From: Ron <ronljohnsonjr@gmail.com>
To: pgsql-admin@lists.postgresql.org
Subject: Re: Query on User account password change details
Date: Fri, 7 May 2021 08:55:15 -0500
Message-ID: <1d0196b7-01e2-e979-e023-d684331db8ea@gmail.com> (raw)
In-Reply-To: <DFC3EF54-3AA9-468A-9537-431970DE1B3A@elevated-dev.com>
References: <CAPOO3u4cxoCmJsXJaMHCLavecb-Bc77=qh=dfQN+bbYJ6gneWA@mail.gmail.com>
<90B6B3A1-BB95-4D69-99EF-D86C0A859431@jakobs.com>
<4e87a433-531f-d108-4ef6-0c54ba44f587@gmail.com>
<DFC3EF54-3AA9-468A-9537-431970DE1B3A@elevated-dev.com>
On 5/7/21 7:30 AM, Scott Ribe wrote:
>> On May 6, 2021, at 11:40 PM, Ron <ronljohnsonjr@gmail.com> wrote:
>>
>> Comments like this are indicative of someone who's never been through an external audit.
> While maybe true, the point stands that even the original source of the requirement has admitted it's a bad idea, and standards bodies are dropping it. So, unlike many other things we might consider pointless, with this one, you have the kind of defense that might work in an audit.
The problem is that Postgresql allows Really Short Passwords without
uttering a peep, and that's not defensible to an auditor.
psql (12.5 (Ubuntu 12.5-1.pgdg18.04+1))
Type "help" for help.
postgres=# create role foo password 'a';
CREATE ROLE
postgres=#
--
Angular momentum makes the world go 'round.
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Reply to all the recipients using the --to and --cc options:
reply via email
To: pgsql-admin@postgresql.org
Cc: ronljohnsonjr@gmail.com, pgsql-admin@lists.postgresql.org
Subject: Re: Query on User account password change details
In-Reply-To: <1d0196b7-01e2-e979-e023-d684331db8ea@gmail.com>
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
This inbox is served by DDX for PostgreSQL; see mirroring instructions
for how to clone and mirror all data and code used for this inbox