Re: Postgres 11 release notes

From: Heikki Linnakangas <hlinnaka(at)iki(dot)fi>
To: Michael Paquier <michael(at)paquier(dot)xyz>, Bruce Momjian <bruce(at)momjian(dot)us>
Cc: PostgreSQL-development <pgsql-hackers(at)postgresql(dot)org>
Subject: Re: Postgres 11 release notes
Date: 2018-05-16 10:09:07
Views: Raw Message | Whole Thread | Download mbox | Resend email
Lists: pgsql-hackers pgsql-www

On 16/05/18 07:22, Michael Paquier wrote:
> On Mon, May 14, 2018 at 08:45:44PM -0400, Bruce Momjian wrote:
>> What TLS does is to mix the offered ciphers into the negotiation hash so
>> a man-in-the-middle can't pretend it doesn't support something. Could
>> we do something like that here?
> I have to admit that I don't quite follow here, the shape of channel
> binding data is decided by RFC 5929, so we need to stick with it.
>> I have to question the value of man-in-the-middle protection that is so
>> easily bypassed.
> Well, the backend does its job, and answers based on what the client
> wants to do. But what you are questioning here is the handling of
> authentication downgrade attempts from a server by libpq, which is a
> different problem, larger than just channel binding as it relates as
> well to MD5/SCRAM interactions. For example, it is perfectly possible
> to implement downgrade protections for any drivers which speak the
> protocol, like JDBC, even with a v11 backend.

I have to agree with Bruce, that it's pretty useless to implement
channel binding, if there is no way to require it in libpq. IMHO that
must be fixed.

It's true that even if libpq doesn't implement it, other drivers like
JDBC could. Good for them, but that still sucks for libpq.

- Heikki

In response to


Browse pgsql-hackers by date

  From Date Subject
Next Message Etsuro Fujita 2018-05-16 10:31:01 Re: Expression errors with "FOR UPDATE" and postgres_fdw with partition wise join enabled.
Previous Message Amit Langote 2018-05-16 09:40:46 Re: postgres_fdw: Oddity in pushing down inherited UPDATE/DELETE joins to remote servers

Browse pgsql-www by date

  From Date Subject
Next Message Heikki Linnakangas 2018-05-16 10:50:04 Re: Postgres 11 release notes
Previous Message Etsuro Fujita 2018-05-16 09:30:23 Re: Postgres 11 release notes