You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
For the past 16 months, there has been discussion about whether and how to implement Transparent Data Encryption (tde) in Postgres. Many other relational databases support tde, and some security standards require it. However, it is also debatable how much security value tde provides.
18
+
19
+
The tde 400-email thread became difficult for people to follow, partly because full understanding required knowledge of Postgres internals and security details. A group of people who wanted to move forward began attending a Zoom call, hosted by Ahsan Hadi. The voice format allowed for more rapid exchange of ideas, and the ability to quickly fill knowledge gaps. It was eventually decided that all-cluster encryption was the easiest to implement in the first version. Later releases will build on this.
20
+
21
+
Fundamentally, tde must meet three criteria — it must be secure, obviously, but it also must be done in a way that has minimal impact on the rest of the Postgres code. This has value for two reasons — first, only a small number of users will use tde, so the less code that is added, the less testing is required. Second, the less code that is added, the less likely tde will break because of future Postgres changes. Finally, tde should meet regulatory requirements. This diagram by Peter Smith illustrates the constraints.
22
+
23
+
There is an active TODO list to coordinate development. There is hope this can be completed in Postgres 13.
2019-09-15 - PL/Proxy 2.9 - “Don’t Look Into The Eye”
35
+
36
+
Fixes:
37
+
38
+
Dynamic record-type functions can crash backend if called in scalar context.
39
+
Changes:
40
+
41
+
- Support for PG11 and PG12.
42
+
- Drop support for PG9.2 and earlier.
43
+
- Drop local Debian packaging, it seems unused.
44
+
- Drop support for keepalive cluster options. These are replaced by keepalive support in libpq. Removing OS-specific code makes PL/Proxy also more portable.
0 commit comments