Date: Fri, 24 May 2019 08:19:04 -0400
From: Stephen Frost <sfrost@snowman.net>
To: Joe Conway <mail@joeconway.com>
Cc: Tom Lane <tgl@sss.pgh.pa.us>, "Jonathan S. Katz" <jkatz@postgresql.org>,
	Peter Eisentraut <peter.eisentraut@2ndquadrant.com>,
	pgsql-hackers <pgsql-hackers@postgresql.org>,
	Noah Misch <noah@leadboat.com>,
	Magnus Hagander <magnus@hagander.net>
Subject: Re: initdb recommendations
Message-ID: <20190524121904.GU2480@tamriel.snowman.net>
References: 
 <CABUevExMizVYea9zaHBte66u9KipEgfwcsaE9spfqK9iYRST_g@mail.gmail.com>
 <20190406180839.GA1921989@rfd.leadboat.com>
 <96389374-9454-d26d-6f79-7c7b15ec14bd@2ndquadrant.com>
 <81b36e8b-e27b-ab5d-c4f0-6493771bc0ee@postgresql.org>
 <9f46f065-ca80-f637-8c5d-a9877bcd5eab@postgresql.org>
 <10093.1558664907@sss.pgh.pa.us>
 <20190524023009.GL2480@tamriel.snowman.net>
 <df011ad3-f1a3-149e-3489-2d68e6ea21a7@joeconway.com>
 <20190524121306.GS2480@tamriel.snowman.net>
 <17041a05-0e28-f2b1-bf0c-fe375af66b45@joeconway.com>
MIME-Version: 1.0
Content-Type: multipart/signed; micalg=pgp-sha512;
	protocol="application/pgp-signature"; boundary="KqBSqvdnnccM6+Kg"
Content-Disposition: inline
In-Reply-To: <17041a05-0e28-f2b1-bf0c-fe375af66b45@joeconway.com>
User-Agent: Mutt/1.5.24 (2015-08-30)
Precedence: bulk


--KqBSqvdnnccM6+Kg
Content-Type: text/plain; charset=us-ascii
Content-Disposition: inline
Content-Transfer-Encoding: quoted-printable

Greetings,

* Joe Conway (mail@joeconway.com) wrote:
> On 5/24/19 8:13 AM, Stephen Frost wrote:
> > * Joe Conway (mail@joeconway.com) wrote:
> >> On 5/23/19 10:30 PM, Stephen Frost wrote:
> >> > * Tom Lane (tgl@sss.pgh.pa.us) wrote:
> >> >> "Jonathan S. Katz" <jkatz@postgresql.org> writes:
> >> >> > For now I have left in the password based method to be scram-sha-=
256 as
> >> >> > I am optimistic about the support across client drivers[1] (and F=
WIW I
> >> >> > have an implementation for crystal-pg ~60% done).
> >> >>=20
> >> >> > However, this probably means we would need to set the default pas=
sword
> >> >> > encryption guc to "scram-sha-256" which we're not ready to do yet=
, so it
> >> >> > may be moot to leave it in.
> >> >>=20
> >> >> > So, thinking out loud about that, we should probably use "md5" an=
d once
> >> >> > we decide to make the encryption method "scram-sha-256" by defaul=
t, then
> >> >> > we update the recommendation?
> >> >>=20
> >> >> Meh.  If we're going to break things, let's break them.  Set it to
> >> >> scram by default and let people who need to cope with old clients
> >> >> change the default.  I'm tired of explaining that MD5 isn't actually
> >> >> insecure in our usage ...
> >> >=20
> >> > +many.
> >>=20
> >> many++
> >>=20
> >> Are we doing this for pg12? In any case, I would think we better loudly
> >> point out this change somewhere.
> >=20
> > Sure, we should point it out, but I don't know that it needs to be
> > screamed from the rooftops considering the packagers have already been
> > largely ignoring our defaults here anyway...
>=20
> Yeah, I thought about that, but anyone not using those packages will be
> in for a big surprise. Don't get me wrong, I wholeheartedly endorse the
> change, but I predict many related questions on the lists, and anything
> we can do to mitigate that should be done.

You think there's someone who builds from the source and just trusts
what we have put in for the defaults in pg_hba.conf..?

I've got a really hard time with that idea...

I'm all for making people aware of it, but I don't think it justifies
being the top item of the release notes or some such.  Frankly, anything
that starts with "If you build from source, then..." is already going to
be pretty low impact and therefore low on the list of things we need to
cover in the release notes, et al.

Thanks,

Stephen

--KqBSqvdnnccM6+Kg
Content-Type: application/pgp-signature; name="signature.asc"

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1

iQIcBAEBCgAGBQJc5+E4AAoJEO1sijiDR2RV2ssP/3B65vOoSrMtdbEiY0Q8GNfo
Rz1AdyNATB8xliHjOIXI24wDajs+Z5489K43ObdsUZafv3PZ0RaRbN+F2/Oh4stE
s8GCY7+MNUsmgxEMz7STCG19nfgiiEQXOWVNRQamXsSKa6k2mIthcugKUlRm9lgy
UGnd/MxVLHY961B8ZUFrlzxj17m+hnvtFVUrUYtBBE9V3cOCk6xWVL8blh38yaS3
HGs5uxKBVcCAbl8hpGilWfqhiML9X1yCd7z6ZHnhJQJWTzBz38JuNhCbYphPzmsq
6IhcDAdzQHKf2ffHlu2pXmxp5DkSpKazRZ9L6DJ/rRPC8yoFfVbyY4beHhlRuobT
hy481tJFBYX9QEf4SRyJ5zGrG/hzQb1uH9ve48WBWJeaF5LQplizIsA930h4u7gG
FhmH66AeBEzyGNa4LlgEYHWdQDz2Uen6TpNim7OAADRur2zz/IhmgpRleb9KROv2
VDRZqclRON+0u8Z0Ap020Yigjkw9zryD4tG3gNgtpLpIU9k7xF29ThAfy/7IOHrq
XdVkj32TbQ2N1kK1oVF6EudQV2Vrt1nOqLOd3PMKLrXfd7OXN3PTQzFKeejgJ21E
dn9/xzCYIMM/CPcOSxCruUDyaZtk11Wo4xZYBvoG4ta19zPRFXx8hPskWfcKL7yd
wCTYIZopjnMMVocgcC6K
=Yxwc
-----END PGP SIGNATURE-----

--KqBSqvdnnccM6+Kg--