From: Merlin Moncure <mmoncure@gmail.com>
To: Andrew Sullivan <ajs@crankycanuck.ca>
To: pgsql-performance@postgresql.org
Subject: Re: viewing source code
Date: Thu, 20 Dec 2007 17:04:33 -0500
Message-ID: <b42b73150712201404i2058c7a2y8a837f30a1f4a2@mail.gmail.com> (raw)
In-Reply-To: <20071220205214.GW4924@crankycanuck.ca>
References: <1A6E6D554222284AB25ABE3229A92762112A33@nrtexcus702.int.asurion.com>
<476A9ADF.5030101@commandprompt.com>
<90bce5730712201047m4dd0fe05k6b1fccc57897326f@mail.gmail.com>
<20071220114011.64a650d7@commandprompt.com>
<20071220200739.GC11586@alvh.no-ip.org>
<b42b73150712201235k7f41c4c7k92321af29ec768e5@mail.gmail.com>
<20071220205214.GW4924@crankycanuck.ca>
On Dec 20, 2007 3:52 PM, Andrew Sullivan <ajs@crankycanuck.ca> wrote:
> On Thu, Dec 20, 2007 at 03:35:42PM -0500, Merlin Moncure wrote:
> >
> > Key management is an issue but easily solved. Uber simple solution is
> > to create a designated table holding the key(s) and use classic
> > permissions to guard it.
>
> Any security expert worth the title would point and laugh at that
> suggestion. If the idea is that the contents have to be encrypted to
> protect them, then it is just not acceptable to have the encryption keys
> online. That's the sort of "security" that inevitably causes programs to
> get a reputation for ill-thought-out protections.
right, right, thanks for the lecture. I am aware of various issues
with key management.
I said 'simple' not 'good'. there are many stronger things, like
forcing the key to be passed in for each invocation, hmac, etc. etc.
I am not making a proposal here and you don't have to denigrate my
broad suggestion on a technical detail which is quite distracting from
the real issue at hand, btw. I was just suggesting something easy to
stop casual browsing. If you want to talk specifics, we can talk
specifics...
merlin
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Reply to all the recipients using the --to and --cc options:
reply via email
To: pgsql-performance@postgresql.org
Cc: mmoncure@gmail.com, ajs@crankycanuck.ca
Subject: Re: viewing source code
In-Reply-To: <b42b73150712201404i2058c7a2y8a837f30a1f4a2@mail.gmail.com>
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
This inbox is served by DDX for PostgreSQL; see mirroring instructions
for how to clone and mirror all data and code used for this inbox