Subject: Re: WIP: Data at rest encryption
To: Stephen Frost <sfrost@snowman.net>, Bruce Momjian <bruce@momjian.us>
References: <20170613162301.GF3151@tamriel.snowman.net>
 <20170613164442.GD13873@momjian.us>
 <20170613170132.GH3151@tamriel.snowman.net>
 <20170613171356.GG13873@momjian.us>
 <20170613172459.GL3151@tamriel.snowman.net>
 <20170613174329.GK13873@momjian.us>
 <20170613182339.GP3151@tamriel.snowman.net>
 <20170613182910.GN13873@momjian.us>
 <20170613183858.GR3151@tamriel.snowman.net>
 <20170613185622.GO13873@momjian.us>
 <20170613192011.GS3151@tamriel.snowman.net>
Cc: Ants Aasma <ants.aasma@eesti.ee>, Robert Haas <robertmhaas@gmail.com>,
 PostgreSQL-development <pgsql-hackers@postgresql.org>
From: Peter Eisentraut <peter.eisentraut@2ndquadrant.com>
Organization: 2ndQuadrant
Message-ID: <a2fa2930-5334-c926-01ee-4a01c605b7a4@2ndquadrant.com>
Date: Tue, 13 Jun 2017 15:43:14 -0400
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.12; rv:52.0)
 Gecko/20100101 Thunderbird/52.1.1
MIME-Version: 1.0
In-Reply-To: <20170613192011.GS3151@tamriel.snowman.net>
Content-Type: text/plain; charset=windows-1252
Content-Language: en-US
Content-Transfer-Encoding: 7bit
Precedence: bulk
Sender: pgsql-hackers-owner@postgresql.org

On 6/13/17 15:20, Stephen Frost wrote:
> No, the benefit is that the database administrator can configure it and
> set it up and not have to get an OS-level administrator involved.  There
> may also be other reasons why filesystem-level encryption is difficult
> to set up or use in a certain environment, but this wouldn't depend on
> anything OS-related and therefore could be done.

Let's see a proposal in those terms then.  How easy can you make it,
compared to existing OS-level solutions, and will that justify the
maintenance overhead?

Considering how ubiquitous file-system encryption is, I have my doubts
that the trade-offs will come out right, but let's see.

-- 
Peter Eisentraut              http://www.2ndQuadrant.com/
PostgreSQL Development, 24x7 Support, Remote DBA, Training & Services


-- 
Sent via pgsql-hackers mailing list (pgsql-hackers@postgresql.org)
To make changes to your subscription:
http://www.postgresql.org/mailpref/pgsql-hackers