From: Robbie Harwood <rharwood@redhat.com>
To: Bruce Momjian <bruce@momjian.us>
To: Magnus Hagander <magnus@hagander.net>
Cc: Joe Conway <mail@joeconway.com>
Cc: Stephen Frost <sfrost@snowman.net>
Cc: Peter Eisentraut <peter.eisentraut@2ndquadrant.com>
Cc: Alvaro Herrera <alvherre@2ndquadrant.com>
Cc: David Steele <david@pgmasters.net>
Cc: Michael Paquier <michael@paquier.xyz>
Cc: Nico Williams <nico@cryptonector.com>
Cc: PostgreSQL-development <pgsql-hackers@postgresql.org>
Subject: Re: [PATCH v20] GSSAPI encryption support
Date: Tue, 09 Apr 2019 13:36:26 -0400
Message-ID: <jlg7ec3krmt.fsf@redhat.com> (raw)
In-Reply-To: <20190409153624.t7cozlctjzuf47ja@momjian.us>
References: <jlg1tgq1ktm.fsf@thriss.redhat.com>
<jlgy38mir81.fsf@redhat.com>
<5ec3f734-810e-36e0-030f-af92efe135da@2ndquadrant.com>
<20190223162751.GO6197@tamriel.snowman.net>
<1f799b02-d766-0328-45d6-73e5674d0bc2@2ndquadrant.com>
<CAOuzzgprZ7-gYkzwkPzMOPka62irppKpXNm219q7a_8Fu33TLw@mail.gmail.com>
<500b1be7-d0aa-96a2-9982-d748609faff5@joeconway.com>
<CABUevEyuNNJv=19foa=ycTfTfBUYOEwM8_Uss5OVKrwBAy+Btw@mail.gmail.com>
<20190409153624.t7cozlctjzuf47ja@momjian.us>
Bruce Momjian <bruce@momjian.us> writes:
> On Wed, Apr 3, 2019 at 08:49:25AM +0200, Magnus Hagander wrote:
>> On Wed, Apr 3, 2019 at 12:22 AM Joe Conway <mail@joeconway.com> wrote:
>>
>> Personally I don't find it as confusing as is either, and I find
>> hostgss to be a good analog of hostssl. On the other hand hostgssenc
>> is long and unintuitive. So +1 for leaving as is and -1 one for
>> changing it IMHO.
>>
>> I think for those who are well versed in pg_hba (and maybe gss as
>> well), it's not confusing. That includes me.
>>
>> However, for a new user, I can definitely see how it can be
>> considered confusing. And confusion in *security configuration* is
>> always a bad idea, even if it's just potential.
>>
>> Thus +1 on changing it.
>>
>> If it was on the table it might have been better to keep hostgss and
>> change the authentication method to gssauth or something, but that
>> ship sailed *years* ago.
>
> Uh, did we consider keeping hostgss and changing the auth part at the
> end to "gssauth"?
I think that was implicitly rejected because we'd have to keep the
capability to configure "gss" there else break compatibility.
Thanks,
--Robbie
Attachments:
signature.asc (application/pgp-signature, 832B) download
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Reply to all the recipients using the --to and --cc options:
reply via email
To: pgsql-hackers@postgresql.org
Cc: rharwood@redhat.com, bruce@momjian.us, magnus@hagander.net, mail@joeconway.com, sfrost@snowman.net, peter.eisentraut@2ndquadrant.com, alvherre@2ndquadrant.com, david@pgmasters.net, michael@paquier.xyz, nico@cryptonector.com
Subject: Re: [PATCH v20] GSSAPI encryption support
In-Reply-To: <jlg7ec3krmt.fsf@redhat.com>
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
This inbox is served by DDX for PostgreSQL; see mirroring instructions
for how to clone and mirror all data and code used for this inbox