3 ms·
> To attempt this security model, which can work if everything in the universe goes right for you Almost all webapps we write, we write them this way. (on orac
by y0ghur7_xxx 13y ago
> To attempt this security model, which can work if everything in the universe goes right for you
Almost all webapps we write, we write them this way. (on oracle, not postgres, but that makes no difference).
> your application needs to be designed for it from the very beginning.
That's true. As in "you can not add security later on".
- tptacek 13y agoNo, that's not what I said. I didn't say you "can't add security later on". I said that you can't rely on database access control configuration to protect an application that hasn't been designed from scratch to do that. Most applications don't rely on database access control; they rely on the application server to protect the database.
- einhverfr 13y agoJust because the application assumes it is trusted by the database doesn't mean the database has to trust the application.
- ako 13y ago15 years ago, in client-server Era, relying on database Access control was the default. It's a shame that all that knowledge has mostly been forgotten, and most programmers don't actually know how to use a database.
- wila 13y agoThat works as long as the database server is kept up to date with security patches. Quite often in production running a security patch is not high priority. I guess it all depends on using this feature as an additional layer of protection or using it as the only layer of protection.