Hacker Newsnew | past | comments | ask | show | jobs | submitlogin

“But how in the world is it okay for Oracle to throw me for a loop as I try to pinpoint why the existing grants aren’t sufficient, debugging the whole program to see which user credentials are used – only to find out that it was neither a table nor a view, but rather the SEQUENCE used to increment the ID column that needed grants for the user?“

Probably a security issue. If you tell a user”“table T exists, but you don’t have rights to write to it because you can’t increase sequence S”, you’re leaking the information that a sequence with that name exists.

It’s the same reason a good login system will say “invalid username or password” instead of “invalid password” and its recovery screen “if that’s a valid user name, a mail has been sent to the address associated with it”.



Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: