Received: from malur.postgresql.org ([217.196.149.56])
	by arkaria.postgresql.org with esmtps
 (TLS1.3:ECDHE_RSA_AES_256_GCM_SHA384:256)
	(Exim 4.92)
	(envelope-from <pgsql-hackers-owner+archive@lists.postgresql.org>)
	id 1oBKuj-0001Ua-8B
	for pgsql-hackers@arkaria.postgresql.org; Tue, 12 Jul 2022 18:47:17 +0000
Received: from localhost ([127.0.0.1] helo=malur.postgresql.org)
	by malur.postgresql.org with esmtp (Exim 4.92)
	(envelope-from <pgsql-hackers-owner+archive@lists.postgresql.org>)
	id 1oBKui-0004uB-4N
	for pgsql-hackers@arkaria.postgresql.org; Tue, 12 Jul 2022 18:47:16 +0000
Received: from makus.postgresql.org ([2001:4800:3e1:1::229])
	by malur.postgresql.org with esmtps (TLS1.3:ECDHE_RSA_AES_256_GCM_SHA384:256)
	(Exim 4.92)
	(envelope-from <bruce@momjian.us>)
	id 1oBKuh-0004u2-Ru
	for pgsql-hackers@lists.postgresql.org; Tue, 12 Jul 2022 18:47:15 +0000
Received: from momjian.us ([72.94.173.45])
	by makus.postgresql.org with esmtps (TLS1.3:ECDHE_RSA_AES_256_GCM_SHA384:256)
	(Exim 4.92)
	(envelope-from <bruce@momjian.us>)
	id 1oBKub-0004MS-95
	for pgsql-hackers@postgresql.org; Tue, 12 Jul 2022 18:47:14 +0000
Received: from bruce by momjian.us with local (Exim 4.94.2)
	(envelope-from <bruce@momjian.us>)
	id 1oBKuZ-00HFrA-Nd; Tue, 12 Jul 2022 14:47:07 -0400
Date: Tue, 12 Jul 2022 14:47:07 -0400
From: Bruce Momjian <bruce@momjian.us>
To: Noah Misch <noah@leadboat.com>
Cc: PostgreSQL-development <pgsql-hackers@postgresql.org>
Subject: Re: First draft of the PG 15 release notes
Message-ID: <Ys3BqwfxDAwCDjES@momjian.us>
References: <YsSEe+y5KtRj0W/V@momjian.us>
 <20220705195349.GB2648447@rfd.leadboat.com>
 <YsSglBBxcPSUDwUb@momjian.us>
 <20220705215752.GC2648447@rfd.leadboat.com>
 <YsTNqC5QO2666i+G@momjian.us>
 <20220706024557.GD2648447@rfd.leadboat.com>
 <YsWJ3XYbT7qMfpmy@momjian.us>
 <20220710031941.GB2808420@rfd.leadboat.com>
 <YsxSXWSS90Yzqqwv@momjian.us>
 <20220712063132.GB2937407@rfd.leadboat.com>
MIME-Version: 1.0
Content-Type: text/plain; charset=us-ascii
Content-Disposition: inline
In-Reply-To: <20220712063132.GB2937407@rfd.leadboat.com>
List-Id: <pgsql-hackers.lists.postgresql.org>
List-Help: <https://lists.postgresql.org/manage/>
List-Subscribe: <https://lists.postgresql.org/manage/>
List-Post: <mailto:pgsql-hackers@lists.postgresql.org>
List-Owner: <mailto:pgsql-hackers-owner@lists.postgresql.org>
List-Archive: <https://www.postgresql.org/list/pgsql-hackers>
Archived-At: 
 <https://www.postgresql.org/message-id/Ys3BqwfxDAwCDjES%40momjian.us>
Precedence: bulk

On Mon, Jul 11, 2022 at 11:31:32PM -0700, Noah Misch wrote:
> On Mon, Jul 11, 2022 at 12:39:57PM -0400, Bruce Momjian wrote:
> > I had trouble reading the sentences in the order you used so I
> > restructured it:
> > 
> > 	The new default is one of the secure schema usage patterns that <xref
> > 	linkend="ddl-schemas-patterns"/> has recommended since the security
> > 	release for CVE-2018-1058.  The change applies to newly-created
> > 	databases in existing clusters and for new clusters.  Upgrading a
> > 	cluster or restoring a database dump will preserve existing permissions.
> 
> I agree with the sentence order change.

Great.

> > 	For existing databases, especially those having multiple users, consider
> > 	issuing <literal>REVOKE</literal> to adopt this new default.  For new
> > 	databases having zero need to defend against insider threats, granting
> > 	<literal>USAGE</literal> permission on their <literal>public</literal>
> > 	schemas will yield the behavior of prior releases.
> 
> s/USAGE/CREATE/ in the last sentence.  Looks good with that change.

Ah, yes, of course.

-- 
  Bruce Momjian  <bruce@momjian.us>        https://momjian.us
  EDB                                      https://enterprisedb.com

  Indecision is a decision.  Inaction is an action.  Mark Batterson