News for hackers. Stuff that matters.

A comment on A picture got my PostgreSQL database to start mining Monero. Parent comment

Re:A picture got my PostgreSQL database to start mining Monero by Animats on Monday March 19, 2018 @11:24AM (#16619070)
The real problem is that Postgres will let you load C functions to run in the server context. That's inherently a bad idea.

Your databases should have multiple users configured with limited roles. Nothing web-facing should have a user with the ability to create a function. A SELECT-only user is a good start.

[ Parent | on HN ]
Re:A picture got my PostgreSQL database to start mining Monero by merb on Monday March 19, 2018 @12:45PM (#16619904)
only the server administrator can do that. (i.e. users with server admin role) as far as I know thats forbidden on aws rds, i.e. to load c functions..
[ Parent | on HN ]