From: Andrew Sullivan <ajs@crankycanuck.ca>
To: pgsql-performance@postgresql.org
Subject: Re: viewing source code
Date: Thu, 20 Dec 2007 17:35:47 -0500
Message-ID: <20071220223547.GA4924@crankycanuck.ca> (raw)
In-Reply-To: <b42b73150712201404i2058c7a2y8a837f30a1f4a2@mail.gmail.com>
References: <1A6E6D554222284AB25ABE3229A92762112A33@nrtexcus702.int.asurion.com>
<476A9ADF.5030101@commandprompt.com>
<90bce5730712201047m4dd0fe05k6b1fccc57897326f@mail.gmail.com>
<20071220114011.64a650d7@commandprompt.com>
<20071220200739.GC11586@alvh.no-ip.org>
<b42b73150712201235k7f41c4c7k92321af29ec768e5@mail.gmail.com>
<20071220205214.GW4924@crankycanuck.ca>
<b42b73150712201404i2058c7a2y8a837f30a1f4a2@mail.gmail.com>
On Thu, Dec 20, 2007 at 05:04:33PM -0500, Merlin Moncure wrote:
> right, right, thanks for the lecture. I am aware of various issues
> with key management.
Sorry to come off that way. It wasn't my intention to lecture, but rather
to try to stop dead a cure that, in my opinion, is rather worse than the
disease.
> I said 'simple' not 'good'.
I think this is where we disagree. It's simple only because it's no
security at all. It's not that it's "not good for some purposes". I'm
arguing that it's the sort of approach that shouldn't be used ever, period.
We have learned, over and over again, that simple answers that might have
been good enough for a very narrow purpose inevitably get used for a
slightly wider case than that for which they're appropriate. Anything that
involves storing the keys in the same repository as the encrypted data is
just begging to be misused that way.
> I am not making a proposal here and you don't have to denigrate my
> broad suggestion on a technical detail which is quite distracting from
> the real issue at hand, btw.
This isn't a technical detail that I'm talking about: it's a very serious
mistake in the entire approach to which you alluded, and goes to the heart
of why I think any talk of somehow encrypting or otherwise obfuscating the
contents of pg_proc are a bad idea. Column controls based on user roles are
another matter, because they'd be part of the access control system in the
DBMS.
Best,
A
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Reply to all the recipients using the --to and --cc options:
reply via email
To: pgsql-performance@postgresql.org
Cc: ajs@crankycanuck.ca
Subject: Re: viewing source code
In-Reply-To: <20071220223547.GA4924@crankycanuck.ca>
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
This inbox is served by DDX for PostgreSQL; see mirroring instructions
for how to clone and mirror all data and code used for this inbox