Date: Mon, 6 Aug 2018 13:26:55 -0500
From: Nico Williams <nico@cryptonector.com>
To: Stephen Frost <sfrost@snowman.net>
Cc: Heikki Linnakangas <hlinnaka@iki.fi>,
	Robbie Harwood <rharwood@redhat.com>,
	PostgreSQL mailing lists <pgsql-hackers@postgresql.org>
Subject: Re: [PATCH v18] GSSAPI encryption support
Message-ID: <20180806182654.GU5695@localhost>
References: <jlg1tgq1ktm.fsf@thriss.redhat.com>
 <jlg1se287n3.fsf@redhat.com>
 <jlg602phyn5.fsf@redhat.com>
 <82e75cb9-9676-6852-74de-1454a5cc97d7@iki.fi>
 <20180806143633.GJ27724@tamriel.snowman.net>
MIME-Version: 1.0
Content-Type: text/plain; charset=us-ascii
Content-Disposition: inline
In-Reply-To: <20180806143633.GJ27724@tamriel.snowman.net>
User-Agent: Mutt/1.5.24 (2015-08-30)
Precedence: bulk

On Mon, Aug 06, 2018 at 10:36:34AM -0400, Stephen Frost wrote:
> * Heikki Linnakangas (hlinnaka@iki.fi) wrote:
> > Sorry if this sounds facetious, but:
> > 
> > What is the point of this patch? What's the advantage of GSSAPI encryption
> > over SSL? I was hoping to find the answer by reading the documentation
> > changes, but all I can see is "how" to set it up, and nothing about "why".
> 
> If you've already got an existing Kerberos environment, then it's a lot
> nicer to leverage that rather than having to also implement a full PKI
> to support and use SSL-based encryption.
> 
> There's also something to be said for having alternatives to OpenSSL.

Those two reasons would be my motivation if I were implementing this,
and they are some of the reasons I did a code review.

Nico
--