On Fri, Jun 26, 2026 at 01:18:55PM -0500, Nathan Bossart wrote: > On Wed, Jun 24, 2026 at 07:43:21AM -0700, Jacob Champion wrote: >> Presumably the verifier was created a while back, though, in the case >> of an upgrade. Personally I think it makes sense to warn whenever the >> MD5 hash is used to authenticate. > > I'm fine with expanding the warnings to "password" auth. Something else I > considered is whether we should warn if a role with an MD5 password is > authenticated without using the password. I ultimately decided against > that, but we could expand it there, too.
FWIW, emitting a WARNING for the "password" case would make more people aware that they're doing something wrong. Folks having the idea to allow plain password authentication should be hopefully next to nothing these days (mostly self-managed), but the more warned the less potential pain when this gets removed. In short, I think that Fujii-san's patch is a good thing to have. >> No opinion on the patch implementation, though (cc'd Nathan who might?). > > TBH I'm not too opinionated here, if for no other reason than all this code > should be getting deleted in the next couple of years. v20 perhaps? Let's be on the very optimistic side of the spectrum. :p -- Michael
signature.asc
Description: PGP signature
