgh.pa.us> (raw)
In-Reply-To: <CA+Tgmoaqmqh0Sr9+0Q6qetTVXd4zB9Xk-NixJA+OJyLrCh7AaQ@mail.gmail.com>
References: <8b00ea5e-28a7-88ba-e848-21528b632354@2ndquadrant.com>
<CA+TgmoZfJ1Y9Zrcit9zQVTSaPugCAo=UXC8b1URJcFsqNVoxqA@mail.gmail.com>
<20274.1561134523@sss.pgh.pa.us>
<20190621165855.GP2480@tamriel.snowman.net>
<26419.1561143177@sss.pgh.pa.us>
<20190621190730.GS2480@tamriel.snowman.net>
<371ecfe3-7ab2-07e3-2e1a-c45a7bdbfb54@anastigmatix.net>
<30500.1561149436@sss.pgh.pa.us>
<CA+Tgmoaqmqh0Sr9+0Q6qetTVXd4zB9Xk-NixJA+OJyLrCh7AaQ@mail.gmail.com>
Robert Haas <robertmhaas@gmail.com> writes:
> On Fri, Jun 21, 2019 at 4:37 PM Tom Lane <tgl@sss.pgh.pa.us> wrote:
>> This line of thought leads to the conclusion that we do want
>> separate "allow_system_table_dml" and "allow_system_table_ddl"
>> bools. Otherwise, the backwards-compatibility hack would need
>> to turn on a level of unsafety that extension scripts have *not*
>> had before and surely shouldn't have by default.
> Right, exactly.
> I'm repeating myself, but I still think it's super-useful to
> distinguish things which are "for expert use only" from things which
> are "totally bonkers."
Agreed, although "DML vs DDL" is a pretty poor approximation of that
boundary. As shown in examples upthread, you can find reasonable things
to do and totally-catastrophic things to do in both categories.
The position I'm maintaining is that it's not worth our trouble to try to
mechanically distinguish which things are which. Once you've broken the
glass and flipped either the big red switch or the slightly smaller orange
switch, it's entirely on you to not screw up your database beyond
recovery.
I do see value in two switches not one, but it's what I said above,
to not need to give people *more* chance-to-break-things than they
had before when doing manual catalog fixes. That is, we need a
setting that corresponds more or less to current default behavior.
There's an aesthetic argument to be had about whether to have two
bools or one three-way switch, but I prefer the former; there's
no backward-compatibility issue here since allow_system_table_mods
couldn't be set by applications anyway.
regards, tom lane
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Reply to all the recipients using the --to and --cc options:
reply via email
To: pgsql-hackers@postgresql.org
Cc: tgl@sss.pgh.pa.us, robertmhaas@gmail.com, chap@anastigmatix.net, sfrost@snowman.net, peter.eisentraut@2ndquadrant.com
Subject: Re: allow_system_table_mods stuff
In-Reply-To: <13422.1561389651@sss.pgh.pa.us>
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
This inbox is served by DDX for PostgreSQL; see mirroring instructions
for how to clone and mirror all data and code used for this inbox