Re: Heroku early upgrade is raising serious questions - Mailing list pgsql-advocacy

From Michael Meskes
Subject Re: Heroku early upgrade is raising serious questions
Date
Msg-id 20130409095412.GB16657@feivel.credativ.lan
Whole thread Raw
In response to Re: Heroku early upgrade is raising serious questions  ("Jonathan S. Katz" <jonathan.katz@excoventures.com>)
List pgsql-advocacy
On Mon, Apr 08, 2013 at 06:58:57PM -0400, Jonathan S. Katz wrote:
> In this specific case, DBaaS providers were exposed to a bug that is
> relatively easy to exploit with potentially dire consequences that could
> potentially ruin many, many businesses (I do not want to give a bad estimate,
> so I won't provide a number).  Let's say this horrible scenario happened:

So you're saying we make it dependant on how many business critical
installations a provider runs? In theory that makes a lot of sense, but in
reality I fail to see how to do this.

> sure, people could say that a DBaaS provider did not adequately secure their
> system, but fingers could also be pointed at the community for a) having a
> security hole in the first place (as ludicrous as that sounds to us as we
> know that software is flawed AND Postgres has an *excellent* track record for
> security) and b) not recognizing the damage that could be caused by not
> permitting systems considered to be "critical infrastructure" early access to
> a fix.

How about a big corporate user where PostgreSQL is the backbone? Wouldn't look
good for us either, but not being a DBaaS provider they are not in our focus
here. Makes me wonder why.

Michael
--
Michael Meskes
Michael at Fam-Meskes dot De, Michael at Meskes dot (De|Com|Net|Org)
Michael at BorussiaFan dot De, Meskes at (Debian|Postgresql) dot Org
Jabber: michael.meskes at gmail dot com
VfL Borussia! Força Barça! Go SF 49ers! Use Debian GNU/Linux, PostgreSQL


pgsql-advocacy by date:

Previous
From: damien clochard
Date:
Subject: Re: Heroku early upgrade is raising serious questions
Next
From: Michael Meskes
Date:
Subject: Re: Heroku early upgrade is raising serious questions