MIME-Version: 1.0
References: 
 <CAN4CZFMmDZMH56O9vb_g7vHqAk8ryWFxBMV19C39PFghENg8kA@mail.gmail.com>
 <CAOYmi+k_et3yXpJ8op71-95j7OYg-kX5bWLgW9YTV_5G7f+O1A@mail.gmail.com>
 <CAOYmi+kivcSnazEJA=KWknd3azGYnU3mMq9SUvht5Zq74qNcYQ@mail.gmail.com>
 <CAN4CZFMKCB2OXPGW0R_hCSu4Gg==B7dBSrv6Mf-YuFcrUncADg@mail.gmail.com>
 <CAOYmi+kCYZ3YiOu+oSv1gVW6LXQaNg4BcEpskYizWgfV1z12kA@mail.gmail.com>
 <CAN4CZFPNL4xuNAwmD1-TUR-z+C84axb+cdhip26k3YBFYo9r1g@mail.gmail.com>
 <CAOYmi+mN2OeFotwLKwwSDAuXHJ6xmrn3AtkUoHRcfAEENSFbMA@mail.gmail.com>
 <CAOYmi+=865C93VegSzD9z4_uvutZwEZEUsS4P6jm3_i0paAMmA@mail.gmail.com>
In-Reply-To: 
 <CAOYmi+=865C93VegSzD9z4_uvutZwEZEUsS4P6jm3_i0paAMmA@mail.gmail.com>
From: Zsolt Parragi <zsolt.parragi@percona.com>
Date: Wed, 1 Apr 2026 22:12:58 +0100
Message-ID: 
 <CAN4CZFOe5P9ZQbxKXJTnJYDF8bpnMGThyQw9QzCffTEZ=MqKvw@mail.gmail.com>
Subject: Re: [oauth] Split and extend PGOAUTHDEBUG
To: Jacob Champion <jacob.champion@enterprisedb.com>
Cc: PostgreSQL Hackers <pgsql-hackers@lists.postgresql.org>
Content-Type: multipart/mixed; boundary="000000000000114a25064e6c8df8"
Archived-At: 
 <https://www.postgresql.org/message-id/CAN4CZFOe5P9ZQbxKXJTnJYDF8bpnMGThyQw9QzCffTEZ%3DMqKvw%40mail.gmail.com>
Precedence: bulk

--000000000000114a25064e6c8df8
Content-Type: text/plain; charset="UTF-8"

> OAUTHDEBUG_LEGACY_UNSAFE?

That sounds better

> I think I'm missing something; how does the choice of .c/.h change
> things? There's no static tracking in v1 of the patchset

Eh, sorry about that, I was sure that I sent a version which handled
that to the list, but apparently I didn't. It didn't use
atomics/mutexes, so maybe it's better.

> `UNSAFE` is intended to be a weak defense against social engineering
> attacks. So these warnings need to be translated, if possible, and we
> should not provide instructions on how to defeat that defense.

With the same logic, shouldn't we print a very visible warning when
somebody enables trace? Since it's a long output, maybe to both the
beginning and end of the flow?

--000000000000114a25064e6c8df8
Content-Type: application/octet-stream; name="nocfbot-tracewarning.diff"
Content-Disposition: attachment; filename="nocfbot-tracewarning.diff"
Content-Transfer-Encoding: base64
Content-ID: <f_mngjh6940>
X-Attachment-Id: f_mngjh6940

ZGlmZiAtLWdpdCBhL3NyYy9pbnRlcmZhY2VzL2xpYnBxLW9hdXRoL29hdXRoLWN1cmwuYyBiL3Ny
Yy9pbnRlcmZhY2VzL2xpYnBxLW9hdXRoL29hdXRoLWN1cmwuYwppbmRleCBlYjJmZTM1ZDBjYy4u
YWQ4YzhjNDU2NWIgMTAwNjQ0Ci0tLSBhL3NyYy9pbnRlcmZhY2VzL2xpYnBxLW9hdXRoL29hdXRo
LWN1cmwuYworKysgYi9zcmMvaW50ZXJmYWNlcy9saWJwcS1vYXV0aC9vYXV0aC1jdXJsLmMKQEAg
LTMwNDEsNiArMzA0MSwxMSBAQCBwZ19mZV9ydW5fb2F1dGhfZmxvdyhQR2Nvbm4gKmNvbm4sIHN0
cnVjdCBQR29hdXRoQmVhcmVyUmVxdWVzdCAqcmVxdWVzdCwKIAkJCQkJYWN0eC0+ZGJnX251bV9j
YWxscyk7CiAJfQoKKwlpZiAoKGFjdHgtPmRlYnVnX2ZsYWdzICYgT0FVVEhERUJVR19VTlNBRkVf
VFJBQ0UpCisJCSYmIChyZXN1bHQgPT0gUEdSRVNfUE9MTElOR19PSyB8fCByZXN1bHQgPT0gUEdS
RVNfUE9MTElOR19GQUlMRUQpKQorCQlmcHJpbnRmKHN0ZGVyciwKKwkJCQlsaWJwcV9nZXR0ZXh0
KCJXQVJOSU5HOiBQR09BVVRIREVCVUcgdHJhY2Ugb3V0cHV0IGFib3ZlIG1heSBjb250YWluIHNl
Y3JldHMuIERvIG5vdCBzaGFyZSB3aXRoIHRoaXJkIHBhcnRpZXMuXG4iKSk7CisKICNpZm5kZWYg
V0lOMzIKIAlpZiAobWFza2VkKQogCXsKQEAgLTMwOTYsNiArMzEwMSwxMCBAQCBwZ19zdGFydF9v
YXV0aGJlYXJlcihQR2Nvbm4gKmNvbm4sIFBHb2F1dGhCZWFyZXJSZXF1ZXN0VjIgKnJlcXVlc3Qp
CiAJLyogUGFyc2UgZGVidWcgZmxhZ3MgZnJvbSB0aGUgZW52aXJvbm1lbnQuICovCiAJYWN0eC0+
ZGVidWdfZmxhZ3MgPSBvYXV0aF9nZXRfZGVidWdfZmxhZ3MoKTsKCisJaWYgKGFjdHgtPmRlYnVn
X2ZsYWdzICYgT0FVVEhERUJVR19VTlNBRkVfVFJBQ0UpCisJCWZwcmludGYoc3RkZXJyLAorCQkJ
CWxpYnBxX2dldHRleHQoIldBUk5JTkc6IFBHT0FVVEhERUJVRyB0cmFjZSBpcyBlbmFibGVkLiBI
VFRQIHRyYWZmaWMgKGluY2x1ZGluZyBzZWNyZXRzKSB3aWxsIGJlIGxvZ2dlZC5cbiIpKTsKKwog
CWluaXRQUUV4cEJ1ZmZlcigmYWN0eC0+d29ya19kYXRhKTsKIAlpbml0UFFFeHBCdWZmZXIoJmFj
dHgtPmVycmJ1Zik7Cg==
--000000000000114a25064e6c8df8--