The discussion centers on whether a Postgres type-confusion vulnerability constitutes Remote Code Execution (RCE) or a more limited privilege escalation, given that exploitation requires existing authenticated access. Participants disagree on the severity and scope, with some arguing it is a serious RCE affecting exposed instances while others classify it as an internal lateral movement vector or ACE.
29 readable replies · Supporting reply 1 · Supporting reply 2 · Supporting reply 3 · Supporting reply 4Abstrct
Schemaverse
PLpgSQL2021–2026
Abstrct / Schemaverse
Schemaverse
The Schemaverse is a space-based strategy game implemented entirely within a PostgreSQL database. Compete against other players using raw SQL commands to command your fleet. Or, if your PL/pgSQL-foo is strong, wield it to write AI and have your fleet command itself!
3Distinct people
6Mentions
0Explicit recommenders
442GitHub stars
What to know before exploring
What it is
The Schemaverse is a space-based strategy game implemented entirely within a PostgreSQL database. Compete against other players using raw SQL commands to command your fleet. Or, if your PL/pgSQL-foo is strong, wield it to write AI and have your fleet command itself!
GitHub
Where it is used
No documented product use was verified in the last source check.
What people are saying
No recommendation phrase was found in the indexed comments.
Informational One commenter mentions the schemaverse repository as an example of pushing authentication and access control into a database engine. The comment describes this approach as 'sort of neat' but notes that security attacks were half-expected.
What changed this week. Read the supporting reply
Also in these discussions
No other repository is repeatedly linked in the same discussions.
This week on Hacker News
Informational
One commenter mentions the schemaverse repository as an example of pushing authentication and access control into a database engine. The comment describes this approach as 'sort of neat' but notes that security attacks were half-expected.
Supporting reply 1 · 1 discussions summarized
Nov 8–Nov 15 UTC · Direct repository links and separately labeled related project stories. Indexed through 11/15/2026, 6:36:16 PM UTC.
Mentions over time
HN mentions by year6 dated mentions
Observed mentions: 2021-11-29 05:02:08 UTC to 2026-07-10 22:37:24 UTC.
* An incomplete calendar period is marked with an outlined bar. Its count is not directly comparable with a full period.
Counts come from the repository’s dated source evidence. Index cutoff: 2026-11-02 08:16:59 UTC.
View mention counts and date ranges
| Period | Start (UTC) | End (exclusive, UTC) | Mentions | Submissions | Comments |
|---|---|---|---|---|---|
| 2021 | 2021-01-01 00:00:00 UTC | 2022-01-01 00:00:00 UTC | 2 | 0 | 2 |
| 2022 | 2022-01-01 00:00:00 UTC | 2023-01-01 00:00:00 UTC | 0 | 0 | 0 |
| 2023 | 2023-01-01 00:00:00 UTC | 2024-01-01 00:00:00 UTC | 0 | 0 | 0 |
| 2024 | 2024-01-01 00:00:00 UTC | 2025-01-01 00:00:00 UTC | 1 | 0 | 1 |
| 2025 | 2025-01-01 00:00:00 UTC | 2026-01-01 00:00:00 UTC | 2 | 0 | 2 |
| 2026 (partial) | 2026-01-01 00:00:00 UTC | 2027-01-01 00:00:00 UTC | 1 | 0 | 1 |
What Hacker News says
2 sourcesSOsomat·Jul 24, 2025
Not quite the same, but for a toy application I was building I had one of those terrible/clever ideas "hey the database has this elaborate comprehensive permission system, Why not have that be my applications permission system as well"
So every user is a database user and if the database sez they can view the data then they can view the data. And for my use case it worked surprisingly well.
I will note note that I think this is generally a bad idea, I have heard that the postgres role data structures scale poorly. and I personally would be terrified to expose a database to a potentially hostile environment.
See also: the schemaverse a game where you directly interface with the db server. https://github.com/Abstrct/Schemaverse
In SQL Injection as a FeatureThere is an interesting project https://github.com/Abstrct/Schemaverse where the whole game takes place entirely within a postgres database that the players connect directly to.
The author discovered quite a few... well lets just call them policy errors in postgres, but had a hard time filing bug reports, mainly because the response was usually an incredulous "why on earth would you even do that in the first place?.
But the author has fun with this, There is a trophy in the game that you can only get by putting your name in the trophy table.
In Hidden Messages in Emojis and Hacking the US Treasury