Received: from malur.postgresql.org ([217.196.149.56]) by arkaria.postgresql.org with esmtp (Exim 4.80) (envelope-from ) id 1VgnGX-0006xA-Dw for pgsql-hackers@arkaria.postgresql.org; Thu, 14 Nov 2013 03:06:45 +0000 Received: from localhost ([127.0.0.1] helo=postgresql.org) by malur.postgresql.org with smtp (Exim 4.80) (envelope-from ) id 1VgnGW-0006aV-Su for pgsql-hackers@arkaria.postgresql.org; Thu, 14 Nov 2013 03:06:44 +0000 Received: from magus.postgresql.org ([2a02:c0:301:0:ffff::29]) by malur.postgresql.org with esmtp (Exim 4.80) (envelope-from ) id 1VgnGU-0006YX-R1 for pgsql-hackers@postgresql.org; Thu, 14 Nov 2013 03:06:42 +0000 Received: from sss.pgh.pa.us ([66.207.139.130]) by magus.postgresql.org with esmtp (Exim 4.80) (envelope-from ) id 1VgnGL-0001hW-5Q; Thu, 14 Nov 2013 03:06:42 +0000 Received: from sss1.sss.pgh.pa.us (localhost [127.0.0.1]) by sss.pgh.pa.us (8.14.4/8.14.4) with ESMTP id rAE365AE000935; Wed, 13 Nov 2013 22:06:05 -0500 From: Tom Lane To: Tatsuo Ishii cc: kleptog@svana.org, maumau307@gmail.com, laurenz.albe@wien.gv.at, robertmhaas@gmail.com, peter_e@gmx.net, arul@fast.au.fujitsu.com, stark@mit.edu, Maksym.Boguk@au.fujitsu.com, hlinnakangas@vmware.com, pgsql-hackers@postgresql.org Subject: Re: UTF8 national character data type support WIP patch and list of open issues. In-reply-to: <20131114.094304.846975239071362840.t-ishii@sraoss.co.jp> References: <24268.1384374698@sss.pgh.pa.us> <20131114.092428.5340552318651483.t-ishii@sraoss.co.jp> <29319.1384388888@sss.pgh.pa.us> <20131114.094304.846975239071362840.t-ishii@sraoss.co.jp> Comments: In-reply-to Tatsuo Ishii message dated "Thu, 14 Nov 2013 09:43:04 +0900" Date: Wed, 13 Nov 2013 22:06:05 -0500 Message-ID: <934.1384398365@sss.pgh.pa.us> X-Pg-Spam-Score: -1.9 (-) List-Archive: List-Help: List-ID: List-Owner: List-Post: List-Subscribe: List-Unsubscribe: X-Mailing-List: pgsql-hackers Precedence: bulk Sender: pgsql-hackers-owner@postgresql.org Tatsuo Ishii writes: > BTW, same characters are assigned different code points are pretty > common in many character sets (Unicode, for example). This is widely considered a security bug; read section 10 in RFC 3629 (the definition of UTF8), and search the CVE database a bit if you still doubt it's a threat. I'm going to push back very hard on any suggestion that Postgres should build itself around a text representation with that kind of weakness designed in. regards, tom lane [1] http://tools.ietf.org/html/rfc3629#section-10 -- Sent via pgsql-hackers mailing list (pgsql-hackers@postgresql.org) To make changes to your subscription: http://www.postgresql.org/mailpref/pgsql-hackers