Re: [PATCH] add ssl_protocols configuration option

Magnus Hagander <magnus(at)hagander(dot)net> writes:
> If anything, I think the default should be "default", and then we have
> that map out to something. Because once you've initdb'ed, the config
> file wil be stuck with a default and we can't change that in a minor
> release *if* something like POODLE shows up again.

Actually, I had that in an earlier version of the patch, but I thought
it was too obscure / circular. I can easily re-add it.

> In a case like POODLE we probably wouldn't have done it anyway, as it
> doesn't affect our connections (we're not http)

If I understand correctly, imaps has been shown to be vulnerable as
well, so I wouldn't be so sure.

> Having the guc could certainly be useful in some cases. If we do, we
> should of course *also* have a corresponding configuration option in
> libpq, so I'd say this patch is incomplete if we do want to do it.

I can update the patch to include the client side.

DES
--
Dag-Erling Smørgrav - des(at)des(dot)no