Document when ssl_prefer_server_ciphers went in

On 03.07.24 11:23, Daniel Gustafsson wrote:

In the documentation for ssl_prefer_server_ciphers we only say it's not in
"older version" but we omit to specify it further. Since it's a fairly
important setting for security I think it makes sense to add the version to
help users, as in the small attached diff (which also adds proper markup in the
paragraph while in there).

Looks reasonable to me.

Would it make sense to remove the setting altogether?

Daniel Gustafsson <daniel@yesql.se> writes:

In the documentation for ssl_prefer_server_ciphers we only say it's not in
"older version" but we omit to specify it further. Since it's a fairly
important setting for security I think it makes sense to add the version to
help users, as in the small attached diff (which also adds proper markup in the
paragraph while in there).

This could be shortened perhaps:

-        Older PostgreSQL versions do not have this setting and always use the
+        <productname>PostgreSQL</productname> versions before 9.4 do not have this setting and always use the

regards, tom lane

On 3 Jul 2024, at 18:22, Tom Lane <tgl@sss.pgh.pa.us> wrote:

Daniel Gustafsson <daniel@yesql.se> writes:

In the documentation for ssl_prefer_server_ciphers we only say it's not in
"older version" but we omit to specify it further. Since it's a fairly
important setting for security I think it makes sense to add the version to
help users, as in the small attached diff (which also adds proper markup in the
paragraph while in there).

This could be shortened perhaps:

-        Older PostgreSQL versions do not have this setting and always use the
+        <productname>PostgreSQL</productname> versions before 9.4 do not have this setting and always use the

Good idea, that reads better.

--
Daniel Gustafsson

On 3 Jul 2024, at 11:49, Peter Eisentraut <peter@eisentraut.org> wrote:

On 03.07.24 11:23, Daniel Gustafsson wrote:

In the documentation for ssl_prefer_server_ciphers we only say it's not in
"older version" but we omit to specify it further. Since it's a fairly
important setting for security I think it makes sense to add the version to
help users, as in the small attached diff (which also adds proper markup in the
paragraph while in there).

Looks reasonable to me.

Thanks, pushed with the wording suggested to Tom downthread.

Would it make sense to remove the setting altogether?

I wouldn't be opposed to it, I can't think of any legitimate usecase for it
outside of testing (it's very similar to ssl_max_protocol_version in that
sense). On the other hand, it's very little code to carry and removing it
would cause churn for anyone who has it in their configuration management
system for provisioning. Maybe it would make sense to remove it from the
sample config?

--
Daniel Gustafsson