Received: from malur.postgresql.org ([217.196.149.56]) by arkaria.postgresql.org with esmtps (TLS1.3:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.92) (envelope-from ) id 1lFJ44-0001Od-4p for pgsql-hackers@arkaria.postgresql.org; Thu, 25 Feb 2021 16:00:32 +0000 Received: from localhost ([127.0.0.1] helo=malur.postgresql.org) by malur.postgresql.org with esmtp (Exim 4.92) (envelope-from ) id 1lFJ43-0001Wg-2P for pgsql-hackers@arkaria.postgresql.org; Thu, 25 Feb 2021 16:00:31 +0000 Received: from makus.postgresql.org ([2001:4800:3e1:1::229]) by malur.postgresql.org with esmtps (TLS1.3:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.92) (envelope-from ) id 1lFJ42-0001Vq-Ro for pgsql-hackers@lists.postgresql.org; Thu, 25 Feb 2021 16:00:30 +0000 Received: from forward4-smtp.messagingengine.com ([66.111.4.238]) by makus.postgresql.org with esmtps (TLS1.3:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.92) (envelope-from ) id 1lFJ40-0002Rz-MP for pgsql-hackers@postgresql.org; Thu, 25 Feb 2021 16:00:29 +0000 Received: from compute5.internal (compute5.nyi.internal [10.202.2.45]) by mailforward.nyi.internal (Postfix) with ESMTP id 91E5F1940828; Thu, 25 Feb 2021 11:00:27 -0500 (EST) Received: from mailfrontend1 ([10.202.2.162]) by compute5.internal (MEProxy); Thu, 25 Feb 2021 11:00:27 -0500 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d= messagingengine.com; h=content-transfer-encoding:content-type :date:from:in-reply-to:message-id:mime-version:references :subject:to:x-me-proxy:x-me-proxy:x-me-sender:x-me-sender :x-sasl-enc; s=fm2; bh=OgxQxhV0NDBQ1n1OsTWiQaTXrWjyUM15w11rljUV+ PI=; b=FWAERjZXBuVLS8uFtZInlFS72CWE1/TWAjg/kxArsWL2mViY4wP6iEqlV uwCBesFoAfUUrtMERZDJZS44OU+riUyl+6iilRcMl0nmPVWx3NT4JTQ8Gm5bZYd8 B9CQlDodMG4lM47iboJKY1Oy0GI6ygS8bxbdioYjfFAg8w2o4NM8lz4WaV/sTnB1 DE1QnIfk2nOvWBq/7tPyZAtIIP+HCmI0BSE7mfDCEDc/7l5WgW2Dd/kdEHu5SEFf yXEmVazSfUCBjBJQRjlKYfEELU7WmkgCh/GBPo8+35BCcKZm/MwAZVJlRP5ynnKZ KuwJEqS/6hLABBr/wl6SIQwZC2L+A== X-ME-Sender: X-ME-Proxy-Cause: gggruggvucftvghtrhhoucdtuddrgeduledrkeelgdekhecutefuodetggdotefrodftvf curfhrohhfihhlvgemucfhrghsthforghilhdpqfgfvfdpuffrtefokffrpgfnqfghnecu uegrihhlohhuthemuceftddtnecusecvtfgvtghiphhivghnthhsucdlqddutddtmdenuc fjughrpefuvfhfhffkffgfgggjtgfgsehtjeertddtfeejnecuhfhrohhmpefrvghtvghr ucfgihhsvghnthhrrghuthcuoehpvghtvghrrdgvihhsvghnthhrrghuthesvghnthgvrh hprhhishgvuggsrdgtohhmqeenucggtffrrghtthgvrhhnpeelveehheeuieduieetiedt keeuteelfeetjeffieffudegvdffvdfftdeivdeukeenucfkphepkeejrddujeejrdeile drudegtdenucevlhhushhtvghrufhiiigvpedtnecurfgrrhgrmhepmhgrihhlfhhrohhm pehpvghtvghrrdgvihhsvghnthhrrghuthesvghnthgvrhhprhhishgvuggsrdgtohhm X-ME-Proxy: Received: from laptop206oxuk.local (p57b1458c.dip0.t-ipconnect.de [87.177.69.140]) by mail.messagingengine.com (Postfix) with ESMTPA id 394E124005B; Thu, 25 Feb 2021 11:00:26 -0500 (EST) Subject: Re: SSL SNI To: Jacob Champion , "pgsql-hackers@postgresql.org" References: <7289d5eb-62a5-a732-c3b9-438cee2cb709@enterprisedb.com> From: Peter Eisentraut Message-ID: <9407b344-7342-b2b7-004f-d5250687be42@enterprisedb.com> Date: Thu, 25 Feb 2021 17:00:25 +0100 User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.16; rv:78.0) Gecko/20100101 Thunderbird/78.7.1 MIME-Version: 1.0 In-Reply-To: Content-Type: text/plain; charset=utf-8; format=flowed Content-Language: en-US Content-Transfer-Encoding: 7bit List-Id: List-Help: List-Subscribe: List-Post: List-Owner: List-Archive: Precedence: bulk On 17.02.21 00:01, Jacob Champion wrote: > On Mon, 2021-02-15 at 15:09 +0100, Peter Eisentraut wrote: >> The question I had was whether this should be an optional behavior, or >> conversely a behavior that can be turned off, or whether it should just >> be turned on all the time. > Personally I think there should be a toggle, so that any users for whom > hostnames are potentially sensitive don't have to make that information > available on the wire. Opt-in, to avoid having any new information > disclosure after a version upgrade? Just as additional data points, it has come to my attention that both the Go driver ("lib/pq") and the JDBC environment already send SNI automatically. (In the case of JDBC this is done by the Java system libraries, not the JDBC driver implementation.)