From: Bruce Momjian <bruce@momjian.us>
To: Aleksander Alekseev <a.alekseev@postgrespro.ru>
Cc: Kenneth Marshall <ktm@rice.edu>
Cc: Peter Eisentraut <peter.eisentraut@2ndquadrant.com>
Cc: Ants Aasma <ants.aasma@eesti.ee>
Cc: Robert Haas <robertmhaas@gmail.com>
Cc: PostgreSQL-development <pgsql-hackers@postgresql.org>
Subject: Re: WIP: Data at rest encryption
Date: Wed, 14 Jun 2017 10:31:44 -0400
Message-ID: <20170614143144.GA4750@momjian.us> (raw)
In-Reply-To: <20170614131357.GC11767@e733.localdomain>
References: <CA+CSw_tb3bk5i7if6inZFc3yyf+9HEVNTy51QFBoeUk7UE_V=w@mail.gmail.com>
<06b6db11-3a3f-4d24-6f57-450f96ecda84@2ndquadrant.com>
<CA+TgmoaXGx=7VEVz7eq9T=raZRHm3iNc244Sx=T1UxX-+szOUQ@mail.gmail.com>
<CA+CSw_uO6wGv2YF-RQvVOGeezJXWY+SGTKYomOY=fDNp6OmHqA@mail.gmail.com>
<babf2042-3a7f-1601-7767-b34707194462@2ndquadrant.com>
<20170614090426.GA7249@e733.localdomain>
<20170614124601.GM26506@aart.rice.edu>
<20170614130509.GB11767@e733.localdomain>
<20170614131357.GC11767@e733.localdomain>
List-Unsubscribe: <mailto:majordomo@postgresql.org?body=unsub%20pgsql-hackers>
On Wed, Jun 14, 2017 at 04:13:57PM +0300, Aleksander Alekseev wrote:
> > > While I agree that configuring full disk encryption is not technically
> > > difficult, it requires much more privileged access to the system and
> > > basically requires the support of a system administrator. In addition,
> > > if a volume is not available for encryption, PostgreSQL support for
> > > encryption would still allow for its data to be encrypted and as others
> > > have mentioned can be enabled by the DBA alone.
> >
> > Frankly I'm having difficulties imagining when it could be a real
> > problem. It doesn't seem to be such a burden to ask a colleague for
> > assistance in case you don't have sufficient permissions to do
> > something. And I got a strong feeling that solving bureaucracy issues of
> > specific organizations by changing PostgreSQL core in very invasive way
> > (keeping in mind testing, maintaining, etc) is misguided.
>
> In the same time implementing a plugable storage API and then implementing
> encrypted / compressed / whatever storage in a standalone extension using
> this API seems to be a reasonable thing to do.
Agreed, good point.
--
Bruce Momjian <bruce@momjian.us> http://momjian.us
EnterpriseDB http://enterprisedb.com
+ As you are, so once was I. As I am, so you will be. +
+ Ancient Roman grave inscription +
--
Sent via pgsql-hackers mailing list (pgsql-hackers@postgresql.org)
To make changes to your subscription:
http://www.postgresql.org/mailpref/pgsql-hackers
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Reply to all the recipients using the --to and --cc options:
reply via email
To: pgsql-hackers@postgresql.org
Cc: bruce@momjian.us, a.alekseev@postgrespro.ru, ktm@rice.edu, peter.eisentraut@2ndquadrant.com, ants.aasma@eesti.ee, robertmhaas@gmail.com
Subject: Re: WIP: Data at rest encryption
In-Reply-To: <20170614143144.GA4750@momjian.us>
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
This inbox is served by DDX for PostgreSQL; see mirroring instructions
for how to clone and mirror all data and code used for this inbox