From: Bruce Momjian <bruce@momjian.us>
To: Noah Misch <noah@leadboat.com>
Cc: PostgreSQL-development <pgsql-hackers@postgresql.org>
Subject: Re: First draft of the PG 15 release notes
Date: Tue, 5 Jul 2022 16:35:32 -0400
Message-ID: <YsSglBBxcPSUDwUb@momjian.us> (raw)
In-Reply-To: <20220705195349.GB2648447@rfd.leadboat.com>
References: <YnqIT8kpiO3m6SD7@momjian.us>
<20220628063719.GA2208244@rfd.leadboat.com>
<YrtmIcJ5BR7+GTvU@momjian.us>
<20220630050808.GC2257984@rfd.leadboat.com>
<Yr84AO1O+zD6Sgot@momjian.us>
<20220702012128.GA2301877@rfd.leadboat.com>
<YsSEe+y5KtRj0W/V@momjian.us>
<20220705195349.GB2648447@rfd.leadboat.com>
On Tue, Jul 5, 2022 at 12:53:49PM -0700, Noah Misch wrote:
> On Tue, Jul 05, 2022 at 02:35:39PM -0400, Bruce Momjian wrote:
> > On Fri, Jul 1, 2022 at 06:21:28PM -0700, Noah Misch wrote:
> > > Here's what I've been trying to ask: what do you think of linking to
> > > https://www.postgresql.org/docs/devel/ddl-schemas.html#DDL-SCHEMAS-PATTERNS
> > > here? The release note text is still vague, and the docs have extensive
> > > coverage of the topic. The notes can just link to that extensive coverage.
> >
> > Sure. how is this patch?
>
> > --- a/doc/src/sgml/release-15.sgml
> > +++ b/doc/src/sgml/release-15.sgml
> > @@ -63,11 +63,12 @@ Author: Noah Misch <noah@leadboat.com>
> > permissions on the <literal>public</literal> schema has not
> > been changed. Databases restored from previous Postgres releases
> > will be restored with their current permissions. Users wishing
> > - to have the former permissions will need to grant
> > + to have the former more-open permissions will need to grant
> > <literal>CREATE</literal> permission for <literal>PUBLIC</literal>
> > on the <literal>public</literal> schema; this change can be made
> > on <literal>template1</literal> to cause all new databases
> > - to have these permissions.
> > + to have these permissions. This change was made to increase
> > + security; see <xref linkend="ddl-schemas-patterns"/>.
> > </para>
> > </listitem>
>
> I think this still puts undue weight on single-user systems moving back to the
> old default. The linked documentation does say how to get back to v14
> permissions (and disclaims security if you do so), so let's not mention it
> here. The attached is how I would write it. I also reworked the "Databases
> restored from previous ..." sentence, since its statement is also true of
> databases restored v15-to-v15 (no "previous" release involved). I also moved
> the bit about USAGE to end, since it's just emphasizing what the reader should
> already assume. Any concerns?
I see where you are going --- to talk about how to convert upgraded
clusters to secure clusters, rather than how to revert to the previous
behavior. I assumed that the most common question would be how to get
the previous behavior, rather than how to get the new behavior in
upgraded clusters. However, I am fine with what you think is best.
My only stylistic suggestion would be to remove "a" from "a
<literal>REVOKE</literal>".
--
Bruce Momjian <bruce@momjian.us> https://momjian.us
EDB https://enterprisedb.com
Indecision is a decision. Inaction is an action. Mark Batterson
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Reply to all the recipients using the --to and --cc options:
reply via email
To: pgsql-hackers@postgresql.org
Cc: bruce@momjian.us, noah@leadboat.com
Subject: Re: First draft of the PG 15 release notes
In-Reply-To: <YsSglBBxcPSUDwUb@momjian.us>
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
This inbox is served by DDX for PostgreSQL; see mirroring instructions
for how to clone and mirror all data and code used for this inbox