| From: | Jacob Champion <jacob(dot)champion(at)enterprisedb(dot)com> |
|---|---|
| To: | Heikki Linnakangas <hlinnaka(at)iki(dot)fi> |
| Cc: | Daniel Gustafsson <daniel(at)yesql(dot)se>, Robert Haas <robertmhaas(at)gmail(dot)com>, Michael Paquier <michael(at)paquier(dot)xyz>, Postgres hackers <pgsql-hackers(at)lists(dot)postgresql(dot)org> |
| Subject: | Re: Direct SSL connection with ALPN and HBA rules |
| Date: | 2024-04-29 19:34:18 |
| Message-ID: | CAOYmi+kDOe+1=LPzZM0CrcEWf6Ht+1vP49+nX3pZd1U1bo26gA@mail.gmail.com |
| Views: | Raw Message | Whole Thread | Download mbox | Resend email |
| Thread: | |
| Lists: | pgsql-hackers |
On Mon, Apr 29, 2024 at 12:32 PM Jacob Champion
<jacob(dot)champion(at)enterprisedb(dot)com> wrote:
>
> On Mon, Apr 29, 2024 at 12:06 PM Heikki Linnakangas <hlinnaka(at)iki(dot)fi> wrote:
> > On 29/04/2024 21:43, Jacob Champion wrote:
> > > But if you're in that situation, what does the use of directonly give
> > > you over `sslnegotiation=direct`? You already know that servers
> > > support direct, so there's no additional performance penalty from the
> > > less strict mode.
> >
> > Well, by that argument we don't need requiredirect/directonly at all.
> > This goes back to whether it's a security feature or a performance feature.
>
> That's what I've been trying to argue, yeah. If it's not a security
> feature... why's it there?
Er, I should clarify this. I _want_ requiredirect. I just want it to
be a security feature.
--Jacob
| From | Date | Subject | |
|---|---|---|---|
| Next Message | Daniel Gustafsson | 2024-04-29 20:52:44 | Re: DROP OWNED BY fails to clean out pg_init_privs grants |
| Previous Message | Jacob Champion | 2024-04-29 19:32:36 | Re: Direct SSL connection with ALPN and HBA rules |