28
MariaDB 11.8's zero-configuration TLS requires no manual setup (optimizedbyotto.com)
submitted 1 year ago by to c/sysadmin@lemmy.world
4 comments fedilink hide all child comments
 

This is nice for those tired of wrestling with TLS certs and CAs for your database

all 4 comments

sorted by: hot top controversial new old
[–] 10 points 1 year ago (3 children)

Connection encryption is pretty low on the list of priorities for database security. Proper accounts and rights management is far more important.

SQL traffic shouldn't really run over anything but short LAN links. Ideally separated from other stuff entirely, but just not spewed over your whole LAN, and really not over the Internet at all.

TLS is good, yes, but unless you're also validating those certs they don't mean much. Client certs would be even better.

  • permalink
  • fedilink
  • source
  • hideshow 3 child comments
    •
  • [–] 5 points 1 year ago

    Some compliance measures (PCI DSS 4, HIPAA) mandate encryption in transit and none penalize it, so making any of that easier and less error-prone seems like a step in the right direction.

  • permalink
  • fedilink
  • source
  • parent
  • [–] 2 points 1 year ago*

    The cloud, and any form of managed database, inverts this. User accounts are extremely easy, as they are automatically provisioned with secrets you can easily rotate, along with the database itself. There is less of a worry about user rights as well, as you can dedicate one "instance" of a database to certain types of data, instead of having more than one database within one instance.

    And then, traffic is commonly going to be routed through untrusted networks, hence the desire for encryption in transit.

  • permalink
  • fedilink
  • source
  • parent
    • 1 comment in c/selfhosted@lemmy.world view that post
    [–] -3 points 1 year ago

    Fuck mariadb its a pain in the ass and getting python to communicate with it is also a pain. Postgress superiority gang.

  • permalink
  • fedilink
  • source
    •