From: Tom Lane <tgl@sss.pgh.pa.us>
To: Robert Haas <robertmhaas@gmail.com>
cc: Michael Paquier <michael@paquier.xyz>,
 Daniel Gustafsson <daniel@yesql.se>,
        Peter Eisentraut <peter.eisentraut@2ndquadrant.com>,
        pgsql-hackers <pgsql-hackers@postgresql.org>
Subject: Re: should libpq also require TLSv1.2 by default?
In-reply-to: 
 <CA+Tgmoadt9jt6o2PwxpXb5MaSOzcJf_uU=HL5kUSjyge37X1Dg@mail.gmail.com>
References: <a9408304-4381-a5af-d259-e55d349ae4ce@2ndquadrant.com>
 <4FBC50DB-599A-42AA-90C8-3051E3A748BB@yesql.se>
 <64437c39-c5fb-d799-f3d3-b638e34c1dd2@2ndquadrant.com>
 <003BDF1F-FC7A-4901-BBC0-33A44FE07A89@yesql.se>
 <20200625015026.GE130132@paquier.xyz>
 <CA+Tgmoadt9jt6o2PwxpXb5MaSOzcJf_uU=HL5kUSjyge37X1Dg@mail.gmail.com>
Comments: In-reply-to Robert Haas <robertmhaas@gmail.com>
	message dated "Thu, 25 Jun 2020 15:41:55 -0400"
MIME-Version: 1.0
Content-Type: text/plain; charset="us-ascii"
Content-ID: <2290552.1593115020.1@sss.pgh.pa.us>
Date: Thu, 25 Jun 2020 15:57:00 -0400
Message-ID: <2290553.1593115020@sss.pgh.pa.us>
Precedence: bulk

Robert Haas <robertmhaas@gmail.com> writes:
> I wonder how much of a problem this really is.

Yeah.  I find Robert's points about that pretty persuasive: by now
needing to connect to a server without TLSv1.2 support, *and* needing to
do so with SSL on, ought to be a tiny niche use case (much smaller than
the number of people who would like a more secure default).  If we can
make the error message about this be reasonably clear then I don't have
an objection to changing libpq's default.

			regards, tom lane