On Tue, Dec 17, 2013 at 09:51:30AM -0500, Robert Haas wrote:
> On Sun, Dec 15, 2013 at 5:10 PM, James Cloos <cl...@jhcloos.com> wrote:
> > For reference, see:
> >
> >   https://wiki.mozilla.org/Security/Server_Side_TLS
> >
> > for the currently suggested suite for TLS servers.
> ...
> > But for pgsql, I'd leave off the !PSK; pre-shared keys may prove useful
> > for some.  And RC4, perhaps, also should be !ed.
> >
> > And if anyone wants Kerberos tls-authentication, one could add
> > KRB5-DES-CBC3-SHA, but that is ssl3-only.
> >
> > Once salsa20-poly1305 lands in openssl, that should be added to the
> > start of the list.
> I'm starting to think we should just leave this well enough alone.  We
> can't seem to find two people with the same idea of what would be
> better than what we have now.  And of course the point of making it a
> setting in the first place is that each person can set it to whatever
> they deem best.

Yes, I am seeing that too.  Can we agree on one that is _better_ than
what we have now, even if we can't agree on a _best_ one?

  Bruce Momjian  <br...@momjian.us>        http://momjian.us
  EnterpriseDB                             http://enterprisedb.com

  + Everyone has their own god. +

Sent via pgsql-hackers mailing list (pgsql-hackers@postgresql.org)
To make changes to your subscription:

Reply via email to