Hacker News Reader

Because queries like this will kill any db, and you don’t need any privileges

SELECT crypt( encode(digest(gen_random_bytes(1024), 'sha512'), 'base64'), gen_salt('bf', 20) )FROM generate_series(1, 1000000)

Wouldn't it be much easier to disable/restrict certain sql functions than do all of the http->sql mapping?

No, as there are countless ways to do the same. Whitelisting is more effective if your code is running on untrusted devices (frontend)

Postgres can limit queries to only given number of milliseconds.

Give me access to your PG with a user that has no privileges, can not run queries longer then X ms and see how easy it would be to DOS the db :)