Scaling Postgres Episode 58 | Security Concerns | Fast Counting | Indexing | Trends
Source: YouTube · Scaling Postgres · published Apr 8, 2019 · 19:02
This episode of Scaling Postgres covers the debate around CVE-2019-9193, emphasizing that granting superuser privileges is often the real security risk, while also reviewing performance tips for COUNT(*), indexing strategies, and current PostgreSQL usage trends 0:24-2:018:53-9:0613:13-13:21.
Key Takeaways:
• The PostgreSQL team clarified that CVE-2019-9193 is not a vulnerability but a design choice; the COPY command's power requires superuser access, which implies full OS permissions, so superuser rights should never be granted to untrusted users or applications 0:24-2:01.
• Security experts recommend mitigating risks by avoiding superuser access for apps, using pg_hba.conf to restrict remote superuser logins, and employing long random passwords with SSL connections to prevent brute force and man-in-the-middle attacks 2:04-3:363:38-5:03.
• COUNT(*) is slow in PostgreSQL due to MVCC; alternatives include index-only scans, maintaining separate counter tables via triggers, or using estimated row counts from system tables if exact precision isn't required 8:53-9:2411:01-11:16.
• For performance tuning, indexes are not free and should be used for retrieving small data subsets, whereas sequential scans are better for large portions of a table 12:18-12:52.
• Recent trends show a significant migration to public clouds, particularly AWS, while community discussions highlight advanced features like partitioning, JSONB usage, and logical replication for upgrades 13:13-13:2114:23-15:3417:58-18:18.
The episode underscores the importance of security best practices regarding superuser privileges and offers practical advice for query optimization and modern PostgreSQL deployment strategies.
Sources:
Generate CPE Credits
Generate a professional CPE document from this video's transcript.
Estimated credit: 0.5 CPE hours
Estimate uses the video runtime (1 hour ≈ 1 CPE, rounded to the nearest 0.5, minimum 0.5, maximum 2.0). The final amount can be lower after review, never higher.
Topic: Cybersecurity. Commonly maps to: Security and Risk Management, Security Operations. Exact CISSP domains are assigned during generation.
Free account. One generation at a time, with a daily limit.
CPEBuddy is independent and not affiliated with or endorsed by ISC2, ISACA, or any certification body. Exports are formatted for common CPE submissions; acceptance is at your certification body's discretion.
Transcript Preview
First 800 characters of the transcript
in this episode of scaling post grows we talk about security concerns fast counting indexing and trends I'm Kristen Jameson and this is scaling Postgres episode 58 [Music] all right I hope everyone's having a great week our first piece of content is a bit of news from PostgreSQL org and it says CVE 2019 91 93 not a security vulnerability and apparently they say that there's been widespread mention of a security vulnerability in PostgreSQL and it was registered this CBE number however the PostgreSQL team believes that this is not a security vulnerability is just how it was designed and specifically it's talking about the copy command which allows you to import and export data from a PostgreSQL table for example to a file but to a program it allows you to run a program and pipe the output fr…