Received: from malur.postgresql.org ([217.196.149.56]) by arkaria.postgresql.org with esmtps (TLS1.3:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.92) (envelope-from ) id 1lEI4K-0004A3-PP for pgsql-hackers@arkaria.postgresql.org; Mon, 22 Feb 2021 20:44:36 +0000 Received: from localhost ([127.0.0.1] helo=malur.postgresql.org) by malur.postgresql.org with esmtp (Exim 4.92) (envelope-from ) id 1lEI4J-0008Dj-Mx for pgsql-hackers@arkaria.postgresql.org; Mon, 22 Feb 2021 20:44:35 +0000 Received: from makus.postgresql.org ([2001:4800:3e1:1::229]) by malur.postgresql.org with esmtps (TLS1.3:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.92) (envelope-from ) id 1lEI4J-0008DH-GN for pgsql-hackers@lists.postgresql.org; Mon, 22 Feb 2021 20:44:35 +0000 Received: from sss.pgh.pa.us ([66.207.139.130]) by makus.postgresql.org with esmtps (TLS1.3:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.92) (envelope-from ) id 1lEI4H-000549-9l for pgsql-hackers@lists.postgresql.org; Mon, 22 Feb 2021 20:44:34 +0000 Received: from sss1.sss.pgh.pa.us (localhost [127.0.0.1]) by sss.pgh.pa.us (8.15.2/8.15.2) with ESMTP id 11MKiU0Y3604971; Mon, 22 Feb 2021 15:44:30 -0500 From: Tom Lane To: Robert Haas cc: Daniil Zakhlystov , Konstantin Knizhnik , Justin Pryzby , Andrey Borodin , PostgreSQL Hackers Subject: Re: libpq compression In-reply-to: References: <612f227d-cb27-9238-5922-1500f8b2eb96@postgrespro.ru> <160623927937.7563.15974279758478581796.pgcf@coridan.postgresql.org> <6811D196-E2FB-40CC-B1C9-F19427FBF675@yandex-team.ru> <470E411E-681D-46A2-A1E9-6DE11B5F59F3@yandex-team.ru> <3676BA4F-ED2B-470C-9892-007C943BB1D2@yandex-team.ru> Comments: In-reply-to Robert Haas message dated "Mon, 22 Feb 2021 14:48:25 -0500" MIME-Version: 1.0 Content-Type: text/plain; charset="us-ascii" Content-ID: <3604969.1614026670.1@sss.pgh.pa.us> Date: Mon, 22 Feb 2021 15:44:30 -0500 Message-ID: <3604970.1614026670@sss.pgh.pa.us> List-Id: List-Help: List-Subscribe: List-Post: List-Owner: List-Archive: Precedence: bulk Robert Haas writes: > So at the end of the day I'm not really quite sure what is best here. > I agree with all of Craig's points about the advantages of > packet-level compression, so I'd really prefer to make that approach > work if we can. However, it also seems to me that there's room to be > fairly concerned about what these test results are showing. BTW ... in view of the nearby thread about permanently disabling OpenSSL's compression option, I wonder whether we really ought to be in a hurry to put back compression underneath that. While this area is out of my wheelhouse, my understanding of the problem with OpenSSL is that the packet length changes due to compression can provide enough information to an attacker to break the encryption. It seems to me that do-it-ourselves compression would most likely create an equivalent vulnerability. Perhaps that problem can be dodged by refusing to use compression if any form of encryption is in use ... but that would make for another big reduction in the scope of usefulness of this feature. Connections on which you'd care about compression are likely to be across open networks where encryption is an even more pressing need. regards, tom lane