Received: from malur.postgresql.org ([217.196.149.56]) by arkaria.postgresql.org with esmtp (Exim 4.80) (envelope-from ) id 1VG7ru-0001Lu-3m for pgsql-hackers@arkaria.postgresql.org; Sun, 01 Sep 2013 13:39:06 +0000 Received: from localhost ([127.0.0.1] helo=postgresql.org) by malur.postgresql.org with smtp (Exim 4.80) (envelope-from ) id 1VG7rt-00084S-Bq for pgsql-hackers@arkaria.postgresql.org; Sun, 01 Sep 2013 13:39:05 +0000 Received: from makus.postgresql.org ([2001:4800:7903:4::125]) by malur.postgresql.org with esmtp (Exim 4.80) (envelope-from ) id 1VG7rs-00084I-3x for pgsql-hackers@postgresql.org; Sun, 01 Sep 2013 13:39:04 +0000 Received: from smtp-outbound-2.vmware.com ([208.91.2.13]) by makus.postgresql.org with esmtp (Exim 4.80) (envelope-from ) id 1VG7rn-0000tb-Jv for pgsql-hackers@postgresql.org; Sun, 01 Sep 2013 13:39:02 +0000 Received: from sc9-mailhost1.vmware.com (sc9-mailhost1.vmware.com [10.113.161.71]) by smtp-outbound-2.vmware.com (Postfix) with ESMTP id 02C2629709; Sun, 1 Sep 2013 06:38:58 -0700 (PDT) Received: from zcs-prod-ext-mta-2.vmware.com (zcs-prod-ext-mta-2.vmware.com [10.113.62.224]) by sc9-mailhost1.vmware.com (Postfix) with ESMTP id F29AF1846D; Sun, 1 Sep 2013 06:38:57 -0700 (PDT) Received: from zcs-prod-ext-mta-2.vmware.com (localhost.localdomain [127.0.0.1]) by zcs-prod-ext-mta-2.vmware.com (Postfix) with ESMTP id 128FBC004F; Sun, 1 Sep 2013 06:39:05 -0700 (PDT) Received: from [192.168.1.90] (zimbra-prod-ext-proxy-vip.vmware.com [10.113.63.87]) by zcs-prod-ext-mta-2.vmware.com (Postfix) with ESMTPSA; Sun, 1 Sep 2013 06:39:01 -0700 (PDT) Message-ID: <5223436B.1070406@vmware.com> Date: Sun, 01 Sep 2013 16:38:51 +0300 From: Heikki Linnakangas Organization: VMware User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:10.0.12) Gecko/20130116 Icedove/10.0.12 MIME-Version: 1.0 To: Josh Berkus CC: Tom Lane , Stephen Frost , Kohei KaiGai , "ktm@rice.edu" , Alexander Korotkov , Oleg Bartunov , Greg Smith , PgHacker Subject: Re: [v9.4] row level security References: <20130829142321.GA30496@aart.rice.edu> <521F7DFB.8060602@agliodbs.com> <5220D832.7090104@agliodbs.com> <20130830192729.GO2706@tamriel.snowman.net> <16798.1377891794@sss.pgh.pa.us> <5220F928.7040503@agliodbs.com> In-Reply-To: <5220F928.7040503@agliodbs.com> Content-Type: text/plain; charset=UTF-8; format=flowed Content-Transfer-Encoding: 7bit X-Pg-Spam-Score: -9.3 (---------) List-Archive: List-Help: List-ID: List-Owner: List-Post: List-Subscribe: List-Unsubscribe: X-Mailing-List: pgsql-hackers Precedence: bulk Sender: pgsql-hackers-owner@postgresql.org On 30.08.2013 22:57, Josh Berkus wrote: > Right now, the primary tool for doing row filtering for MTA is Veil, > which has numerous and well-known limitations. If RLS has fewer > limitations, or is easier to deploy, maintain, and/or understand, then > it's a valuable feature for that user base, even if it doesn't address > the covert channels we've brought up at all. > > That is, if RLS is your*second* level of defense, instead of your > primary defense, covert channels are not a make-or-break issue. It just > has to be better than what we had before. > > Note that I have NOT done an evaluation of Veil vs. RLS for MTA at this > point. I'm hoping someone else will ;-) I'd also like to hear how Veil differs from RLS. From what I've understood this far, they are the same in terms of what you can and cannot do. To phrase it differently: We already have RLS. It's shipped as an extension called Veil. Now please explain what's wrong with that statement, if anything. - Heikki -- Sent via pgsql-hackers mailing list (pgsql-hackers@postgresql.org) To make changes to your subscription: http://www.postgresql.org/mailpref/pgsql-hackers