Re: [pg_hba.conf] publish own Python application using PostgreSQL - Mailing list pgsql-general

From John McKown
Subject Re: [pg_hba.conf] publish own Python application using PostgreSQL
Date
Msg-id CAAJSdjgCfV-ziJsDATkU7gY_wsAK4kvo1RZ6A8stJHBhi19ymg@mail.gmail.com
Whole thread Raw
In response to Re: [pg_hba.conf] publish own Python application using PostgreSQL  (John R Pierce <pierce@hogranch.com>)
Responses Re: [pg_hba.conf] publish own Python application using PostgreSQL  (Karsten Hilbert <Karsten.Hilbert@gmx.net>)
List pgsql-general
On Tue, Jul 7, 2015 at 12:10 AM, John R Pierce <pierce@hogranch.com> wrote:
On 7/6/2015 9:55 PM, c.buhtz@posteo.jp wrote:
On 2015-07-05 22:16 John R Pierce<pierce@hogranch.com>  wrote:
>at a bare minimum, a database administrator needs to create database
>roles (users) and databases for an app like yours.
The admin don't need to create the db. It is done by the application
(sqlalchemy-utils on Python3) itself.

an application should not have the privileges to do that.   you don't run your apps as 'root', do you?   why would you run them as a database administrator ?

​Trigger Warning (Thanks, Mallard Fillmore)

I agree with you on this. If I were a customer and some vendor said: "Oh yes, to run our product, you must configure your multi-user data base to disable passwords and run it as a DBA so that it can make schema changes on the fly", then I'd simply say "no sale". Of course, in regards to the schema, it would be proper to document what the DBA needs to do to set up the data base with the proper tables and other items. WRT to the data base userid and password, that, IMO, should be some sort of installation parameter, not "hard coded" into the code itself.

SQLite, which I guess the OP has decided to use, is a much better choice for _this_ application. IMO, it does not seem to "play well with others".


--
john r pierce, recycling bits in santa cruz

 
--

Schrodinger's backup: The condition of any backup is unknown until a restore is attempted.

Yoda of Borg, we are. Futile, resistance is, yes. Assimilated, you will be.

He's about as useful as a wax frying pan.

10 to the 12th power microphones = 1 Megaphone

Maranatha! <><
John McKown

pgsql-general by date:

Previous
From: Filipe Pina
Date:
Subject: Re: database-level lockdown
Next
From: John McKown
Date:
Subject: Re: pg_dump (PostgreSQL) 9.4.1 - delay in checking if file exists