Date: Thu, 15 Jun 2017 19:51:10 -0400
From: Stephen Frost <sfrost@snowman.net>
To: Bruce Momjian <bruce@momjian.us>
Cc: Robert Haas <robertmhaas@gmail.com>,
	Peter Eisentraut <peter.eisentraut@2ndquadrant.com>,
	Ants Aasma <ants.aasma@eesti.ee>,
	PostgreSQL-development <pgsql-hackers@postgresql.org>
Subject: Re: WIP: Data at rest encryption
Message-ID: <20170615235110.GF1769@tamriel.snowman.net>
References: <20170614214119.GL1769@tamriel.snowman.net>
 <0b5611b8-af0f-152d-9c38-222b081c71ac@2ndquadrant.com>
 <CA+TgmoYrQvGkr-6j4fDxJ-SBjhiALzDZcukR2c9s0VeGbWoWaw@mail.gmail.com>
 <20170615202942.GA20904@momjian.us>
 <CA+TgmoaPbgzNytWPwD43s996eQkOwVATbhXCfhvQ8FkP8cG4JQ@mail.gmail.com>
 <20170615211201.GC8443@momjian.us>
 <20170615224108.GC1769@tamriel.snowman.net>
 <20170615231302.GA11450@momjian.us>
 <20170615232755.GD1769@tamriel.snowman.net>
 <20170615234443.GE11450@momjian.us>
MIME-Version: 1.0
Content-Type: multipart/signed; micalg=pgp-sha512;
	protocol="application/pgp-signature"; boundary="J8DmsxNGmrt1tVhI"
Content-Disposition: inline
In-Reply-To: <20170615234443.GE11450@momjian.us>
User-Agent: Mutt/1.5.21 (2010-09-15)
Precedence: bulk
Sender: pgsql-hackers-owner@postgresql.org


--J8DmsxNGmrt1tVhI
Content-Type: text/plain; charset=us-ascii
Content-Disposition: inline
Content-Transfer-Encoding: quoted-printable

Bruce,

* Bruce Momjian (bruce@momjian.us) wrote:
> On Thu, Jun 15, 2017 at 07:27:55PM -0400, Stephen Frost wrote:
> > I expect the same would happen with the shell-command approach suggested
> > up-thread and the prompt-on-stdin approach too, they aren't great but I
> > expect users would still use the feature.  As Robert and I have
> > mentioned, there is a good bit of value to having this feature simply
> > because it avoids the need to get someone with root privileges to set up
> > an encrypted volume and I don't think having to use a shell command or
> > providing the password on stdin at startup really changes that very
> > much.
>=20
> Understood, but now you are promoting a feature with an admittedly-poor
> API, duplication of an OS feature, and perhaps an invasive change to the
> code.  Those are high hurdles.

Of those, the only one that worries me, at least, is that it might be an
invasive and difficult to maintain code change.  As Robert said, and I
agree with, "duplication of an OS feature" is something we pretty
routinly, and justifiably, do.  The poor interface is unfortunate, but
if it's consistent with what we have today for a similar feature then
I'm really not too upset with it.  If we can do better, great, I'm all
for that, but if not, then I'd rather have the feature with the poor
interface than not have it at all.

If it's an invasive code change or one which ends up being difficult to
maintain, then that's a problem.  Getting some focus on that aspect
would be great and I certainly appreciate Robert's initial review and
commentary on it.

Thanks!

Stephen

--J8DmsxNGmrt1tVhI
Content-Type: application/pgp-signature; name="signature.asc"
Content-Description: Digital signature

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1

iQIcBAEBCgAGBQJZQx1uAAoJEO1sijiDR2RV7vsQALsJmpUjpBP6S6RCdLJn25N2
vsDkC8M6pUYki2pd5oJZcH3Chk6d346CgsVEgEtfF8crWqfarHLgwE6TT1m5drla
7WxJpKksYD0jK9uqVGQZHOitJjmCJfRB1tkF6nWPPC7R9ZqvlOihtmCZsh3wNK43
ql9YOauKl0JcyWuza7RH9YehHpV7/3EKS87OmsaCBV12pknXr63KEScWf/59SwTT
lsNZ5K0P2QiuPvVmWZLe58oPPc4pUdsbcAGlBJTujHw7Ke8ZQae08yh1fqiT6jS9
PIfzv/cE3VDl1nUAA771RH24NtxOtuaA4MmFt2Upwm6TvDmTeUkJlfplPFvrGdbu
K5OFMbFdGceG3lRk4CSmoo9Yq9l1kKwWxoxhZ5ag9Pqt8p2/MIsojWMUVoo+mARc
sSus8i/EUc4eQZ4hp7qLQhwst9cQlcvitRCfQ36hxB6jhKYZMrUHylScynhUJvLj
pSSK6teQagcI4mx9+Pc5om7QD3hXZbVexuQOfZxekgvtbdIuKPu2tXiKtQXBdOMC
bk1ZQdDuEZHH8WS2PIh9lWkkePMavUgw7SSwjLiPPx3p6C/W9TT7qh78dKIoHDyw
CB2+iQE4XJA7HLnd7waBSvvt5LNENiTcO1sTt2DeRVl0wEMgtE04kq5hSGDdTQXK
eFygbwXWYQVntb5yz+x3
=Cvf9
-----END PGP SIGNATURE-----

--J8DmsxNGmrt1tVhI--