From: Dan Langille <dan@langille.org>
To: Bruce Momjian <bruce@momjian.us>
Cc: Tom Lane <tgl@sss.pgh.pa.us>
Cc: Merlin Moncure <mmoncure@gmail.com>
Cc: Alvaro Herrera <alvherre@commandprompt.com>
Cc: Joshua D. Drake <jd@commandprompt.com>
Cc: Trevor Talbot <quension@gmail.com>
Cc: Roberts, Jon <Jon.Roberts@asurion.com>
Cc: Kris Jurka <books@ejurka.com>
Cc: Jonah H. Harris <jonah.harris@gmail.com>
Cc: Bill Moran <wmoran@collaborativefusion.com>
Cc: pgsql-performance@postgresql.org
Subject: Re: viewing source code
Date: Fri, 21 Dec 2007 09:51:24 -0500
Message-ID: <476BD2EC.70204@langille.org> (raw)
In-Reply-To: <200712211434.lBLEYrm01943@momjian.us>
References: <200712211434.lBLEYrm01943@momjian.us>
Bruce Momjian wrote:
> Is this a TODO?
>
> ---------------------------------------------------------------------------
>
> Tom Lane wrote:
>> "Merlin Moncure" <mmoncure@gmail.com> writes:
>>> I don't really agree that wrapping pl/pgsql with encryptor/decryptor
>>> is a bad idea.
>> It's quite a good idea, because it has more than zero chance of
>> succeeding politically in the community.
>>
>> The fundamental reason why preventing access to pg_proc.prosrc won't
>> happen is this: all the pain (and there will be plenty) will be
>> inflicted on people who get none of the benefit (because they don't give
>> a damn about hiding their own functions' code). The folks who want
>> function hiding can shout all they want, but as long as there is a very
>> sizable fraction of the community who flat out *don't* want it, it's
>> not going to get applied.
>>
>> Encrypted function bodies avoid this problem because they inflict no
>> performance penalty, operational complexity, or client-code breakage
>> on people who don't use the feature. They are arguably also a better
>> solution because they can guard against more sorts of threats than
>> a column-hiding solution can.
>>
>> I don't deny that the key-management problem is interesting, but it
>> seems soluble; moreover, the difficulties that people have pointed to
>> are nothing but an attempt to move the goalposts, because they
>> correspond to requirements that a column-hiding solution would never
>> meet at all.
>>
>> So if you want something other than endless arguments to happen,
>> come up with a nice key-management design for encrypted function
>> bodies.
I keep thinking the problem of keys is similar that of Apache servers
which use certificates that require passphrases. When the server is
started, the passphrase is entered on the command line.
--
Dan Langille - http://www.langille.org/
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Reply to all the recipients using the --to and --cc options:
reply via email
To: pgsql-performance@postgresql.org
Cc: dan@langille.org, bruce@momjian.us, tgl@sss.pgh.pa.us, mmoncure@gmail.com, alvherre@commandprompt.com, jd@commandprompt.com, quension@gmail.com, Jon.Roberts@asurion.com, books@ejurka.com, jonah.harris@gmail.com, wmoran@collaborativefusion.com
Subject: Re: viewing source code
In-Reply-To: <476BD2EC.70204@langille.org>
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
This inbox is served by DDX for PostgreSQL; see mirroring instructions
for how to clone and mirror all data and code used for this inbox