On Tue, 2010-10-05 at 12:27 -0400, Tom Lane wrote: > Robert Haas <robertmh...@gmail.com> writes: > > On Tue, Oct 5, 2010 at 10:56 AM, Tom Lane <t...@sss.pgh.pa.us> wrote: > >> Personally I think this is a dead end that we shouldn't be wasting > >> any more time on. > > > But you haven't proposed a reasonable alternative. > > Tom: "This problem is insoluble." > Robert: "You can't claim that without offering a solution." > > Sorry ... > > > Option #1: Remove all mention from the documentation of using views > > for security purposes. Don't allow views to have explicit permissions > > attached to them; they are merely shorthand for a SELECT, for which > > you either do or do not have privileges. > > The SQL standard requires us to attach permissions to views. The > standard makes no claims whatsoever about how leak-proof views should > be; it only says that you can't call a view without the appropriate > permissions. > > I do think it's reasonable for the docs to point out that views that do > row-filtering should not be presumed to be absolutely bulletproof. > That doesn't make permissions on them useless, so you're attacking a > straw man.
+1 JD -- PostgreSQL.org Major Contributor Command Prompt, Inc: http://www.commandprompt.com/ - 509.416.6579 Consulting, Training, Support, Custom Development, Engineering http://twitter.com/cmdpromptinc | http://identi.ca/commandprompt -- Sent via pgsql-hackers mailing list (pgsql-hackers@postgresql.org) To make changes to your subscription: http://www.postgresql.org/mailpref/pgsql-hackers
