pg_anon Open-Source Tool Receives Major Updates for PostgreSQL Data Masking and Partial Database Operations
pg_anon, an open-source tool developed by Tantor Labs for masking personal data in PostgreSQL, has received significant updates over the past year. The new version 1.11.0 introduces packaging as a standard Python package, support for partial database dumps and restores, enhanced handling of complex schemas, and a REST API for automation.
The tool addresses a common challenge in organizations that need to create copies of production databases for developers, analysts, or contractors without exposing real personal data. Direct copying of production databases risks violating internal security policies and data protection laws such as 152-FZ and GDPR. pg_anon performs masking by replacing field values with plausible alternatives while keeping table structures and referential integrity intact, resulting in a pseudonymized dataset.
Installation and New CLI Structure
Installation now uses standard pip commands with optional dependency groups. Users can install the base package or add support for the REST API and development tools. Two commands are provided after installation: pg_anon for core operations and pg_anon_api for running the REST service. Each operation mode is now a separate subcommand, improving usability compared to the previous single-entry-point approach.
Partial Dump and Restore Capabilities
A major addition is support for partial dumps and restores. Administrators can specify tables to include or exclude using dictionary files passed via command-line options. The tool automatically collects DDL for dependent objects such as custom types, domains, and functions to ensure successful restoration on a clean target database without manual pre-creation of supporting objects.
Performance and Schema Improvements
The dump engine was rewritten using asyncio instead of multiprocessing. Metadata collection now uses a single query instead of per-table connections, dramatically reducing preparation time on databases with thousands of tables. Compression was changed to a streaming model with lower gzip levels, eliminating memory leaks on large JSON-heavy tables. Support was added for partitioned tables, inherited tables, generated columns, identity sequences, and object names containing special characters.
REST API and Automation
The new REST API enables integration into automated pipelines. Standardized error codes, operation identifiers, custom headers, and log retrieval features support use in CI/CD systems that refresh masked database copies on a schedule without human intervention.
The release maintains backward compatibility with older command syntax while providing a more structured and extensible foundation for data masking workflows in regulated environments.
Related articles
Kaspersky Premium for macOS Gains App Uninstall Feature to Remove Residual Files
Kaspersky Premium now includes an App Uninstall tool for macOS that locates and deletes leftover files such as caches, cookies, settings, and logs after applications are removed. The feature also identifies duplicate copies of programs and lets users remove all instances or select specific ones while preserving shared components used by other software. Survey data from Kaspersky shows that only 44 percent of macOS users delete unused applications, even though 56 percent regularly clear browser data and 54 percent remove unwanted media files. Residual files can contain sensitive information including account tokens, passwords, IP addresses, event logs, and personal documents, creating privacy risks especially when a device is sold or accessed by unauthorized parties. Deleted files can be restored from the trash or directly within Kaspersky Premium before the application session ends. The company also warns that malicious programs are frequently disguised as legitimate macOS cleaning utilities.
Bypassing VPN Detection on iPhone: Detailed Methods to Avoid App Blocks
Many iPhone users encounter apps that detect and block active VPN connections even after switching servers or protocols. The detection often occurs locally on the device by inspecting network interfaces rather than relying solely on external IP addresses. This guide explains how apps identify VPN tunnels through iOS network data and provides practical workarounds including moving the VPN to a router, configuring per-app exclusions, and using web versions of services. It also covers why protocol obfuscation and port changes fail to hide local VPN activity from applications. Additional troubleshooting addresses automatic VPN profiles, ad blockers, and iCloud Private Relay interference. The article emphasizes that no universal toggle exists in iOS to hide an active VPN from all apps.
New Obfuscation Method Dissolves Personal Data Records in Layer of Plausible Variants
A Russian information security researcher has proposed a data protection technique that renders stolen personal records unusable even after full compromise. The approach mixes real data such as phone numbers, emails, passports, addresses, INN and SNILS with vast numbers of semantically valid alternatives. Attackers receive nearly complete information including a 361-character message containing PIN codes and word order, yet lack the secret vector space and reconstruction algorithm required to identify the correct record. Without these components, brute-force attempts produce millions of plausible results with no architectural method to verify accuracy. The method is presented as an alternative to traditional encryption when data must remain accessible yet protected against extraction. A public sandbox is available for testing the approach.
Hydrat Project Builds Automated WireGuard Gateway for Resilient VLESS and Tor Routing
A developer has released Hydrat, a self-hosted gateway that connects devices via WireGuard while automatically managing VLESS and Tor backends to survive server blocks and quality degradation. The system maintains a pool of tested proxies, performs continuous health checks, and switches routes without requiring client-side profile changes. Two Go processes handle control logic and network enforcement separately, using SQLite for state and nftables plus Xray for traffic routing. TCP and UDP can be assigned independent exits, with geoip.dat support and custom rules to keep marketplace apps functional. The project emphasizes stability over direct connections and is designed for deployment on servers in Russian jurisdiction.