MIME-Version: 1.0
In-Reply-To: <5dba9c6c-19fe-6095-ff83-d8d9e29d0e93@2ndquadrant.com>
References: <20180117161459.3623.50555@wrigleys.postgresql.org>
 <5dba9c6c-19fe-6095-ff83-d8d9e29d0e93@2ndquadrant.com>
From: Jon Wolski <jonwolski@gmail.com>
Date: Thu, 1 Feb 2018 19:23:31 -0600
Message-ID: 
 <CABZG8z866RH733UWbKA-oD5J4XE0kQc-LfBrDV+fF=4U=bAsgw@mail.gmail.com>
Subject: Re: removal of md5 from example code
To: Peter Eisentraut <peter.eisentraut@2ndquadrant.com>
Cc: pgsql-docs@lists.postgresql.org
Content-Type: multipart/alternative; boundary="94eb2c0e730a7a6de60564308ff9"
Precedence: bulk

--94eb2c0e730a7a6de60564308ff9
Content-Type: text/plain; charset="UTF-8"

I think I get it, now.

Is the reason for including the `pass` in the example so that the
documentation can demonstrate `citext` along side case-sensitive text?

If so, I struggle to come up with anything more obvious than a password
hash for a case where case-sensitive comparison of text is necessary. The
only other thing that comes to mind is an external system identifier like a
Salesforce object id of a user. That would not be as universally obvious an
example of case-sensitivity to all PostgreSQL users..

On Tue, Jan 30, 2018 at 10:02 PM, Peter Eisentraut <
peter.eisentraut@2ndquadrant.com> wrote:

> On 1/17/18 11:14, PG Doc comments form wrote:
> > The documentation at
> > https://www.postgresql.org/docs/current/static/citext.html shows an
> example
> > using md5 for password hashes. This is generally a bad practice and not
> > relevant to the feature documented.
> >
> > I recommend removing the password column from this example or replacing
> the
> > md5 hash with something more secure (a secure hash algorithm with a
> salt).
>
> We don't have any other hash functions built in and exposed at the SQL
> level.  (Maybe that is a problem.)  Do you have any other ideas how to
> rewrite that example?
>
> --
> Peter Eisentraut              http://www.2ndQuadrant.com/
> PostgreSQL Development, 24x7 Support, Remote DBA, Training & Services
>

--94eb2c0e730a7a6de60564308ff9
Content-Type: text/html; charset="UTF-8"
Content-Transfer-Encoding: quoted-printable

<div dir=3D"ltr"><div>I think I get it, now. <br><br>Is the reason for incl=
uding the `pass` in the example so that the documentation can demonstrate `=
citext` along side case-sensitive text? <br><br>If so, I struggle to come u=
p with anything more obvious than a password hash for a case where case-sen=
sitive comparison of text is necessary. The only other thing that comes to =
mind is an external system identifier like a Salesforce object id of a user=
. That would not be as universally obvious an example of case-sensitivity t=
o all PostgreSQL users..<br></div></div><div class=3D"gmail_extra"><br><div=
 class=3D"gmail_quote">On Tue, Jan 30, 2018 at 10:02 PM, Peter Eisentraut <=
span dir=3D"ltr">&lt;<a href=3D"mailto:peter.eisentraut@2ndquadrant.com" ta=
rget=3D"_blank">peter.eisentraut@2ndquadrant.com</a>&gt;</span> wrote:<br><=
blockquote class=3D"gmail_quote" style=3D"margin:0 0 0 .8ex;border-left:1px=
 #ccc solid;padding-left:1ex">On 1/17/18 11:14, PG Doc comments form wrote:=
<br>
&gt; The documentation at<br>
&gt; <a href=3D"https://www.postgresql.org/docs/current/static/citext.html"=
 rel=3D"noreferrer" target=3D"_blank">https://www.postgresql.org/<wbr>docs/=
current/static/citext.<wbr>html</a> shows an example<br>
&gt; using md5 for password hashes. This is generally a bad practice and no=
t<br>
&gt; relevant to the feature documented.<br>
&gt;<br>
&gt; I recommend removing the password column from this example or replacin=
g the<br>
&gt; md5 hash with something more secure (a secure hash algorithm with a sa=
lt).<br>
<br>
We don&#39;t have any other hash functions built in and exposed at the SQL<=
br>
level.=C2=A0 (Maybe that is a problem.)=C2=A0 Do you have any other ideas h=
ow to<br>
rewrite that example?<br>
<span class=3D"HOEnZb"><font color=3D"#888888"><br>
--<br>
Peter Eisentraut=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 <a href=3D=
"http://www.2ndQuadrant.com/" rel=3D"noreferrer" target=3D"_blank">http://w=
ww.2ndQuadrant.com/</a><br>
PostgreSQL Development, 24x7 Support, Remote DBA, Training &amp; Services<b=
r>
</font></span></blockquote></div><br></div>

--94eb2c0e730a7a6de60564308ff9--