Re: Removing SSL renegotiation (Was: Should we back-patch SSL renegotiation fixes?)

<p dir="ltr"><br /> On Jun 27, 2015 8:07 AM, "Michael Paquier" <<a
href="mailto:michael.paquier@gmail.com">michael.paquier@gmail.com</a>>wrote:<br /> ><br /> > On Sat, Jun 27,
2015at 6:12 AM, Tom Lane <<a href="mailto:tgl@sss.pgh.pa.us">tgl@sss.pgh.pa.us</a>> wrote:<br /> > > Andres
Freund<<a href="mailto:andres@anarazel.de">andres@anarazel.de</a>> writes:<br /> > >> On 2015-06-24
16:41:48+0200, Andres Freund wrote:<br /> > >>> I, by now, have come to a different conclusion. I think
it'stime to<br /> > >>> entirely drop the renegotiation support.<br /> > ><br /> > >> I
thinkby now we essentially concluded that we should do that. What I'm<br /> > >> not sure yet is how: Do we
wantto rip it out in master and just change<br /> > >> the default in the backbranches, or do we want to rip
itout in all<br /> > >> branches and leave a faux guc in place in the back branches. I vote for<br /> >
>>the latter, but would be ok with both variants.<br /> > ><br /> > > I think the former is probably
thesaner answer.  It is less likely to<br /> > > annoy people who dislike back-branch changes.  And it will be<br
/>> > significantly less work, considering that that code has changed enough<br /> > > that you won't be
ableto just cherry-pick a removal patch.  I also fear<br /> > > there's a nonzero chance of breaking stuff if
you'recareless about doing<br /> > > the removal in one or more of the five active back branches ...<br />
><br/> > +1 for removing on master and just disabling on back-branches.<br /><br /><p dir="ltr">+1. Definitely
soundslike the safer choice. <p dir="ltr">/Magnus