Re: Using views for row-level access control is leaky

Tom Lane wrote:
> The thought that's been in the back of my mind is that you could solve
> 99% of the performance problem if you trusted all builtin functions and
> nothing else.  This avoids the question of who gets to mark functions
> as trustable.

Except that all builtin functions are not trustworthy. set_config and
int->text cast are two examples mentioned this far, and I'm sure there's
a boatload of others.

Trusting only index operators seems more and more attractive to me. That
won't limit us to built-in datatypes, requires no explicit user action
to categorize functions. They're also the most significant functions
from a performance point-of-view, allowing use of indexes instead of
forcing a seqscan of all tables.

--  Heikki Linnakangas EnterpriseDB   http://www.enterprisedb.com