Re: Monitoring roles patch

Greetings,

* Mark Dilger (hornschnorter(at)gmail(dot)com) wrote:
> The inability to revoke access to this sort of information being proposed
> makes me a bit uneasy.

What data are you concerned about, specifically?

> Mostly, I think, I'm bothered because there may
> be people who have revoked privileges on a lot of things, thereby restricting
> access to superuser, who won't necessarily notice this new feature in
> postgres 10. That could be a source of security holes that we get blamed
> for.

There is no access granted by adding this role without an admin granting
access to this role to some other user. If they make incorrect
assumptions about what granting access to this role means then I'm
afraid that's their issue, not ours.

> Please note that I'm not specifically opposed to this work, and see a lot
> of merit here. I'm just thinking about unintended consequences.

Certainly, good to think of, but I don't believe there's a concern here.

Thanks!

Stephen