Received: from malur.postgresql.org ([217.196.149.56])
	by arkaria.postgresql.org with esmtps
 (TLS1.3:ECDHE_RSA_AES_256_GCM_SHA384:256)
	(Exim 4.92)
	(envelope-from <pgsql-hackers-owner+archive@lists.postgresql.org>)
	id 1o8pGm-0001Gt-Qp
	for pgsql-hackers@arkaria.postgresql.org; Tue, 05 Jul 2022 20:35:40 +0000
Received: from localhost ([127.0.0.1] helo=malur.postgresql.org)
	by malur.postgresql.org with esmtp (Exim 4.92)
	(envelope-from <pgsql-hackers-owner+archive@lists.postgresql.org>)
	id 1o8pGl-0004Kg-CW
	for pgsql-hackers@arkaria.postgresql.org; Tue, 05 Jul 2022 20:35:39 +0000
Received: from magus.postgresql.org ([2a02:c0:301:0:ffff::29])
	by malur.postgresql.org with esmtps (TLS1.3:ECDHE_RSA_AES_256_GCM_SHA384:256)
	(Exim 4.92)
	(envelope-from <bruce@momjian.us>)
	id 1o8pGl-0004Jz-3N
	for pgsql-hackers@lists.postgresql.org; Tue, 05 Jul 2022 20:35:39 +0000
Received: from momjian.us ([72.94.173.45])
	by magus.postgresql.org with esmtps (TLS1.3:ECDHE_RSA_AES_256_GCM_SHA384:256)
	(Exim 4.92)
	(envelope-from <bruce@momjian.us>)
	id 1o8pGi-000744-H3
	for pgsql-hackers@postgresql.org; Tue, 05 Jul 2022 20:35:38 +0000
Received: from bruce by momjian.us with local (Exim 4.94.2)
	(envelope-from <bruce@momjian.us>)
	id 1o8pGe-00Feiv-HP; Tue, 05 Jul 2022 16:35:32 -0400
Date: Tue, 5 Jul 2022 16:35:32 -0400
From: Bruce Momjian <bruce@momjian.us>
To: Noah Misch <noah@leadboat.com>
Cc: PostgreSQL-development <pgsql-hackers@postgresql.org>
Subject: Re: First draft of the PG 15 release notes
Message-ID: <YsSglBBxcPSUDwUb@momjian.us>
References: <YnqIT8kpiO3m6SD7@momjian.us>
 <20220628063719.GA2208244@rfd.leadboat.com>
 <YrtmIcJ5BR7+GTvU@momjian.us>
 <20220630050808.GC2257984@rfd.leadboat.com>
 <Yr84AO1O+zD6Sgot@momjian.us>
 <20220702012128.GA2301877@rfd.leadboat.com>
 <YsSEe+y5KtRj0W/V@momjian.us>
 <20220705195349.GB2648447@rfd.leadboat.com>
MIME-Version: 1.0
Content-Type: text/plain; charset=us-ascii
Content-Disposition: inline
In-Reply-To: <20220705195349.GB2648447@rfd.leadboat.com>
List-Id: <pgsql-hackers.lists.postgresql.org>
List-Help: <https://lists.postgresql.org/manage/>
List-Subscribe: <https://lists.postgresql.org/manage/>
List-Post: <mailto:pgsql-hackers@lists.postgresql.org>
List-Owner: <mailto:pgsql-hackers-owner@lists.postgresql.org>
List-Archive: <https://www.postgresql.org/list/pgsql-hackers>
Archived-At: 
 <https://www.postgresql.org/message-id/YsSglBBxcPSUDwUb%40momjian.us>
Precedence: bulk

On Tue, Jul  5, 2022 at 12:53:49PM -0700, Noah Misch wrote:
> On Tue, Jul 05, 2022 at 02:35:39PM -0400, Bruce Momjian wrote:
> > On Fri, Jul  1, 2022 at 06:21:28PM -0700, Noah Misch wrote:
> > > Here's what I've been trying to ask: what do you think of linking to
> > > https://www.postgresql.org/docs/devel/ddl-schemas.html#DDL-SCHEMAS-PATTERNS
> > > here?  The release note text is still vague, and the docs have extensive
> > > coverage of the topic.  The notes can just link to that extensive coverage.
> > 
> > Sure. how is this patch?
> 
> > --- a/doc/src/sgml/release-15.sgml
> > +++ b/doc/src/sgml/release-15.sgml
> > @@ -63,11 +63,12 @@ Author: Noah Misch <noah@leadboat.com>
> >        permissions on the <literal>public</literal> schema has not
> >        been changed.  Databases restored from previous Postgres releases
> >        will be restored with their current permissions.  Users wishing
> > -      to have the former permissions will need to grant
> > +      to have the former more-open permissions will need to grant
> >        <literal>CREATE</literal> permission for <literal>PUBLIC</literal>
> >        on the <literal>public</literal> schema; this change can be made
> >        on <literal>template1</literal> to cause all new databases
> > -      to have these permissions.
> > +      to have these permissions.  This change was made to increase
> > +      security;  see <xref linkend="ddl-schemas-patterns"/>.
> >       </para>
> >      </listitem>
> 
> I think this still puts undue weight on single-user systems moving back to the
> old default.  The linked documentation does say how to get back to v14
> permissions (and disclaims security if you do so), so let's not mention it
> here.  The attached is how I would write it.  I also reworked the "Databases
> restored from previous ..." sentence, since its statement is also true of
> databases restored v15-to-v15 (no "previous" release involved).  I also moved
> the bit about USAGE to end, since it's just emphasizing what the reader should
> already assume.  Any concerns?

I see where you are going --- to talk about how to convert upgraded
clusters to secure clusters, rather than how to revert to the previous
behavior.  I assumed that the most common question would be how to get
the previous behavior, rather than how to get the new behavior in
upgraded clusters.  However, I am fine with what you think is best.

My only stylistic suggestion would be to remove "a" from "a
<literal>REVOKE</literal>".

-- 
  Bruce Momjian  <bruce@momjian.us>        https://momjian.us
  EDB                                      https://enterprisedb.com

  Indecision is a decision.  Inaction is an action.  Mark Batterson