Bryn Llewellyn <bryn@xxxxxxxxxxxx> writes: > I confess that I'm surprised by the choice of the default behavior. It seems to be at odds with the principle of least privilege that insists that you actively opt in to any relevant privilege. I'd be the first to agree that this behavior sacrifices security principles for convenience. However, it's not that big a deal in practice, because functions that aren't SECURITY DEFINER can't do anything that the caller couldn't do anyway. You do need to be careful about the default PUBLIC grant if you're making a SECURITY DEFINER function, but that's a minority use-case. (I wonder if it'd be practical or useful to emit a warning when granting permissions on an object that already has a grant of the same permissions to PUBLIC. That would at least cue people who don't understand about this behavior that they ought to look more closely.) regards, tom lane
