From: Stephen Frost <sfrost@snowman.net>
To: Joe Conway <mail@joeconway.com>
Cc: Tom Lane <tgl@sss.pgh.pa.us>
Cc: Jonathan S. Katz <jkatz@postgresql.org>
Cc: Peter Eisentraut <peter.eisentraut@2ndquadrant.com>
Cc: pgsql-hackers <pgsql-hackers@postgresql.org>
Cc: Noah Misch <noah@leadboat.com>
Cc: Magnus Hagander <magnus@hagander.net>
Subject: Re: initdb recommendations
Date: Fri, 24 May 2019 08:13:06 -0400
Message-ID: <20190524121306.GS2480@tamriel.snowman.net> (raw)
In-Reply-To: <df011ad3-f1a3-149e-3489-2d68e6ea21a7@joeconway.com>
References: <bec17f0a-ddb1-8b95-5e69-368d9d0a3390@postgresql.org>
<f27d3170-76cf-4afb-1e1a-b1059295ec8d@2ndquadrant.com>
<CABUevExMizVYea9zaHBte66u9KipEgfwcsaE9spfqK9iYRST_g@mail.gmail.com>
<20190406180839.GA1921989@rfd.leadboat.com>
<96389374-9454-d26d-6f79-7c7b15ec14bd@2ndquadrant.com>
<81b36e8b-e27b-ab5d-c4f0-6493771bc0ee@postgresql.org>
<9f46f065-ca80-f637-8c5d-a9877bcd5eab@postgresql.org>
<10093.1558664907@sss.pgh.pa.us>
<20190524023009.GL2480@tamriel.snowman.net>
<df011ad3-f1a3-149e-3489-2d68e6ea21a7@joeconway.com>
Greetings,
* Joe Conway (mail@joeconway.com) wrote:
> On 5/23/19 10:30 PM, Stephen Frost wrote:
> > * Tom Lane (tgl@sss.pgh.pa.us) wrote:
> >> "Jonathan S. Katz" <jkatz@postgresql.org> writes:
> >> > For now I have left in the password based method to be scram-sha-256 as
> >> > I am optimistic about the support across client drivers[1] (and FWIW I
> >> > have an implementation for crystal-pg ~60% done).
> >>
> >> > However, this probably means we would need to set the default password
> >> > encryption guc to "scram-sha-256" which we're not ready to do yet, so it
> >> > may be moot to leave it in.
> >>
> >> > So, thinking out loud about that, we should probably use "md5" and once
> >> > we decide to make the encryption method "scram-sha-256" by default, then
> >> > we update the recommendation?
> >>
> >> Meh. If we're going to break things, let's break them. Set it to
> >> scram by default and let people who need to cope with old clients
> >> change the default. I'm tired of explaining that MD5 isn't actually
> >> insecure in our usage ...
> >
> > +many.
>
> many++
>
> Are we doing this for pg12? In any case, I would think we better loudly
> point out this change somewhere.
Sure, we should point it out, but I don't know that it needs to be
screamed from the rooftops considering the packagers have already been
largely ignoring our defaults here anyway...
Thanks,
Stephen
Attachments:
signature.asc (application/pgp-signature, 818B) download
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Reply to all the recipients using the --to and --cc options:
reply via email
To: pgsql-docs@postgresql.org
Cc: sfrost@snowman.net, mail@joeconway.com, tgl@sss.pgh.pa.us, jkatz@postgresql.org, peter.eisentraut@2ndquadrant.com, pgsql-hackers@postgresql.org, noah@leadboat.com, magnus@hagander.net
Subject: Re: initdb recommendations
In-Reply-To: <20190524121306.GS2480@tamriel.snowman.net>
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
This inbox is served by DDX for PostgreSQL; see mirroring instructions
for how to clone and mirror all data and code used for this inbox