Date: Wed, 20 Nov 2024 10:33:39 -0600
From: Nathan Bossart <nathandbossart@gmail.com>
To: Greg Sabino Mullane <htamfids@gmail.com>
Cc: Jim Nasby <jnasby@upgrade.com>, Andrew Dunstan <andrew@dunslane.net>,
	Tom Lane <tgl@sss.pgh.pa.us>, Heikki Linnakangas <hlinnaka@iki.fi>,
	pgsql-hackers <pgsql-hackers@postgresql.org>
Subject: Re: sunsetting md5 password support
Message-ID: <Zz4PYyO05Bnvm8lg@nathan>
References: <ZwmaW2AeUjBJGHgw@nathan>
 <Zw_cAwYO5bhaku3k@nathan>
 <Zx0RAAiMda8s0JZl@nathan>
 <CAKAnmmKq9EYTeUnmikfTL-1jKN2NXpGTN+8pYxsqfx3gYePEag@mail.gmail.com>
 <E70FC674-9B76-423C-A5F9-6372E828962E@upgrade.com>
 <ZyA0_8P8F3WHWnFu@nathan>
 <Zz0Zq39rd9WF1imY@nathan>
 <CAKAnmmJE_x81etTbh2-X0YcjQHCwVadNwiBqrm29iCU3PHOvGQ@mail.gmail.com>
 <Zz1BeHjbHECYENmO@nathan>
 <CAKAnmmK0r1ZajcL+tU2QLPTD1Nd_VKkr5LjxSCBaENPOZLiXrQ@mail.gmail.com>
MIME-Version: 1.0
Content-Type: text/plain; charset=utf-8
Content-Disposition: inline
Content-Transfer-Encoding: 8bit
In-Reply-To: 
 <CAKAnmmK0r1ZajcL+tU2QLPTD1Nd_VKkr5LjxSCBaENPOZLiXrQ@mail.gmail.com>
Archived-At: <https://www.postgresql.org/message-id/Zz4PYyO05Bnvm8lg%40nathan>
Precedence: bulk

On Wed, Nov 20, 2024 at 10:56:11AM -0500, Greg Sabino Mullane wrote:
> On Tue, Nov 19, 2024 at 8:55 PM Nathan Bossart <nathandbossart@gmail.com>
> wrote:
> 
>> * Expand the documentation.  Perhaps we could add a step-by-step guide
>> for migrating to SCRAM-SHA-256 since more users will need to do so when
>> MD5 password support is removed.
>> * Remove the hint.  It's arguably doing little more than pointing out the
>> obvious, and it doesn't actually tell users where in the documentation
>> to look for this information, anyway.
>>
> 
> I think both ideally, but maybe just the hint removal for this patch?
> 
> On the other hand, "change your password and update pg_hba.conf" is pretty
> much all you need, so not sure how detailed we want to get. :)

After thinking about this some more, I'm actually finding myself leaning
towards leaving the hint and potentially adding more detail to the
documentation as a follow-up patch.  While the hint arguably points out the
obvious, it should at least nudge users in the right direction instead of
just telling them to stop using MD5 passwords.  I've always found it
incredibly frustrating when something is marked deprecated but there's zero
information about what to do instead.

I also see a few existing cases where we refer users to the documentation,
so it's not without precedent.

-- 
nathan