Re: [Libreoffice] postresql-sdbc bits out of minutes of tech. steering call

On Mon, Dec 12, 2011 at 10:32:26AM +0100, Lionel Elie Mamane wrote:
> On Mon, Dec 12, 2011 at 09:46:37AM +0100, Fridrich Strba wrote:
> > On 12/12/11 08:14, Lionel Elie Mamane wrote:

> > > This also means that by our "we have to build everything we ship"
> > > rule, we have to internalise, according to my first quick survey:

> > >  - MIT Kerberos:

> > >  - Kerberos for Windows: that's not part of the OS -> internalise
> > >    (http://web.mit.edu/kerberos/dist/index.html#kfw-3.2)

> > Do we really really need this on Windows?

> It depends what value we give to "really".

So, I asked on the PostgreSQL devs mailing list. Briefly the answer is
that MIT Kerberos on Windows is bitrotten, unmaintained and a pain in
the backside: open security bugs will likely not be fixed soon,
etc. Other software in the PostgreSQL ecosystem have stopped linking
against it.

As to what feature is lost:

 - On Windows XP, any kind of decent crypto in the context of Kerberos
   authentication.

 - On Windows 7, the system Kerberos is actually quite OK.

So, all in all, we better *not* link against MIT Kerberos on Microsoft
Windows. That is our current situation, no change needed, just for
your information (& vindication).

-- 
Lionel