From: Tom Lane <tgl@sss.pgh.pa.us>
To: Nathan Bossart <nathandbossart@gmail.com>
Cc: Robert Haas <robertmhaas@gmail.com>
Cc: pgsql-hackers@postgresql.org <pgsql-hackers@postgresql.org>
Subject: Re: allow building trusted languages without the untrusted versions
Date: Tue, 24 May 2022 13:38:32 -0400
Message-ID: <1679334.1653413912@sss.pgh.pa.us> (raw)
In-Reply-To: <20220524172851.GA1191690@nathanxps13>
References: <20220520225619.GA876272@nathanxps13>
<571753.1653092411@sss.pgh.pa.us>
<20220523165403.GC938919@nathanxps13>
<1290329.1653326228@sss.pgh.pa.us>
<CA+TgmoY-Xy_ObfYVUTSamD8BmW8npaktbr65JtnkW-c1VQobVA@mail.gmail.com>
<1333860.1653338790@sss.pgh.pa.us>
<CA+TgmoYZKLxftaZZvj4_-zHQ27CBeUs+KvggyU3qS79-7aQEPA@mail.gmail.com>
<1354561.1653345768@sss.pgh.pa.us>
<CA+TgmoZ_c0j4ut87_QCFm697Qq5Z_u66VZt2PYenfZVjUT1qRA@mail.gmail.com>
<20220524172851.GA1191690@nathanxps13>
Nathan Bossart <nathandbossart@gmail.com> writes:
> On Tue, May 24, 2022 at 12:39:16PM -0400, Robert Haas wrote:
>> No, my point is that one size doesn't fit all. Bundling everything
>> together that could result in a disk access is going to suck too many
>> marginally-related into the same bucket. It's much better to have
>> individual switches controlling individual behaviors, so that people
>> can opt into or out of the behavior that they want.
> Can we do both? That is, can we add retail options for untrusted
> languages, generic file access functions, etc., and then also introduce a
> --disable-disk-access configuration option? The latter might even just be
> a combination of retail options. This would allow for more granular
> configurations, but it also could help address Tom's concerns.
Don't see why not.
I'm a bit skeptical of Robert's position, mainly because I don't think
he's offered any credible threat model that would justify disabling
individual features of this sort but not all of them. However, if what
it takes to have consensus is some individual knobs in addition to an
"easy button", let's do it that way.
regards, tom lane
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Reply to all the recipients using the --to and --cc options:
reply via email
To: pgsql-hackers@postgresql.org
Cc: tgl@sss.pgh.pa.us, nathandbossart@gmail.com, robertmhaas@gmail.com
Subject: Re: allow building trusted languages without the untrusted versions
In-Reply-To: <1679334.1653413912@sss.pgh.pa.us>
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
This inbox is served by DDX for PostgreSQL; see mirroring instructions
for how to clone and mirror all data and code used for this inbox