Re: Safe security - Mailing list pgsql-hackers

From Tom Lane
Subject Re: Safe security
Date
Msg-id 19881.1268068454@sss.pgh.pa.us
Whole thread Raw
In response to Re: Safe security  ("David E. Wheeler" <david@kineticode.com>)
Responses Re: Safe security
Re: Safe security
List pgsql-hackers
"David E. Wheeler" <david@kineticode.com> writes:
> On Mar 8, 2010, at 8:03 AM, Tom Lane wrote:
>> #3 is still an absolute nonstarter, especially for a patch that we'd
>> wish to backpatch.

> You're at least going to want to exclude Safe 2.20 - 2.23, IIUC.

If those aren't versions that are likely to be in wide use, no objection
to that.  I'm just concerned about arbitrarily breaking existing
installations.  I note that Fedora 11 and OS X 10.6.2 are providing Safe
2.12, which means the proposed patch would break plperl on every machine
I have, without easy recourse --- I am not likely to install a private
version of Safe under either OS, and I doubt many other PG users would
wish to either.  The net effect would be to prevent PG users from
upgrading until the OS vendors get around to issuing new versions,
which is not helpful.  Particularly if the vendor chooses to back-patch
Safe security fixes without bumping the visible version number, as is
not unlikely for Red Hat in particular.
        regards, tom lane


pgsql-hackers by date:

Previous
From: Hitoshi Harada
Date:
Subject: Re: SQL compatibility reminder: MySQL vs PostgreSQL
Next
From: Robert Haas
Date:
Subject: Re: SQL compatibility reminder: MySQL vs PostgreSQL