5 ms·

That's a strange take on the subject of db servers and ssl usage. Most db servers shouldn't be accessible on internet, which skews the announced result a lot. A

That's a strange take on the subject of db servers and ssl usage. Most db servers shouldn't be accessible on internet, which skews the announced result a lot. And, obviously, clients and servers generally won't require ssl by default, because it would make no sense in most situations. (but at least the 'prefer' default setting is mentionned) Requiring a certificate to run the server isn't something that is likely to become the default setting for a while...

_bohm 4y ago
I think the announced results are specifically referring to servers available on the internet.
- OJFord 4y ago
  That's GP's point, that's already a 'smell' (in the strict 'hm, that seems suspiciously like it might not be right' sense).
- deleted 4y ago
  [deleted]
adam_gyroscope 4y ago
(co-author) - `prefer` is... not great. That'll silently fall back to an unencrypted connection without warning the user. If you are the one using a programming library directly, you may know that `prefer` does this. If you are using a client that doesn't expose this to you, you may not know that you are using an unencrypted connection after you had set ssl on.
- mistrial9 4y ago
  do you understand that Postgres devs have been all over this since (likely) the time you were born? The conventional, real and actual servers that matter are generally not at all visible on the Internet, period. Because they know this.. its like this paper tests servers that dont care, and declare the entire product unsecure. Bad take, scare-mongering
- RL_Quine 4y ago
  Who cares though? All connections to SQL servers are going to be localhost or over a VPN, if your setup for postgres has a SSL certificate you're doing something terribly wrong to begin with. I'm not even sure why the option exists to begin with, there's no use case.
  - orev 4y ago
    Many places have security policies that require all traffic to be encrypted, even over local networks.
    - RL_Quine 4y ago
      So, a VPN then?
      - orev 4y ago
        A VPN generally connects networks, so that’s probably overkill for a database connection, but sure you could use one. Or something like stunnel, etc. or you could just use the built in feature already in Postgres. Why such resistance to simply having this option?
        RL_Quine 4y ago
        It’s something akin to a layer violation to have a database server running openssl and encrypting its own communication. It isn’t it’s business at all.
        imtringued 4y ago
        This is one of the most disappointing hackernews submissions I have seen in a while. I use a private CA and client certificate authentication. It might be overkill but it is easy to implement.
    - thayne 4y ago
      So in that case, require ssl. But, that probably shouldn't be the default.
chasil 4y ago
Still, Oracle is the worst. All the SQL transit is cleartext by default. A "wallet" can be defined for TLS, but the Oracle Instant Client doesn't (appear to) support this functionality. I push all my local Oracle database links over stunnel. Oracle SQL Developer even has an SSH pane, because wallets are so very unusable.

_bohm 4y ago

I think the announced results are specifically referring to servers available on the internet.

OJFord 4y ago
That's GP's point, that's already a 'smell' (in the strict 'hm, that seems suspiciously like it might not be right' sense).
deleted 4y ago
[deleted]

adam_gyroscope 4y ago

(co-author) - `prefer` is... not great. That'll silently fall back to an unencrypted connection without warning the user. If you are the one using a programming library directly, you may know that `prefer` does this. If you are using a client that doesn't expose this to you, you may not know that you are using an unencrypted connection after you had set ssl on.

mistrial9 4y ago
do you understand that Postgres devs have been all over this since (likely) the time you were born? The conventional, real and actual servers that matter are generally not at all visible on the Internet, period. Because they know this.. its like this paper tests servers that dont care, and declare the entire product unsecure. Bad take, scare-mongering
RL_Quine 4y ago
Who cares though? All connections to SQL servers are going to be localhost or over a VPN, if your setup for postgres has a SSL certificate you're doing something terribly wrong to begin with. I'm not even sure why the option exists to begin with, there's no use case.
- orev 4y ago
  Many places have security policies that require all traffic to be encrypted, even over local networks.
  - RL_Quine 4y ago
    So, a VPN then?
    - orev 4y ago
      A VPN generally connects networks, so that’s probably overkill for a database connection, but sure you could use one. Or something like stunnel, etc. or you could just use the built in feature already in Postgres. Why such resistance to simply having this option?
      - RL_Quine 4y ago
        It’s something akin to a layer violation to have a database server running openssl and encrypting its own communication. It isn’t it’s business at all.
        imtringued 4y ago
        This is one of the most disappointing hackernews submissions I have seen in a while. I use a private CA and client certificate authentication. It might be overkill but it is easy to implement.
  - thayne 4y ago
    So in that case, require ssl. But, that probably shouldn't be the default.

chasil 4y ago

Still, Oracle is the worst. All the SQL transit is cleartext by default. A "wallet" can be defined for TLS, but the Oracle Instant Client doesn't (appear to) support this functionality. I push all my local Oracle database links over stunnel. Oracle SQL Developer even has an SSH pane, because wallets are so very unusable.