agora inbox for pgsql-hackers@postgresql.org
help / color / mirror / Atom feedRequest for Code Review: BPGSQL
3+ messages / 2 participants
[nested] [flat]
* Request for Code Review: BPGSQL
@ 2016-02-11 13:06 Rich Jones <miserlou@gmail.com>
2016-02-11 13:26 ` Re: Request for Code Review: BPGSQL Jacek Wielemborek <d33tah@gmail.com>
0 siblings, 1 reply; 3+ messages in thread
From: Rich Jones @ 2016-02-11 13:06 UTC (permalink / raw)
To: pgsql-hackers
Hello, team!
I am writing on behalf of the BPGSQL Project [1] to request a code audit
from a core PGSQL team member.
The current maintainer is worried about the security of the code, and is
considering closing the project unless it can be properly reviewed [2]. As
a project living downstream[3] of that client library, I'd obviously much
rather see that project get reviewed rather than see it die.
Would anybody here be so kind as to volunteer to give BPGSQL a code review
from an upstream developer's perspective? It would have a lot of value
downstream users who want to use Postgres on Amazon RDS for serverless
applications, and I'm sure in plenty of other places.
Thanks very much!,
Rich Jones
[1] https://github.com/d33tah/bpgsql
[2] https://github.com/d33tah/bpgsql/issues/7
[3] https://github.com/Miserlou/django-zappa/issues/3
^ permalink raw reply [nested|flat] 3+ messages in thread
* Re: Request for Code Review: BPGSQL
2016-02-11 13:06 Request for Code Review: BPGSQL Rich Jones <miserlou@gmail.com>
@ 2016-02-11 13:26 ` Jacek Wielemborek <d33tah@gmail.com>
2016-02-25 16:45 ` Re: Request for Code Review: BPGSQL Jacek Wielemborek <d33tah@gmail.com>
0 siblings, 1 reply; 3+ messages in thread
From: Jacek Wielemborek @ 2016-02-11 13:26 UTC (permalink / raw)
To: Rich Jones <miserlou@gmail.com>; pgsql-hackers
W dniu 11.02.2016 o 14:06, Rich Jones pisze:
> Hello, team!
>
> I am writing on behalf of the BPGSQL Project [1] to request a code audit
> from a core PGSQL team member.
>
> The current maintainer is worried about the security of the code, and is
> considering closing the project unless it can be properly reviewed [2]. As
> a project living downstream[3] of that client library, I'd obviously much
> rather see that project get reviewed rather than see it die.
>
> Would anybody here be so kind as to volunteer to give BPGSQL a code review
> from an upstream developer's perspective? It would have a lot of value
> downstream users who want to use Postgres on Amazon RDS for serverless
> applications, and I'm sure in plenty of other places.
>
> Thanks very much!,
> Rich Jones
>
> [1] https://github.com/d33tah/bpgsql
> [2] https://github.com/d33tah/bpgsql/issues/7
> [3] https://github.com/Miserlou/django-zappa/issues/3
>
Hello,
Thanks Rich, I second the request for a code review.
I felt I'd add that this is a 1500-line pure-Python PostgreSQL client
module that I inherited after Barry Pederson. After I realized how
execute() is implemented, I have my worries and I'd rather not risk
making my users vulnerable.
I'd be really grateful if somebody who knows a bit of Python and the
guts of PostgreSQL could speak up on this one.
Cheers,
d33tah
Attachments:
[application/pgp-signature] signature.asc (818B, ../../56BC8C11.1000505@gmail.com/2-signature.asc)
download
^ permalink raw reply [nested|flat] 3+ messages in thread
* Re: Request for Code Review: BPGSQL
2016-02-11 13:06 Request for Code Review: BPGSQL Rich Jones <miserlou@gmail.com>
2016-02-11 13:26 ` Re: Request for Code Review: BPGSQL Jacek Wielemborek <d33tah@gmail.com>
@ 2016-02-25 16:45 ` Jacek Wielemborek <d33tah@gmail.com>
0 siblings, 0 replies; 3+ messages in thread
From: Jacek Wielemborek @ 2016-02-25 16:45 UTC (permalink / raw)
To: Rich Jones <miserlou@gmail.com>; pgsql-hackers
W dniu 11.02.2016 o 14:26, Jacek Wielemborek pisze:
> W dniu 11.02.2016 o 14:06, Rich Jones pisze:
>> Hello, team!
>>
>> I am writing on behalf of the BPGSQL Project [1] to request a code audit
>> from a core PGSQL team member.
>>
>> The current maintainer is worried about the security of the code, and is
>> considering closing the project unless it can be properly reviewed [2]. As
>> a project living downstream[3] of that client library, I'd obviously much
>> rather see that project get reviewed rather than see it die.
>>
>> Would anybody here be so kind as to volunteer to give BPGSQL a code review
>> from an upstream developer's perspective? It would have a lot of value
>> downstream users who want to use Postgres on Amazon RDS for serverless
>> applications, and I'm sure in plenty of other places.
>>
>> Thanks very much!,
>> Rich Jones
>>
>> [1] https://github.com/d33tah/bpgsql
>> [2] https://github.com/d33tah/bpgsql/issues/7
>> [3] https://github.com/Miserlou/django-zappa/issues/3
>>
>
> Hello,
>
> Thanks Rich, I second the request for a code review.
>
> I felt I'd add that this is a 1500-line pure-Python PostgreSQL client
> module that I inherited after Barry Pederson. After I realized how
> execute() is implemented, I have my worries and I'd rather not risk
> making my users vulnerable.
>
> I'd be really grateful if somebody who knows a bit of Python and the
> guts of PostgreSQL could speak up on this one.
>
> Cheers,
> d33tah
>
Hello,
I just unsubscribed from the mailing list so please CC next time you
post a reply to this thread.
Cheers,
d33tah
Attachments:
[application/pgp-signature] signature.asc (818B, ../../56CF2FB8.4080608@gmail.com/2-signature.asc)
download
^ permalink raw reply [nested|flat] 3+ messages in thread
end of thread, other threads:[~2016-02-25 16:45 UTC | newest]
Thread overview: 3+ messages (download: mbox mbox.gz follow: Atom feed)
-- links below jump to the message on this page --
2016-02-11 13:06 Request for Code Review: BPGSQL Rich Jones <miserlou@gmail.com>
2016-02-11 13:26 ` Jacek Wielemborek <d33tah@gmail.com>
2016-02-25 16:45 ` Jacek Wielemborek <d33tah@gmail.com>
This inbox is served by agora; see mirroring instructions
for how to clone and mirror all data and code used for this inbox