Hacker News Reader

Comment by noodlesUK | Hacker News Reader

I don’t understand the purpose of this. If what’s being said is true, alter system being disabled wouldn’t prevent the super user from doing all the same things as alter system but in a less convenient way. It will just give people a false sense of security, because they can abuse COPY to overwrite the config.

View on HN

See my comment at https://news.ycombinator.com/item?id=40107325 for the use case.

It is a safety feature that can help avoid people getting confused when working in a containerized environment. It is not a security feature at all. Nor is it intended to be. It is meant so that people like me can set up a configuration that will work better for coworkers who know less about databases than I do.

Then surely the answer should be that there should be a config setting that disables it, with the option to do something like "WITH FORCE" which would force enable it in the environment even with that config setting enabled. This gives the best of both worlds, in that it stops people from copying blindly from Stack Overflow, but doesn't give the sense of security that it initially seems to imply.

Yes, lots of people had ideas about this should work. Exactly like you just did. Unfortunately they had different ideas. And that's why there was months of debate over how this feature should work before something was accepted.

Just to give one example of an obvious problem with your idea, saying "WITH FORCE" will suggest to some that this configuration setting is somehow forcibly maintained. This is likely to generate bug reports based on that misunderstanding. "I said WITH FORCE and it is easy to get around!" And, worse yet, questions about, "Why do we have a security feature that doesn't provide any security?"

Then it'd be very purposeful, the idea of this kind of patch would be that someone Googling random older PG answers to fix a random issue wouldn't be tempted to just issue an ALTER command, think the issue is fixed and then find out after a restart/rebuild that the fix is not there any more.

This not a security patch but more of a safeguard against hapless idiots manhandling themselves without resistance in an unsupported case.

As a comment on the LWN article noted, it might be better to think of it as a safety feature, not a security feature.

Reply on news.ycombinator.com