Date: Thu, 25 May 2023 13:29:12 -0400
From: Stephen Frost <sfrost@snowman.net>
To: Jacob Champion <jchampion@timescale.com>
Cc: Daniel Gustafsson <daniel@yesql.se>,
	PostgreSQL Hackers <pgsql-hackers@lists.postgresql.org>,
	"Jonathan S. Katz" <jkatz@postgresql.org>,
	Michael Paquier <michael@paquier.xyz>
Subject: Re: Docs: Encourage strong server verification with SCRAM
Message-ID: <ZG+a6Bac95yWytUK@tamriel.snowman.net>
References: <CAAWbhmg5Gh0JetNbQi7z0yOsdsN9YECv8GoY-QBGBBiip9+JOw@mail.gmail.com>
 <ZG0p+sk/1WkYJ2+l@tamriel.snowman.net>
 <69EC75B8-3A75-43D9-9A2A-61BF6571247B@yesql.se>
 <2cdec255-6514-705b-0a4e-0cfb06dbddd7@timescale.com>
MIME-Version: 1.0
Content-Type: multipart/signed; micalg=pgp-sha512;
	protocol="application/pgp-signature"; boundary="AgPsqsPxtWbVyRot"
Content-Disposition: inline
In-Reply-To: <2cdec255-6514-705b-0a4e-0cfb06dbddd7@timescale.com>
User-Agent: Mutt/2.1.4 (2021-12-11)
Archived-At: <https://www.postgresql.org/message-id/ZG%2Ba6Bac95yWytUK%40tamriel.snowman.net>
Precedence: bulk


--AgPsqsPxtWbVyRot
Content-Type: text/plain; charset=us-ascii
Content-Disposition: inline
Content-Transfer-Encoding: quoted-printable

Greetings,

* Jacob Champion (jchampion@timescale.com) wrote:
> On 5/24/23 05:04, Daniel Gustafsson wrote:
> >> On 23 May 2023, at 23:02, Stephen Frost <sfrost@snowman.net> wrote:
> >> Perhaps more succinctly- maybe we should be making adjustments to the
> >> current language instead of just adding a new paragraph.
> >=20
> > +1
>=20
> I'm 100% on board for doing that as well, but the "instead of"
> suggestion makes me think I didn't explain my goal very well. For
> example, Stephen, you said
>=20
> > I have to admit that the patch as presented strikes me as a warning
> > without really providing steps for how to address the issues mentioned
> > though; there's a reference to what was just covered at the bottom but
> > nothing really new.
>=20
> but the last sentence of my patch *is* the suggested step:
>=20
> > +      ... It's recommended to employ strong server
> > +      authentication, using one of the above anti-spoofing measures, t=
o prevent
> > +      these attacks.

I was referring specifically to that ordering as not being ideal or in
line with the rest of the flow of that section.  We should integrate the
concerns higher in the section where we outline the reason these things
matter and then follow those with the specific steps for how to address
them, not give a somewhat unclear reference from the very bottom back up
to something above.

Thanks,

Stephen

--AgPsqsPxtWbVyRot
Content-Type: application/pgp-signature; name="signature.asc"

-----BEGIN PGP SIGNATURE-----

iQIzBAABCgAdFiEEwf6gbxKhD863zrx/7WyKOINHZFUFAmRvmuYACgkQ7WyKOINH
ZFViZA/+NHdYoUUiu8uchotztXeuiMGYNhAXCv9ByBLyfvqdGytUx+vxf4/vPnRy
ACzZlAUviKH9YUKzmOZXVhXksqqZh6CsFbt/7XnOr4VsJ8fZVpd9jGRBDfEYBcyF
IkbuMlnBSJtSLjUN/xXaZdIOPYkutq5f7MuG0uzUq84zR85WV0y8UhWnIxoKlsES
LOJoipdDjfkxdweFuJE6oMOCrL720lfENkpLN1riDql0pBX4ew8qD5NN/GvJVTtT
9DRo2oVPW6PiU6Gckz4fmk22ujj1JIfUfjJjWAKhA1954QgDPqT5J2jRXrAWTpIt
WpPYPdeH73te8pCTHBhsgPw6gJbXPbQcg6WBapOUKiyaPwqCjSFfYgxskK7brOPo
YThVz0jq4S2bM6VCQ48qfVR9xf9elX+wYvgYKxEKvPvwNNoCwHyZl8ug6fG6CLA8
H13trsVCDEt1yqYXS+SA0d2hQjVLOc7X+8xsdykSO4+ZG1GgSvkxuRllKmP2Nrnz
O6RKxkGwDN6Uyo2RvLtSfpznzfRPhqSR9DuvH+6c292zM/Dt+kz5Y2AlH+NAorBc
+PD90TRZwL0ML+O1DhNsk4ZIqTu2WAPig5ogXJurSR6miJ5kh7xAAG47QWyKQ62N
HyNlDFyM3bZoZzn3fRHpb462Ub+TTXYC9dp3yOjw43X0J2Ekb2k=
=QOcZ
-----END PGP SIGNATURE-----

--AgPsqsPxtWbVyRot--