Re: [PATCH] add ssl_protocols configuration option

From: Dag-Erling Smørgrav <des(at)des(dot)no>
To: Magnus Hagander <magnus(at)hagander(dot)net>
Cc: Tom Lane <tgl(at)sss(dot)pgh(dot)pa(dot)us>, Alvaro Herrera <alvherre(at)2ndquadrant(dot)com>, Michael Paquier <michael(dot)paquier(at)gmail(dot)com>, PostgreSQL mailing lists <pgsql-hackers(at)postgresql(dot)org>
Subject: Re: [PATCH] add ssl_protocols configuration option
Date: 2014-10-22 13:14:26
Message-ID: 868uk8dz65.fsf@nine.des.no
Views: Raw Message | Whole Thread | Download mbox | Resend email
Thread:
Lists: pgsql-hackers

Magnus Hagander <magnus(at)hagander(dot)net> writes:
> If anything, I think the default should be "default", and then we have
> that map out to something. Because once you've initdb'ed, the config
> file wil be stuck with a default and we can't change that in a minor
> release *if* something like POODLE shows up again.

Actually, I had that in an earlier version of the patch, but I thought
it was too obscure / circular. I can easily re-add it.

> In a case like POODLE we probably wouldn't have done it anyway, as it
> doesn't affect our connections (we're not http)

If I understand correctly, imaps has been shown to be vulnerable as
well, so I wouldn't be so sure.

> Having the guc could certainly be useful in some cases. If we do, we
> should of course *also* have a corresponding configuration option in
> libpq, so I'd say this patch is incomplete if we do want to do it.

I can update the patch to include the client side.

DES
--
Dag-Erling Smørgrav - des(at)des(dot)no

In response to

Responses

Browse pgsql-hackers by date

  From Date Subject
Next Message Teodor Sigaev 2014-10-22 13:14:43 speedup tidbitmap patch: hash BlockNumber
Previous Message Dag-Erling Smørgrav 2014-10-22 13:12:19 Re: [PATCH] add ssl_protocols configuration option