pg.ddx.io  pgsql-hackers@postgresql.org mailing list archive  

help / color / mirror / Atom feed

From: Tom Lane <tgl@sss.pgh.pa.us>
To: Robert Haas <robertmhaas@gmail.com>
Cc: Michael Paquier <michael@paquier.xyz>
Cc: Daniel Gustafsson <daniel@yesql.se>
Cc: Peter Eisentraut <peter.eisentraut@2ndquadrant.com>
Cc: pgsql-hackers <pgsql-hackers@postgresql.org>
Subject: Re: should libpq also require TLSv1.2 by default?
Date: Thu, 25 Jun 2020 15:57:00 -0400
Message-ID: <2290553.1593115020@sss.pgh.pa.us> (raw)
In-Reply-To: <CA+Tgmoadt9jt6o2PwxpXb5MaSOzcJf_uU=HL5kUSjyge37X1Dg@mail.gmail.com>
References: <a9408304-4381-a5af-d259-e55d349ae4ce@2ndquadrant.com>
	<4FBC50DB-599A-42AA-90C8-3051E3A748BB@yesql.se>
	<64437c39-c5fb-d799-f3d3-b638e34c1dd2@2ndquadrant.com>
	<003BDF1F-FC7A-4901-BBC0-33A44FE07A89@yesql.se>
	<20200625015026.GE130132@paquier.xyz>
	<CA+Tgmoadt9jt6o2PwxpXb5MaSOzcJf_uU=HL5kUSjyge37X1Dg@mail.gmail.com>

Robert Haas <robertmhaas@gmail.com> writes:
> I wonder how much of a problem this really is.

Yeah.  I find Robert's points about that pretty persuasive: by now
needing to connect to a server without TLSv1.2 support, *and* needing to
do so with SSL on, ought to be a tiny niche use case (much smaller than
the number of people who would like a more secure default).  If we can
make the error message about this be reasonably clear then I don't have
an objection to changing libpq's default.

			regards, tom lane

view thread (21+ messages)  latest in thread

Message-ID: <2290553.1593115020@sss.pgh.pa.us>
Permalink:  ../2290553.1593115020@sss.pgh.pa.us/
Also on:    postgresql.org/message-id/2290553.1593115020@sss.pgh.pa.us

copy link · copy postgr.es

reply

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Reply to all the recipients using the --to and --cc options:
  reply via email

  To: pgsql-hackers@postgresql.org
  Cc: tgl@sss.pgh.pa.us, robertmhaas@gmail.com, michael@paquier.xyz, daniel@yesql.se, peter.eisentraut@2ndquadrant.com
  Subject: Re: should libpq also require TLSv1.2 by default?
  In-Reply-To: <2290553.1593115020@sss.pgh.pa.us>

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

This inbox is served by DDX for PostgreSQL; see mirroring instructions
for how to clone and mirror all data and code used for this inbox