Salutations

[Al Snell]

On Sun, 10 Dec 2000, David Merrill wrote:

> I know plenty about databases, but only bits and pieces about
> security. Hopefully between us and others on the project we'll get it
> done right.

Have no fear! I do both databases and security. If I don't come back with
a security statements about any proposal that comes up (be it a good or
bad security statement :-) please hassle me until I do!

Basically, we can't really rely on database-side access control (eg,
GRANT/REVOKE stuff from the SQL standard) - it's not granular enough. For
multiuser access we need either trusted clients (possibly a fair enough
restriction...) or middleware.

Middleware is what I would endorse. Especially since we could run it
through CORBA and interoperate with other systems beautifully.

However, I don't know what level of security ORBit supports, or even if it
will do proper IIOP for networked operation - RTFM time I guess :-)

ABS

-- 
                               Alaric B. Snell
 http://www.alaric-snell.com/  http://RFC.net/  http://www.warhead.org.uk/
   Any sufficiently advanced technology can be emulated in software