Message-ID: <53F37B7E.30300@vmware.com>
Date: Tue, 19 Aug 2014 19:29:50 +0300
From: Heikki Linnakangas <hlinnakangas@vmware.com>
Organization: VMware
User-Agent: Mozilla/5.0 (X11; Linux x86_64;
 rv:24.0) Gecko/20100101 Icedove/24.5.0
MIME-Version: 1.0
To: Stephen Frost <sfrost@snowman.net>, Andres Freund <andres@2ndquadrant.com>
CC: PostgreSQL-development <pgsql-hackers@postgreSQL.org>
Subject: Re: PQgetssl() and alternative SSL implementations
References: <53F1E989.8020609@vmware.com>
 <20140819144841.GA16422@tamriel.snowman.net>
 <20140819145547.GB30525@awork2.anarazel.de>
 <20140819150507.GB16422@tamriel.snowman.net>
 <20140819152613.GC30525@awork2.anarazel.de>
 <20140819155237.GE16422@tamriel.snowman.net>
In-Reply-To: <20140819155237.GE16422@tamriel.snowman.net>
Content-Type: text/plain; charset="ISO-8859-1"; format=flowed
Content-Transfer-Encoding: 7bit
Precedence: bulk
Sender: pgsql-hackers-owner@postgresql.org

On 08/19/2014 06:52 PM, Stephen Frost wrote:
> * Andres Freund (andres@2ndquadrant.com) wrote:
>> No. We should build something that's suitable for postgres, not
>> something general. We'll fail otherwise. For anything fancy the user has
>> to look at the certificate themselves. We should make it easy to get at
>> the whole certificate chain in a consistent manner.
>
> I don't buy this argument at all.
>
>>> Telling users they simply can't have this information isn't
>>> acceptable.
>>
>> Meh. Why? Most of that isn't something a normal libpq user is going to
>> need.
>
> I'm not interested in SSL support for users who don't use or care about
> SSL (which would be 'normal libpq users', really).  I've *long* been
> frustrated by our poor support of SSL and at how painful it is to get
> proper SSL working- and it's been a real problem getting PG to pass the
> security compliance requirements because of that poor support.  Let's
> stop the rhetoric that PG doesn't need anything but the most basic
> SSL/auditing/security capabilities.

I think you just packed up the goalposts for a one-way trip to Mars, but 
I wonder: What would you consider "proper SSL support"? What exactly are 
we missing?

- Heikki


-- 
Sent via pgsql-hackers mailing list (pgsql-hackers@postgresql.org)
To make changes to your subscription:
http://www.postgresql.org/mailpref/pgsql-hackers