Regarding "Comparison of database operations-related capabilities"

[ccavitt]

Summary

There seems to be conflicting information on whether or not EPAS provides data masking. The Migration documentation indicates that EPAS does NOT provide data masking, however the EPAS documentation for the DBMS_REDACT package seems to indicate that it does.

Based on the EPAS documentation, it seems like it at least offers some kind of data masking.

Where did you see the problem?

https://github.com/EnterpriseDB/docs/blob/8f813057c808974551b03776c51978453c44335c/advocacy_docs/migrating/oracle/oracle_epas_comparison/operational_capabilities.mdx

and/or

https://www.enterprisedb.com/docs/epas/latest/reference/oracle_compatibility_reference/epas_compat_bip_guide/03_built-in_packages/13_dbms_redact/

Expected behavior

I don't know if there is more to take into consideration besides just the DBMS_REDACT package, but it seems like the migration document's table should list data masking for EPAS as yes - or at least partial.

Screenshots

Migration Doc:

EPAS Doc:

Browser / Platform

No response

Additional notes

No response

[gvasquezvargas]

@ccavitt Thanks for flagging this!

Looking at the table more closely, it's actually distinguishing two different Oracle capabilities that both get called "masking" in casual usage:

• Data masking (the row you saw as "No") refers to Oracle's static Data Masking and Subsetting pack — used to permanently scrub sensitive data when creating non-production copies of a database. EPAS doesn't have a direct equivalent to this.

• Data redaction (the very next row, marked "Yes ✓") is the dynamic, query-time masking of values as they're returned — this is what Oracle's own DBMS_REDACT package does, and it's exactly what EPAS's DBMS_REDACT package replicates.

So the table already gives EPAS credit for the capability DBMS_REDACT provides — it's just filed under "Data redaction" rather than "Data masking," since those are two separate rows for two separate Oracle features.

We agree the two rows sitting right next to each other with similar names is an easy place to get tripped up, especially since our own DBMS_REDACT documentation describes it as letting you "redact or mask" data, which blurs the line. What about a short clarifying note to the table to make that distinction explicit?