On 24.03.21 10:49, Daniel Gustafsson wrote:
> The recently published RFC 8996 deprecates the use of TLSv1 and TLSv1.1, the
> attached rewords where we say our default of 1.2 is industry best practice with
> a link to the authoritative source.
The "industry best practices" the original text refers to are things
like PCI-DSS and various announcements by browser vendors. Those best
practices have already been around for long before RFC 8996. I think
this patch is mangling the two concepts of what is best practice and
what is officially deprecated, and since when each of them applies.
If we want to throw RFC 8996 into the mix, we could drop the reference
to best practices and just write something like
"The default is TLSv1.2. Note that all older versions are deprecated as
of this writing (see RFC 8996)."
However, now that I read this, it's not clear from this who is doing the
deprecating. Someone could wonder, does this mean PostgreSQL will drop
support for it?
Maybe the old wording is best and more timeless, and if someone wants to
question it they can do their own research.