Postgres 9.1 - Release Theme

Following a great deal of discussion, I'm pleased to announce that the PostgreSQL Core team has decided that the major theme for the 9.1 release, due in 2011, will be 'NoSQL'.

There is a growing trend towards NoSQL databases, with major sites like Twitter and Facebook utilising them extensively. NoSQL databases often include multi-master replication, clustering and failover features that have long been requested in PostgresSQL, but have been extremely difficult to implement with SQL which has prevented us from advancing Postgree in the way that we'd like.

To address this, the intention is to remove SQL support from Postgres, and replace it with a language called 'QUEL'. This will provide us with the flexibility we need to implement the features of modern NoSQL databases. With no SQL support there will obviously be some differences in the query syntax that must be used to access your data. For example, the query:

select (e.salary/ (e.age - 18)) as comp from employee as e where e.name = "Jones"

would be rewritten as:

range of e is employee retrieve (comp = e.salary/ (e.age - 18)) where e.name = "Jones"

Aggregate syntax in QUEL is particularly powerful. For example, the query:

select dept,

avg(salary) as avg_salary,

sum(salary) as tot_salary

from

employees

group by

dept

may be written as:

range of e is employee

retrieve (e.dept,

avg_salary = avg(e.salary by e.dept),

tot_salary = sum(e.salary by e.dept)

)

Note that the grouped column can be specified for each individual aggregate.

We will be producing a comprehensive guide to the QUEL syntax to aid with application migration. We appreciate the difficulty that this change may cause some users, but feel we must embrace the NoSQL philosophy in order to remain "The world's most advanced Open Source

database"

"There's no question that, at 21 years old, the SQL standard is past its prime," said core developer and standards expert Peter Eisentraut. "It's time for us to switch to something fresher. I personally would have preferred XSLT, but QUEL is almost as good."

Project committer Heikki Linnakangas added: "By replacing SQL with QUEL not only will will be able to add new features to Postgres that were previously too difficult, but we'll also increase user loyalty as it'll be much harder for them to change to a different, SQL-based

database. That'll be pretty cool."

You may also notice that without SQL, the project name is somewhat misleading. To address that, the project name will be changed to 'PostgreQUEL' with the 9.1 release. We expect this will also put an end to the periodic debates on changing the project name.

Dave Page

On behalf of the PostgreSQL Core Team

Getting ready for PG East

After a stressful few weeks keeping a close eye on the BA cabin crew strike, it seems that my flight is still scheduled so I will be able to get to Philadelphia for PG East 2010 without having to use my insanely expensive refundable backup ticket with US Airways.

This years conference is in a new format, spread over three days with a fourth day of tutorials on the schedule, all at the rather nice Radisson Plaza-Warwick Hotel in Philly, courtesy of my boss' budget here at EnterpriseDB (OK, I'm done with the shameless company plugs :-p ). The schedule includes a good mix of topics with varying levels of technical detail for geeks through IT/IS management.

I'll be presenting a new talk in which I'll describe the infrastructure behind postgresql.org, and how it's managed. If you've not been closely involved in a large Open Source project, you may be surprised at just how much there is - certainly far more than a webserver and mailing lists which are probably the most visible things.

Anyway - I'm speaking on Thursday, so if you can get to Philly, it'd be great to see you there.

PostgreSQL Europe opens for general membership

After numerous emails, meetings in foreign lands and changes to the statutes, PostgreSQL Europe finally opened it's doors to new members today, of which I became the very first. Well, OK, technically I'm the fifth, as the elected board made up the first four, but I was the first non-elected, fee paying member.

So 'what's the point?' I hear you cry, and 'why should I part with my hard-earned cash?'. Well, joining PostgreSQL Europe costs €10 for 2 years membership, which is a fraction of what some other groups charge. You won't get a postgresql.eu email address for your money, but you do get the chance to vote for PostgreSQL Europe board members of your choosing, at the annual elections. Those four board members (who will become five after the upcoming elections) decide what events and activities the not-for-profit organisation will be involved in, and how to spend the money - what events should be sponsored, what swag should be purchased and so on.

Membership is open to anyone resident in geographical Europe (including all of Turkey and Russia), so if you want to join and play a part in the future of PostgreSQL, you can sign up on the postgresql.eu website. Don't leave it too long though - you need to be a member for at least a month to be eligible to vote in future elections.

PostgreSQL - now with added Open Source!

Some of you may be aware that some time ago, Redhat's legal team changed the description of the PostgreSQL licence (yes, that is correct where I live - please don't email me to tell me I can't spell) from BSD to MIT. After doing some poking around (it helps when your boss's boss is an ex-Redhat exec) it transpired that they considered that our licence looked a lot more like the MIT licence than BSD.

It's true that ours doesn't look like the traditional BSD 3 or 4 clause licences - some people had already spotted that, but as it came from Berkeley we always just considered it to be a variant on the simplified BSD licence. The long and short of it was that lawyers said "no they're not the same", and we said "well it sure ain't MIT" and much discussion ensued.

The solution it seemed, was to try to get our licence recognised and approved by the Open Source Initiative. I originally tried to do it as an official BSD variant, but that wasn't accepted. I then resubmitted it as 'The PostgreSQL License" (yes, I know :-p), which was rejected as it wasn't a generic licence (OSI are trying to ensure that all new licences are resuable). Finally, I submitted it again with placeholders replacing the project name and copyright holder info, and nearly two months later, it's approved!

So there you have it ladies and gents. "The world's most advanced database with freely available source code" now actually is, officially, The world's most advanced Open Source database"!

