Date: Sat, 22 May 2021 19:29:45 -0400
From: Stephen Frost <sfrost@snowman.net>
To: Bruce Momjian <bruce@momjian.us>
Cc: PostgreSQL-development <pgsql-hackers@postgresql.org>
Subject: Re: PG 14 release notes, first draft
Message-ID: <20210522232945.GO20766@tamriel.snowman.net>
References: <20210510060308.GC6088@momjian.us>
MIME-Version: 1.0
Content-Type: multipart/signed; micalg=pgp-sha512;
	protocol="application/pgp-signature"; boundary="Tw5Si7EKpwIa9w5C"
Content-Disposition: inline
In-Reply-To: <20210510060308.GC6088@momjian.us>
User-Agent: Mutt/1.5.24 (2015-08-30)
Archived-At: 
 <https://www.postgresql.org/message-id/20210522232945.GO20766%40tamriel.snowman.net>
Precedence: bulk


--Tw5Si7EKpwIa9w5C
Content-Type: text/plain; charset=us-ascii
Content-Disposition: inline
Content-Transfer-Encoding: quoted-printable

Greetings,

* Bruce Momjian (bruce@momjian.us) wrote:
> I have committed the first draft of the PG 14 release notes.  You can
> see the most current  build of them here:
>=20
> 	https://momjian.us/pgsql_docs/release-14.html

It occurs to me that the wording around the new default roles could
probably be better.  Specifically:

Add predefined roles pg_read_all_data and pg_write_all_data (Stephen Frost)

These non-login roles give read-only/write-only access to all objects.

Might be better as:

These non-login roles give read, or write, access to all tables, views,
and sequences.

(These roles don't actually allow, for example, a function to be
redefined, so saying 'all objects' isn't quite right either.)

While these roles could be used to create a 'read only' or 'write only'
role, they, themselves, do not explicitly convey that on to a role
because they don't do anything to prevent someone from GRANT'ing other
rights to some role which has been GRANT'd these predefined roles.  I
don't think anyone on this list thought differently from that, but the
phrasing strikes me as potentially confusing.

Maybe another way would be:

These non-login roles give (only) read, or write, access to all tables,
views, and sequences.

but I don't think saying 'only' there really adds anything and instead
invites confusion.

Thanks!

Stephen

--Tw5Si7EKpwIa9w5C
Content-Type: application/pgp-signature; name="signature.asc"

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1

iQIcBAEBCgAGBQJgqZPpAAoJEO1sijiDR2RVOqcP/0IryANI+BuVRHh7oAIWMdWP
8t53yvqSKCTjBc4adNE6jydh+iqXSlqhVWlAgzGVh9WQvDR0IdjS9wRJoe+p5/sj
TLAcal2Xmp3/L5CAyra441cyqy8AUgXq7p9LoCxJE+sow9caCE+IFMNxoUiYqo29
/8jOA95XpUkz/f4brUvXlpNl9/zhL4FsFlseK0xhWQNrxVSRufsDJmER2QwIQx0W
teLC4yYVvG/EqDE2mRvEaEjw7YQnrRwyNJTHM6L6jTlaDZfqzSFW1Fjb7jllsHsG
dKvr81RgIaVMTdLlr0l2PRUxzihubZT6WBhPy5wSG5W7GUjFFeanwJvMIF1m3o8L
n+hMwxQUh7o3S0E/NAzvZZ/Q8zp9b5YuK+87GXw1BRefSYqfE48tXeivR4/mY8oq
Id0rfFK7bNmeUyPK+5SW1mlajbgKWTiWqf8N7Dc2SZddv1CBNEvVUtFtoFETK7Du
3wxwbrK9mv+f8VK+0qMDuJCoj/ZBLxn5Uh8bjFizK5XEYMD6w6BvKq6gEJ0tfp7w
PEBx/bD1gBtC/nM9fUqjKGOJao1/Q9rh2jCvEKmKkUyUqxuXq32farx1U3S7xU4r
c0RfnfWSSqkQprVbSRejuztDMJBOcuW1WBKG2OZ0OPJJqTxtzSw1I0KEaCvh4rTq
urudXfrYErIoI8X3D7aP
=wAGT
-----END PGP SIGNATURE-----

--Tw5Si7EKpwIa9w5C--