Message-ID: <66124eab.500a0220.47342.091b@mx.google.com>
Sender: Michael Banck <mbanck@gmail.com>
Date: Sun, 7 Apr 2024 09:43:39 +0200
From: Michael Banck <mbanck@gmx.net>
To: Daniel Gustafsson <daniel@yesql.se>
Cc: Jacob Champion <jacob.champion@enterprisedb.com>,
	Tomas Vondra <tomas.vondra@enterprisedb.com>,
	Nathan Bossart <nathandbossart@gmail.com>,
	Abhijit Menon-Sen <ams@toroid.org>,
	pgsql-hackers@lists.postgresql.org,
	=?utf-8?B?5oiQ5LmL54SV?= <zhcheng@ceresdata.com>
Subject: Re: [PATCH] Exponential backoff for auth_delay
References: <65e62440.170a0220.f6a7c.6f7f@mx.google.com>
 <20240305215044.GA3538518@nathanxps13>
 <CAOYmi+=47C8PEXZ8C9xxTRPtTevJgioQxJ3_vvd45rAQXPBy-Q@mail.gmail.com>
 <20240306161045.GA3542434@nathanxps13>
 <CAOYmi+koiMd58P=k_S7wsLw17chw5g2Y8kc6MHzoOqOOZ9KXdA@mail.gmail.com>
 <c7873369-4c91-4d03-b344-c21085da3122@enterprisedb.com>
 <65e8f208.170a0220.ba91f.1ea3@mx.google.com>
 <CAOYmi+k2jkTPeWxCvSi7qzAGLsckQyAyiuZcNjosNJpOBjjo2g@mail.gmail.com>
 <CAOYmi+nkZ+BbmsbdXZEaULrv+fqL9gx1uyEBOKKNS8zYCy65dA@mail.gmail.com>
 <F043D4E9-C115-4FA1-8A86-05351BE94214@yesql.se>
MIME-Version: 1.0
Content-Type: text/plain; charset=utf-8
Content-Disposition: inline
Content-Transfer-Encoding: 8bit
In-Reply-To: <F043D4E9-C115-4FA1-8A86-05351BE94214@yesql.se>
User-Agent: Mutt/1.10.1 (2018-07-13)
Archived-At: 
 <https://www.postgresql.org/message-id/66124eab.500a0220.47342.091b%40mx.google.com>
Precedence: bulk

Hi,

On Wed, Mar 20, 2024 at 11:22:12PM +0100, Daniel Gustafsson wrote:
> > On 20 Mar 2024, at 22:21, Jacob Champion <jacob.champion@enterprisedb.com> wrote:
> > 
> > On Wed, Mar 20, 2024 at 2:15 PM Jacob Champion
> > <jacob.champion@enterprisedb.com> wrote:
> >> I think solutions for case 1 and case 2 are necessarily at odds under
> >> the current design, if auth_delay relies on slot exhaustion to do its
> >> work effectively. Weakening that on purpose doesn't make much sense to
> >> me; if a DBA is uncomfortable with the DoS implications then I'd argue
> >> they need a different solution. (Which we could theoretically
> >> implement, but it's not my intention to sign you up for that. :D )
> > 
> > The thread got quiet, and I'm nervous that I squashed it unintentionally. :/
> > 
> > Is there consensus on whether the backoff is useful, even without the
> > host tracking? (Or, alternatively, is the host tracking helpful in a
> > way I'm not seeing?) Failing those, is there a way forward that could
> > make it useful in the future?
> 
> I actually wrote more or less the same patch with rudimentary attacker
> fingerprinting, and after some off-list discussion decided to abandon it for
> the reasons discussed in this thread.  It's unlikely to protect against the
> attackers we wan't to protect the cluster against since they won't wait for the
> delay anyways.

I have marked the patch "Returned with Feedback" now. Maybe I will get
back to this for v18, but it was clearly not ready for v17.


Michael