Hacker News Reader

It doesn't specify whether pg_hba.conf is sufficient to protect against this, anybody have any word on that?

No, pg_hba.conf is not sufficient. I'll work on adding that to the FAQ.

I'm wondering this as well.