On Wed, Feb 3, 2010 at 10:21 AM, Tom Lane <tgl(at)sss(dot)pgh(dot)pa(dot)us> wrote:
> Robert Haas <robertmhaas(at)gmail(dot)com> writes:
>> Should we think about adding a GUC to disable renegotiation until this
>> blows over?
>
> Bad idea: once set, it'll never get unset, thus leaving installations
> with a weakened security posture even after they've installed fixed
> versions of openssl.

That's a problem, but our current posture of holding our breath
doesn't seem to be working either.  If we insist on shipping code that
doesn't work with currently-distributed versions of OpenSSL, people
will do things like, say, shut SSL off.  Or packagers of PostgreSQL
will apply patches that disable it unconditionally, leaving us with no
control.

...Robert

In response to

• Re: Recent vendor SSL renegotiation patches break PostgreSQL at 2010-02-03 15:21:25 from Tom Lane

Responses

• Re: Recent vendor SSL renegotiation patches break PostgreSQL at 2010-02-03 15:35:00 from Chris Campbell

pgsql-hackers by date

Next:	From: Tom Lane	Date: 2010-02-03 15:34:04
	Subject: Re: Add on_trusted_init and on_untrusted_init to plperl UPDATED [PATCH]
Previous:	From: Tom Lane	Date: 2010-02-03 15:21:25
	Subject: Re: Recent vendor SSL renegotiation patches break PostgreSQL