News for hackers. Stuff that matters.
Re:Parsing the Postgres protocol – logging executed statements by jascha_eng on Thursday March 14, 2024 @06:27PM (#39709684)
You can parse the logs to figure out executed statements. But then you only know the Postgres user that executed them.

In my experience there is often shared users, e.g. a readonly user or even for maintenance/operational tasks ("I need to fix prod real quick") a shared admin user.

The idea of Kviklet as a tool is to not share the password for such a user but instead use Single Sign on for authentication. Meaning multiple users can use the same DB user but the execution of statements is still linked to their individual accounts (e.g. Google Account) in the audit-log.

Hope this makes sense?

Re:Parsing the Postgres protocol – logging executed statements by mdaniel on Friday March 15, 2024 @12:57AM (#39712191)
I ordinarily would have said you reinvented Teleport <https://github.com/gravitational/teleport/tree/v14.3.7#readm...> but now that they've gone AGPL with v15 I'm guessing there's a market for MIT licensed stuff, although for sure since Teleport has been around for so long it has encountered more edge cases and undergone more security reviews. I was surprised while digging up the link that Gravatational is still releasing v13 and v14 updates under Apache 2, so maybe even Teleport will continue to have legs for those who cannot deploy AGPL stuff
Re:Parsing the Postgres protocol – logging executed statements by tristan957 on Friday March 15, 2024 @02:35AM (#39712633)
That's great that they're moving to AGPL. Respecting user freedoms is important.
Re:Parsing the Postgres protocol – logging executed statements by jascha_eng on Friday March 15, 2024 @02:06AM (#39712498)
Yes it's similar to teleport, but I always found teleport way too expensive and and complex to set up. Also as you say it's not really open source.

Of course Kviklet isn't as mature yet but since I just want to target databases I think it has a bit of it's own niche.

Re:Parsing the Postgres protocol – logging executed statements by krab on Friday March 15, 2024 @04:05AM (#39713170)
What's not open source about AGPL?
Re:Parsing the Postgres protocol – logging executed statements by jascha_eng on Friday March 15, 2024 @04:28AM (#39713317)
I think the license is fine? Idk don't know so much about OS licenses. But teleport has a paid offering and hide a bunch of features behind a hefty paywall so the actual open source part has the limbs cut off.
Re:Parsing the Postgres protocol – logging executed statements by Dan_Nguyen_ on Friday March 15, 2024 @04:58AM (#39713485)
It’s not that AGPL is not open source, but many enterprises are not allowed to use AGPL licensed software because of legel risks
Re:Parsing the Postgres protocol – logging executed statements by Dan_Nguyen_ on Friday March 15, 2024 @07:21AM (#39714290)
This also quite relevant news regarding Teleport: https://goteleport.com/blog/teleport-community-license/

It’s quite interesting to see how the market around access tooling is evolving. Especially now with the platform shift with AI

Re:Parsing the Postgres protocol – logging executed statements by wdella on Tuesday March 19, 2024 @04:51PM (#39760075)
> I was surprised while digging up the link that Gravatational is still releasing v13 and v14 updates under Apache 2, so maybe even Teleport will continue to have legs for those who cannot deploy AGPL stuff

Teleport puts out 3 major releases a year (every 4 months) and supports versions back to N-2. So the v13 will be updated until May (v16's release) and v14 until September-ish (v17's release). Using v14 and prior is not a viable strategy for AGPL averse companies in the long run... unless they want to fork.

After September 2024, the Teleport options that will get updates are:

1. Compiling Teleport yourself under the terms of the AGPL

2. Use the pre-compiled Community Edition under its new commercial license (<100 employees and <$10MM)

3. Purchase a license (or Teleport Cloud tenant) under enterprise terms

The recent Teleport licensing changes are designed to:

1. Push business users in category 1 and 2 into category 3 and

2. Preempt having Teleport's value resold by a big cloud player like the AWS Elasticsearch/OpenSearch kerfuffle a while back.

Source: I work at Teleport, and while I had no say in the license change, I did keep an ear out as I care about our open source stance. It is part of what brought me to the company.