Moving from hackers Begin forwarded message:
Actually it seems the question is whether we suggest trading security for convenience. If the rest of PostgreSQL is something these whiz kids want or need to use they will learn what is needed to install it. If they work for a company likely someone will train them. If they do not they will teach the selves from some form of textbook - whether that be a blog post or official high-quality documentation.
In a project of this magnitude there is only so much you can learn via trial and error. Thus original learning requires some (multiple) forms of written text. Once you have some people with the knowledge you can train others. The documentation is there and really smart people will realize that they cannot know everything and so they should read documentation. Its our job to make sure the trough is full. If the horse dehydrates because it doesn't want to drink I don't lose any sleep - I'll just look for a different horse. That said I'll at least to make the software indicate when there is an unusual configuration and give the user some guidance on what to look for. But I'd generally rather strictly notify and let the user make an informed, manual, decision on how to resolve the issue instead of assuming and hoping the cure is no worse than the disease.
Most of those seem irrelevant and none of them are followed by specific actions the community can take to adapt to the new normal.
That means nothing without more context. And while making Postgres "part of that" sounds all good I still haven't and good reasons the status quo is failing nor specific actions that can be taken toward that end. The few things you mentioned you can do without any permission from the community and getting listed on the website seems to require that you make security a higher priority. That's just how we roll here and it is highly unlikely that will change.
David J. |
