Re: Post-CVE Wishlist - Mailing list pgsql-hackers

From Peter Eisentraut
Subject Re: Post-CVE Wishlist
Date
Msg-id 09889c44-05bc-376e-a4e5-0ef0adccf2ee@enterprisedb.com
Whole thread Raw
In response to Re: Post-CVE Wishlist  (Jacob Champion <pchampion@vmware.com>)
Responses Re: Post-CVE Wishlist  (Heikki Linnakangas <hlinnaka@iki.fi>)
List pgsql-hackers
On 07.12.21 19:49, Jacob Champion wrote:
>> = Implicit TLS =
> Reactions to implicit TLS were mixed, from "we should not do this" to
> "it might be nice to have the option, from a technical standpoint".
> Both a separate-port model and a shared-port model were tentatively
> proposed. The general consensus seems to be that the StartTLS-style
> flow is currently sufficient from a security standpoint.
> 
> I didn't see any responses that were outright in favor, so I think my
> remaining question is: are there any committers who think a prototype
> would be worth the time for a motivated implementer?

I'm quite interested in this.  My next question would be how complicated 
it would be.  Is it just a small block of code that peaks at a few bytes 
and decides it's a TLS handshake?  Or would it require a major 
restructuring of all the TLS support code?  Possibly something in the 
middle.



pgsql-hackers by date:

Previous
From: Peter Eisentraut
Date:
Subject: Re: SQL/JSON: functions
Next
From: Peter Eisentraut
Date:
Subject: Re: Dubious usage of TYPCATEGORY_STRING