Re:Total security in a PostgreSQL database
by tptacek on Saturday February 08, 2014 @07:13PM
(#7203537)
No, that's not what I said. I didn't say you "can't add security later on". I said that you can't rely on database access control configuration to protect an application that hasn't been designed from scratch to do that. Most applications don't rely on database access control; they rely on the application server to protect the database.
15 years ago, in client-server Era, relying on database Access control was the default. It's a shame that all that knowledge has mostly been forgotten, and most programmers don't actually know how to use a database.
Re:Total security in a PostgreSQL database
by einhverfr on Saturday February 08, 2014 @10:19PM
(#7204169)
Just because the application assumes it is trusted by the database doesn't mean the database has to trust the application.
That works as long as the database server is kept up to date with security patches. Quite often in production running a security patch is not high priority.
I guess it all depends on using this feature as an additional layer of protection or using it as the only layer of protection.
Almost all webapps we write, we write them this way. (on oracle, not postgres, but that makes no difference).
> your application needs to be designed for it from the very beginning.
That's true. As in "you can not add security later on".