Received: from malur.postgresql.org ([217.196.149.56]) by arkaria.postgresql.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_CBC_SHA1:256) (Exim 4.89) (envelope-from ) id 1hTzyI-00017B-Eq for pgsql-hackers@arkaria.postgresql.org; Fri, 24 May 2019 02:30:14 +0000 Received: from localhost ([127.0.0.1] helo=malur.postgresql.org) by malur.postgresql.org with esmtp (Exim 4.89) (envelope-from ) id 1hTzyH-0007yh-6O for pgsql-hackers@arkaria.postgresql.org; Fri, 24 May 2019 02:30:13 +0000 Received: from makus.postgresql.org ([2001:4800:3e1:1::229]) by malur.postgresql.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_CBC_SHA1:256) (Exim 4.89) (envelope-from ) id 1hTzyG-0007ya-Qh for pgsql-hackers@lists.postgresql.org; Fri, 24 May 2019 02:30:12 +0000 Received: from tamriel.snowman.net ([2001:470:e38f::11]) by makus.postgresql.org with esmtp (Exim 4.89) (envelope-from ) id 1hTzyE-0005L3-4n; Fri, 24 May 2019 02:30:11 +0000 Received: by tamriel.snowman.net (Postfix, from userid 1000) id 510375F79F; Thu, 23 May 2019 22:30:09 -0400 (EDT) Date: Thu, 23 May 2019 22:30:09 -0400 From: Stephen Frost To: Tom Lane Cc: "Jonathan S. Katz" , Peter Eisentraut , pgsql-hackers , Noah Misch , Magnus Hagander Subject: Re: initdb recommendations Message-ID: <20190524023009.GL2480@tamriel.snowman.net> References: <20190406180839.GA1921989@rfd.leadboat.com> <96389374-9454-d26d-6f79-7c7b15ec14bd@2ndquadrant.com> <81b36e8b-e27b-ab5d-c4f0-6493771bc0ee@postgresql.org> <9f46f065-ca80-f637-8c5d-a9877bcd5eab@postgresql.org> <10093.1558664907@sss.pgh.pa.us> MIME-Version: 1.0 Content-Type: multipart/signed; micalg=pgp-sha512; protocol="application/pgp-signature"; boundary="2WS97oupGEGbYNpW" Content-Disposition: inline In-Reply-To: <10093.1558664907@sss.pgh.pa.us> User-Agent: Mutt/1.5.24 (2015-08-30) List-Id: List-Help: List-Subscribe: List-Post: List-Owner: List-Archive: Precedence: bulk --2WS97oupGEGbYNpW Content-Type: text/plain; charset=us-ascii Content-Disposition: inline Content-Transfer-Encoding: quoted-printable Greetings, * Tom Lane (tgl@sss.pgh.pa.us) wrote: > "Jonathan S. Katz" writes: > > For now I have left in the password based method to be scram-sha-256 as > > I am optimistic about the support across client drivers[1] (and FWIW I > > have an implementation for crystal-pg ~60% done). >=20 > > However, this probably means we would need to set the default password > > encryption guc to "scram-sha-256" which we're not ready to do yet, so it > > may be moot to leave it in. >=20 > > So, thinking out loud about that, we should probably use "md5" and once > > we decide to make the encryption method "scram-sha-256" by default, then > > we update the recommendation? >=20 > Meh. If we're going to break things, let's break them. Set it to > scram by default and let people who need to cope with old clients > change the default. I'm tired of explaining that MD5 isn't actually > insecure in our usage ... +many. Thanks, Stephen --2WS97oupGEGbYNpW Content-Type: application/pgp-signature; name="signature.asc" -----BEGIN PGP SIGNATURE----- Version: GnuPG v1 iQIcBAEBCgAGBQJc51cwAAoJEO1sijiDR2RVYbwQALACCvO6pN7lCW05/AB7of08 eWynDQ9W3DiAu7HK9kbpWL7XqDB1PstLpzJ0lXJx1mc2DbM4vBvRjkEheYoE7OTj 3RT/ezaNIojk1AZKJzeKau1Kai0k6ekyC8lOrloAPx60XiBusuwD0KD7xvY7AiK0 WHF394eKiWmKac0FdyGZGJ+5bHBQfOpV0bYGPgrHKh7aPPHB9QQbqtLduxuXIrNW biYzQRqtZPW4zw+I/83j9+tfnZFYLZmVIL/3Wj8eWZILDC1Is6omz3Og0PYyeUN6 rhkd6Vs0/RdlxPm1kkJjWuk8QU/qf177mzExlpnWlvKVUsuI0qANIAjpkoti6pcD oRpOxmqCOphpx7eSPLfM3us+WE6WPe1rmwHSdOQbSpUEgSCftcqnm5J/8vP2uAwH MhRoBqiZGXl/M5V8+JfmtOjc9LqKusWzXtNzo33ctM21LA8MvOxil2rDNeY7SATj Lywl+sj9ITh9ycafxg5tiONpUyNctz90oYCZWYKoc06ZiLSpuAwUxCW4ckOrCrZY wuB458PnNFLnJusgbmWgWW25KyxcMs30hiZxU1yL2ducWU70SvJPSGa4qm2c5eRb XRgGMthlG4IA6jR6XphA5qRGvxqRuI9J7wvbxC5hmj4YW6vzcUclHtFUFRzQ9Vet 5CR/CNmwc3VKP6DRUc2x =Ub14 -----END PGP SIGNATURE----- --2WS97oupGEGbYNpW--