Speaking at PG East

If you've been involved in the PostgreSQL project at all in the last few years, you'll know that Josh Drake has been organising the PG East and PG West conference series since 2007. When we met in Paris at PGDay.EU, JD suggested that I submit a talk for East in March.

Which I did.

Which got accepted.

So now I'm travelling to Philadelphia in March :-)

Since we spoke though, the crack marketing team here at EnterpriseDB contacted JD and between them hatched a plan to make East the most impressive PostgreSQL conference to date. It'll be held over four days, at the Radisson Plaza - Warwick Hotel in Philadelphia, from March 25th to 28th and will include content for C-level execs and decision makers, as well as the regular crowd of database geeks like me. Of course, there will also be the traditional EnterpriseDB Party on the Friday night - if you haven't been to one of those yet, now's the perfect time to see what you've been missing out on!

So if you've been toying with the idea of going to a PostgreSQL conference, this is the perfect time to give into the urge and join us in Philly for database talk, beer and cheese-steak sandwiches. Mmmmm, cheese-steak....

FOSDEM 2010

Well, FOSDEM 2010 is now over and it all seemed to go pretty well. The PostgreSQL Project was represented well (as one would hope for our second biggest annual European gathering), with the majority of the Hotel Agenda Louise seemingly occupied by database geeks.

On the Friday night we had a database dinner at Les Brasseurs de la Grand Place where we were joined by Sergey Petrunya and Kristian Nielsen from MariaDB. Good conversation, good beer and good food followed later by an aborted attempt to join the FOSDEM Beer Event at Cafe Delirium (it was just too busy) and a successful landing at the Irish pub a short walk from the Hotel.


Saturday morning was the start of the conference itself. We'd hoped to scrounge an extra table (much needed, with the number of people and the amount of swag we had), but unfortunately that didn't work out. Somehow, we managed to squeeze onto one.


The talks started at 1PM in our dev room (which we only had for Saturday afternoon unfortunately). Magnus and Jean-Paul started with report on the state of PostgreSQL Europe, and then it was my turn with my talk on "Developments in PostgreSQL 9.0". Slides and the full schedule can be found on the PostgreSQL Wiki. The dev room was basically packed solid with people sitting on the floor for every talk. Please FOSDEM organisers - give us a bigger room next year!


Saturday night was a late dinner at possibly the slowest restaurant in the world, who clearly weren't expecting too many diners. Food wasn't too bad though, when it finally arrived.

Sunday was spent mostly on the booth and (in my case) in lots of ad-hoc meetings on topics such as the new PostgreSQL project infrastructure thats in development, as well as PGDay.EU 2010 which is being planned in Amsterdam.

Most of us left at around 5PM, with Heikki, Greg, Magnus, Stefan and I heading for the airport. After pizza and a brief scare when Stefan lost his boarding pass, we left for home. Goodbye Brussels, see you next year.

More photos can be found here.

Kerberos support in PostgreSQL on Windows

We recently received a report of some automated security scanning software red-flagging the Kerberos DLLs that ship with the PostgreSQL installers for Windows. This blog post is an analysis of the impact of know vulnerabilities in Kerberos, and how they relate to PostgreSQL, and what we're doing about them.

PostgreSQL 8.3.x and 8.4.x

PostgreSQL 8.3 and 8.4 are built using Kerberos for Windows (KfW) 3.2.2 which is based on the Kerberos 1.6.3 package. This is the latest version of Kerberos for Windows that is currently available from MIT.

The vulnerabilities that were reported by the security scanning tool were:

CVE-2008-0062 and CVE-2008-0063. These are bugs in the KDC server which are exposed if Kerberos 4 is enabled on a v5 KDC. As we don't ship the KDC software with PostgreSQL, these bugs do not apply.

CVE-2008-0947 and CVE-2008-0948. These are bugs in kadmind, the Kerberos Administration Server. We don't ship this either, so like the previous bugs, these do not apply to PostgreSQL.

What the scanning tool didn't report, was a fifth vulnerability which does potentially affect PostgreSQL users:

CVE-2009-0846. This issue is described as: The asn1_decode_generaltime() function, which decodes DER encodings of the ASN.1 type "GeneralizedTime", can free an uninitialized pointer. This can cause a Kerberos application to crash, or, under theoretically possible but unlikely circumstances, execute arbitrary malicious code.

As mentioned above, we currently ship the latest version of Kerberos with PostgreSQL. As soon as MIT update the Kerberos for Windows package to include Kerberos 1.6.4 (which does not have this issue), we will update the PostgreSQL build servers.

PostgreSQL 8.2.x

PostgreSQL 8.2 is built using Kerberos for Windows (KfW) 2.6.5 which is based on the Kerberos 1.3.5 package. This is the most recent version of Kerberos for Windows v2.6.x that is available from MIT and is no longer being maintained.

This version of Kerberos is believed to be vulnerable to the issue noted above (CVE-2009-0846), as well as CVE-2005-1689, which describes a double-free bug in the krb5_recvauth function (but was not noted by the scanning tool that started this exercise)!

Updating Kerberos for Windows to version 3.2.2 in the PostgreSQL 8.2 distribution is the only way we can work around this issue, however, this is not as simple as it might sound as the distribution has changed in structure thus requiring modifications to the PostgreSQL installer to accommodate additional DLLs as well as any application installers that our users may have built around their libpq-based applications.

Because of the potential disruption to users and software developers for the sake of a feature used by such a small percentage of users, we have decided not to update the PostgreSQL 8.2 installer with the newer Kerberos packages but instead to recommend users of PostgreSQL 8.2 on Windows who wish to use Kerberos plan to upgrade their installations to PostgreSQL 8.3 or 8.4 as soon as possible.