On 28/01/2008, Andrew Dunstan <andrew@dunslane.net> wrote:
>
>
> Pavel Stehule wrote:
> > Hello
> >
> > this patch define new function flag - OBFUSCATE. With this flag
> > encrypted source code is stored to probin column. Password is stored
> > in GUC_SUPERUSER_ONLY item - it is similar security like SQL Server
> > does (where privileged users can access system tables with source code
> > or can use debugger)
> >
> > ToDo: Dump
> >
>
> Maybe a better TODO would be to do this task in the way that has
> previously been suggested:
> http://archives.postgresql.org/pgsql-hackers/2007-08/msg00258.php
>
> I'm certainly not happy about any proposal to put a password/key in a
> GUC var - that strikes me as a major footgun.
>
why? we cannot ensure bigger real security. Anybody with superuser
rights can add modules that show source code of plpgsql procedure, or
can run debugger and attach postgres process.
p.s. this topic was discussed in http://markmail.org/message/r6jy7m6oryi5owyb
Pavel
> cheers
>
> andrew
>
>
>