PostgreSQL

14 Jun 2025 12:31

There's databases of passwords and their relative hash widely available, if you add a "salt" to your hash it means all those hashes are not valid against your database

PostgreSQL

14 Jun 2025 12:29

Isnt salt just another layer of protection? Why shouldn’t just hash be working?

PostgreSQL

14 Jun 2025 12:27

Whatever, things is - you need to store it

PostgreSQL

14 Jun 2025 12:26

Almost, but you need column for salt as well and optionally for hash params like work factor, iteration count etc (it could be random per credential or stored somewhere in the app as constant). Pick some unusual numbers, e.g. instead of round 300000 iterations of pbkdf2, pick 436278 to prevent rainbow attacks

PostgreSQL

14 Jun 2025 12:15

https://www.postgresql.org/docs/current/pgcrypto.html#PGCRYPTO-PASSWORD-HASHING-FUNCS

PostgreSQL

14 Jun 2025 11:53

I mean, PostgreSQL does it itself, but it doesn't store a raw password, it stores a SHA-256 hash of it (or a salted MD5 hash).

As for being a server, a server is just a computer, but if you want to use it in production you might have issues with e.g. dynamic IPs, NAT, uptime, competing for resources, backup and reliability systems, etc.

PostgreSQL

14 Jun 2025 11:42

And can i use my pc as a server? In building an app on flutter so i guess i’ll need nodejs for API

PostgreSQL

13 Jun 2025 19:50

While checkpoints are one of the points at which WAL segments are released, a checkpoint does not *require* that they be released.

PostgreSQL

13 Jun 2025 17:50

Hello,

I've a question here regarding the replication slot.

If I have a logical replication slot and its state is false and it should be used by informatica_cdc user... although informatica able to capture and have the changes of the data, but still its logical replication slot is false...

my question is, if I have checkpoint timeout set, still the wal will ignore that parameter and keep or retain the wals for that slot until it states changed to true? I mean what is the precedence for here?

PostgreSQL

13 Jun 2025 07:30

Have any idea to install feature postgis 3.5 or latest plugin compatible with postges v17.5

PostgreSQL

11 Jun 2025 18:57

Vibe hacking PostgreSQL journey with Andrey and Kirk continues – going to finish the "log LSN on DROP TABLE" patch https://www.youtube.com/watch?v=t6T3GPjEiS4 -- it's live, join!

PostgreSQL

11 Jun 2025 17:11

Thanks, we migrate data from Oracle to postgres, when we migrate data on bytea column it's has limit by 1gb. When data greater than 1GB it's throw error that's why we choose OID Data type which suggested in ora2pg tool.

Please suggest if you have any alternative solution

PostgreSQL

11 Jun 2025 10:25

I tried using autohotkey & working perfectly

Thanks for help

PostgreSQL

11 Jun 2025 10:02

Hey,
I'd love your input about which pgsql extensions are trending right now and provide great value or essential for general usage and administrative purposes.
I have check all that can be found inside the 'contrib' and some popular ones such as pgvector.

Thanks

PostgreSQL

11 Jun 2025 09:03

Hello All,

I need some clarification regarding the cleanup of large objects (LOBs) in PostgreSQL. We are currently migrating data from Oracle to PostgreSQL using ora2pg. For BLOB data, we are using the OID data type instead of bytea due to size limitations and performance considerations.
During the migration, if the process fails midway, some large objects might already be committed to the database. When we re-run the migration, it results in additional large objects being created, thereby consuming more disk space.

I would like to understand:

What is the best approach to safely remove large objects associated with a specific table ?

Can vacuumlo be used in this scenario to clean up orphaned large objects, and are there any risks or precautions we should be aware of?

PostgreSQL

14 Jun 2025 12:31

Because if you only hashed then rainbow tables would work

PostgreSQL

14 Jun 2025 12:27

The algorithms in crypt() differ from the usual MD5 or SHA1 hashing algorithms in the following respects:

They are slow. As the amount of data is so small, this is the only way to make brute-forcing passwords hard.

They use a random value, called the salt, so that users having the same password will have different encrypted passwords. This is also an additional defense against reversing the algorithm.

They include the algorithm type in the result, so passwords hashed with different algorithms can co-exist.

Some of them are adaptive — that means when computers get faster, you can tune the algorithm to be slower, without introducing incompatibility with existing passwords.

PostgreSQL

14 Jun 2025 12:26

A decent algorithm will store every parameter in the hash itself and also upgrade the hash algorithm as computers get faster

PostgreSQL

14 Jun 2025 12:22

So basically frome what i’ve read i can create a table with
Serial
Email
Password plain text
But that password is hashed before inserted into the table

PostgreSQL

14 Jun 2025 12:12

https://cheatsheetseries.owasp.org/cheatsheets/Password_Storage_Cheat_Sheet.html

PostgreSQL

14 Jun 2025 11:53

Do not store the plaintext password but rather a hash. There's plenty of libraries (some work on postgresql too) that let you do it safely.

PostgreSQL

14 Jun 2025 11:42

Im new to postgresql and i wanna l ow, is it a good practice to store a password in the database? Or shoukd i rely on other services?

PostgreSQL

13 Jun 2025 19:50

PostgreSQL will hold on to WAL under several circumstances:
* wal_keep_size
* If it needs those WAL segments to catch up a replication slot.
** Exception: if max_slot_wal_keep_size has been reached for that particular slot.
* If there is an archive_command set, and it has returned an error (or not been called yet) on a particular WAL segment, and,
* If it needs it for crash recovery (that usually means back to the checkpoint before the most current one).

PostgreSQL

13 Jun 2025 08:46

hello I have table, when select pg_stat_user_tables it shows
n tup ins : 0
n tup upd:0
n tup del: 0
n live tup: 250M
n dead tup: 5M

about this table, how its could be, which dml operation does not update statistics?

PostgreSQL

13 Jun 2025 01:03

Did anyone configured report for all servers under balckout in pem repository database using sql script ? I am able to write script to get all servers under blackout using server table but not able to get details when was blackout started. I am using pem 9.5.1. Thank You

PostgreSQL

11 Jun 2025 18:35

implement chunked storage by yourself (1000-byte chunks is a good size).
Something ilke TOAST, just handwritten. A table with description, a probably partitioned table(s) for file chunks...

Or just don't store files in RDBMS, put them in S3.

PostgreSQL

11 Jun 2025 10:25

Working fine using autohotkey

PostgreSQL

11 Jun 2025 10:06

Also, just don't. Your architect is probably a newby in postgres.

Large objects are mostly considered obsolete and retained mostly for compatibility reasons.

PostgreSQL

11 Jun 2025 09:13

vacuumlo is basically your way to go, yes. If you only have a single table with OIDs, you can probably get away with a DELETE [...] WHERE NOT EXISTS on pg_largeobject as well, which might be quicker.

PostgreSQL

11 Jun 2025 09:00

whitelist this through pg_hba file