Re: pl/pgsql enabled by default

Simon Riggs wrote:
> I support Andrew's comment, though might reword it to 
> "Don't enable anything that gives users programmable features or user
> exits by default".

Users can already define SQL functions by default, which certainly 
provides "programmable features". I'm not quite sure what you mean by 
"user exits."

I guess I'm missing how pl/pgsql is a fundamentally greater security risk.

> You can't use the builtin encoding functions or non-btree indexes to
> access things you are not supposed to.

How can you use pl/pgsql to "access things you are not supposed to"?

-Neil