Thread: Document when ssl_prefer_server_ciphers went in
In the documentation for ssl_prefer_server_ciphers we only say it's not in "older version" but we omit to specify it further. Since it's a fairly important setting for security I think it makes sense to add the version to help users, as in the small attached diff (which also adds proper markup in the paragraph while in there). -- Daniel Gustafsson
Attachment
On 03.07.24 11:23, Daniel Gustafsson wrote: > In the documentation for ssl_prefer_server_ciphers we only say it's not in > "older version" but we omit to specify it further. Since it's a fairly > important setting for security I think it makes sense to add the version to > help users, as in the small attached diff (which also adds proper markup in the > paragraph while in there). Looks reasonable to me. Would it make sense to remove the setting altogether?
Daniel Gustafsson <daniel@yesql.se> writes: > In the documentation for ssl_prefer_server_ciphers we only say it's not in > "older version" but we omit to specify it further. Since it's a fairly > important setting for security I think it makes sense to add the version to > help users, as in the small attached diff (which also adds proper markup in the > paragraph while in there). This could be shortened perhaps: - Older PostgreSQL versions do not have this setting and always use the + <productname>PostgreSQL</productname> versions before 9.4 do not have this setting and always use the regards, tom lane
> On 3 Jul 2024, at 18:22, Tom Lane <tgl@sss.pgh.pa.us> wrote: > > Daniel Gustafsson <daniel@yesql.se> writes: >> In the documentation for ssl_prefer_server_ciphers we only say it's not in >> "older version" but we omit to specify it further. Since it's a fairly >> important setting for security I think it makes sense to add the version to >> help users, as in the small attached diff (which also adds proper markup in the >> paragraph while in there). > > This could be shortened perhaps: > > - Older PostgreSQL versions do not have this setting and always use the > + <productname>PostgreSQL</productname> versions before 9.4 do not have this setting and always use the Good idea, that reads better. -- Daniel Gustafsson
> On 3 Jul 2024, at 11:49, Peter Eisentraut <peter@eisentraut.org> wrote: > > On 03.07.24 11:23, Daniel Gustafsson wrote: >> In the documentation for ssl_prefer_server_ciphers we only say it's not in >> "older version" but we omit to specify it further. Since it's a fairly >> important setting for security I think it makes sense to add the version to >> help users, as in the small attached diff (which also adds proper markup in the >> paragraph while in there). > > Looks reasonable to me. Thanks, pushed with the wording suggested to Tom downthread. > Would it make sense to remove the setting altogether? I wouldn't be opposed to it, I can't think of any legitimate usecase for it outside of testing (it's very similar to ssl_max_protocol_version in that sense). On the other hand, it's very little code to carry and removing it would cause churn for anyone who has it in their configuration management system for provisioning. Maybe it would make sense to remove it from the sample config? -- Daniel Gustafsson