Received: from malur.postgresql.org ([217.196.149.56])
	by arkaria.postgresql.org with esmtps  (TLS1.3) tls
 TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384
	(Exim 4.96)
	(envelope-from <pgsql-hackers-owner+archive@lists.postgresql.org>)
	id 1x6qVW-000TV2-2D
	for pgsql-hackers@arkaria.postgresql.org;
	Wed, 16 Sep 2026 14:21:07 +0000
Received: from localhost ([127.0.0.1] helo=malur.postgresql.org)
	by malur.postgresql.org with esmtp (Exim 4.96)
	(envelope-from <pgsql-hackers-owner+archive@lists.postgresql.org>)
	id 1x6qVV-007lDF-29
	for pgsql-hackers@arkaria.postgresql.org;
	Wed, 16 Sep 2026 14:21:05 +0000
Received: from makus.postgresql.org ([2001:4800:3e1:1::229])
	by malur.postgresql.org with esmtps  (TLS1.3) tls
 TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384
	(Exim 4.96)
	(envelope-from <tgl@sss.pgh.pa.us>)
	id 1x6qVV-007lD4-1D
	for pgsql-hackers@lists.postgresql.org;
	Wed, 16 Sep 2026 14:21:05 +0000
Received: from sss.pgh.pa.us ([68.162.161.243])
	by makus.postgresql.org with esmtps  (TLS1.3) tls
 TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384
	(Exim 4.98.2)
	(envelope-from <tgl@sss.pgh.pa.us>)
	id 1x6qVT-00000000OjH-3A9x
	for pgsql-hackers@lists.postgresql.org;
	Wed, 16 Sep 2026 14:21:04 +0000
Received: from sss1.sss.pgh.pa.us (localhost [127.0.0.1])
	by sss.pgh.pa.us (8.18.1/8.18.1) with ESMTP id 68GEKvCh496976;
	Wed, 16 Sep 2026 10:20:57 -0400
From: Tom Lane <tgl@sss.pgh.pa.us>
To: Daniel Gustafsson <daniel@yesql.se>
cc: Greg Sabino Mullane <htamfids@gmail.com>,
        Andres Freund <andres@anarazel.de>, Antonin Houska <ah@cybertec.at>,
        "pgsql-hackers@lists.postgresql.org"
 <pgsql-hackers@lists.postgresql.org>
Subject: Re: POC: Carefully exposing information without authentication
In-reply-to: <53ACCD31-34FD-4D36-A60E-8FF62023FA0A@yesql.se>
References: 
 <CAKAnmm+T-CEDLmRezWfH-7ZEsFfD_kU2KY1TgB288K+wprB_4Q@mail.gmail.com>
 <21076.1748617331@localhost>
 <CAKAnmmJ77jeYZGXPBxb75U52ojNRUoKd6Za-T26xNPCouUeV8g@mail.gmail.com>
 <2724612.1748655287@sss.pgh.pa.us>
 <CAKAnmm+RQbLFv1F35ZTRZfMRigwN0LN0KKRocLLpwSshBTZxvg@mail.gmail.com>
 <CAKAnmmLdrvdCMbAQbfiWY3q=zv+-11zZk+jweTRVCJrNL=aD4A@mail.gmail.com>
 <CAKAnmmKxP7bOO7QOLdSk8dYoUxFRus2XC1nEbk6En9GgV_4JbA@mail.gmail.com>
 <11894.1767966998@localhost>
 <CAKAnmm+-+2aZiK-wtwSCEpfOJbU7-PnwofByhr0F_XQB4wUJNw@mail.gmail.com>
 <CAKAnmmJUGidY7cjD0rHtNVisQksy3u1KszHXkMCNPWYhMKPEvw@mail.gmail.com>
 <sqammd2ykcy34skbsewpfq4ftm6xl3qt5ebr2plwenoprtvdrm@ayddy4xqbkb5>
 <CAKAnmmKxDD41mrnbM29+5d+OBrPRBr3N=T+LGxUcAKoG5JkM5A@mail.gmail.com>
 <CAKAnmm+eGs++amVMuq-dGXzUOHRNytHgMcaX_5N+jvitmBn6MA@mail.gmail.com>
 <CAKAnmmJBhwNK-vBgRJ0EgBVe_2dLomKOGtt=OLFbkA1Kd1eFjA@mail.gmail.com>
 <53ACCD31-34FD-4D36-A60E-8FF62023FA0A@yesql.se>
Comments: In-reply-to Daniel Gustafsson <daniel@yesql.se>
	message dated "Tue, 15 Sep 2026 23:24:54 +0200"
MIME-Version: 1.0
Content-Type: text/plain; charset="us-ascii"
Content-ID: <496974.1789568457.1@sss.pgh.pa.us>
Content-Transfer-Encoding: quoted-printable
Date: Wed, 16 Sep 2026 10:20:57 -0400
Message-ID: <496975.1789568457@sss.pgh.pa.us>
List-Id: <pgsql-hackers.lists.postgresql.org>
List-Help: <https://lists.postgresql.org/manage/>
List-Subscribe: <https://lists.postgresql.org/manage/>
List-Post: <mailto:pgsql-hackers@lists.postgresql.org>
List-Owner: <mailto:pgsql-hackers-owner@lists.postgresql.org>
List-Archive: <https://www.postgresql.org/list/pgsql-hackers>
Archived-At: 
 <https://www.postgresql.org/message-id/496975.1789568457%40sss.pgh.pa.us>
Precedence: bulk

Daniel Gustafsson <daniel@yesql.se> writes:
> To be honest, I am absolutely terrified by any feature which does any le=
vel of
> work based on user input before authentication or authorization.

Yeah.  TBH, I can't see this ever getting committed.

			regards, tom lane