Brian Aker wrote:
> Hi!
>
> On May 4, 2009, at 10:58 AM, Jim Starkey wrote:
>
>>> Adding C++ triggers right now would be easy (and from the interface
>>> Monty Taylor could tie a half a dozen other languages, including Java).
>> I don't believe that un-sandboxed user code should ever be allowed in
>> a database system. I did that Interbase and felt guilty for 25 years.
>
> To me Gearman workers are much safer but I don't believe locking out
> solutions. If someone wants to use a Java plugin over a C++ one for
> security?
> Let them.
Agree. There's a funny line between what is "user code" and what isn't
once the door is open to plugin code at all. Since we allow plugins to
be written in C++, there is nothing worse that could be done with a
plugin written in Ruby.
Now - allowing J. Random User to do:
create procedure language=PERL
as
BEGIN
system("rm -rf all your files");
END;
Is a whole other ball of security-related wax. But I don't think we're
really considering this at this point.
>> INACTIVE
>> CLASS <trigger class>
>
> This is the part I was curious about. I'd essentially do the same
> thing... though I wonder if this was addressed in the standard in later
> versions (my SQL 99 reference book doesn't have an option for anything
> but SQL parsed triggers).
>
> Cheers,
> -Brian
>
>
>
>
> _______________________________________________
> Mailing list: https://launchpad.net/~drizzle-discuss
> Post to : [email protected]
> Unsubscribe : https://launchpad.net/~drizzle-discuss
> More help : https://help.launchpad.net/ListHelp
>
_______________________________________________
Mailing list: https://launchpad.net/~drizzle-discuss
Post to : [email protected]
Unsubscribe : https://launchpad.net/~drizzle-discuss
More help : https://help.launchpad.net/ListHelp
