Received: from localhost (unknown [200.46.204.184]) by postgresql.org (Postfix) with ESMTP id 56FCC2E35BF for ; Fri, 21 Dec 2007 17:47:55 -0400 (AST) Received: from postgresql.org ([200.46.204.71]) by localhost (mx1.hub.org [200.46.204.184]) (amavisd-maia, port 10024) with ESMTP id 19343-06 for ; Fri, 21 Dec 2007 17:47:47 -0400 (AST) Received: from main2.mycybernet.net (main2.mycybernet.net [209.222.63.140]) by postgresql.org (Postfix) with ESMTP id DD9552E3549 for ; Fri, 21 Dec 2007 17:47:51 -0400 (AST) Received: from 227-54-222-209.mycybernet.net ([209.222.54.227] helo=crankycanuck.ca) by main2.mycybernet.net with esmtp (Exim 4.62) (envelope-from ) id 1J5pig-00077j-Rc for pgsql-hackers@postgresql.org; Fri, 21 Dec 2007 16:47:50 -0500 Received: by crankycanuck.ca (Postfix, from userid 1000) id 125CD500AD; Fri, 21 Dec 2007 16:47:46 -0500 (EST) Date: Fri, 21 Dec 2007 16:47:46 -0500 From: Andrew Sullivan To: pgsql-hackers@postgresql.org Subject: Re: function body actors (was: [PERFORM] viewing source code) Message-ID: <20071221214746.GG3864@crankycanuck.ca> Mail-Followup-To: Andrew Sullivan , pgsql-hackers@postgresql.org References: <26811.1198215605@sss.pgh.pa.us> <20071221164826.GI10918@crankycanuck.ca> <10257.1198263464@sss.pgh.pa.us> <20071221205619.GD3864@crankycanuck.ca> <12277.1198271991@sss.pgh.pa.us> MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline In-Reply-To: <12277.1198271991@sss.pgh.pa.us> User-Agent: Mutt/1.5.13 (2006-08-11) X-Virus-Scanned: Maia Mailguard 1.0.1 X-Archive-Number: 200712/813 X-Sequence-Number: 112102 On Fri, Dec 21, 2007 at 04:19:51PM -0500, Tom Lane wrote: > > 2. Protect the content of a field from _some_ users on a given system, > > I would argue that (2) is reasonably well served today by setting up > separate databases for separate users. I thought actually this was one of the use-cases we were hearing. Different people using the same database (because the same data), with rules about the different staff being able to see this or that function body. I can easily imagine such a case, for instance, in a large organization with different departments and different responsibilities. It seems a shame that the only answer we have there is, "Give them different databases." I actually think organizations that think keeping function bodies secret like this to be a good idea are organizations that will eventually make really stupid mistakes. But that doesn't mean they're not under the legal requirement to do this. For instance, my current employer has (externally-mandated) organizational conflict of interest rules that require all disclosure to be done exclusively as "need to know". Under the right (!) legal guidance, such a requirement could easily lead to rules about function-body disclosure. From my point of view, such a use case is way more compelling than function-body encryption (although I understand that one too). A