Re: [Gnumed-devel] security & architecture (was Re: Texlive and Gnumed)

[Karsten Hilbert]

On Wed, Mar 10, 2010 at 08:06:27AM +0100, Gour wrote:

> Otoh, the following comment in /etc/trytond.conf reveals why I am able
> to create database from login dialog: "db_user must have create
> permission for new databases to be able to use automatic database
> creation with the Tryton client."

Which does not have anything to do whatsoever with why any
odd user can *connect* to PostgreSQL in the first case
without any setting up of permissions.

> Moreover, as you can see from
> http://code.google.com/p/tryton/wiki/SSLHowto 
> 
> it is very easy to put SSL in use to secure communication.

Using SSL does not substitute access security.

SSL is enabled by default within GNUmed.

> GNUmed, afaict, is more MVC, client is not really thin and that's why
> it is not the same situation.

This got nothing to do with whether access is secure and
enabled by default.

Karsten
-- 
GPG key ID E4071346 @ wwwkeys.pgp.net
E167 67FD A291 2BEA 73BD  4537 78B9 A9F9 E407 1346