Document that the "-P" option to pg_autovacuum is insecure on many

platforms, and suggest using ~/.pgpass instead.

diff --git a/contrib/pg_autovacuum/README.pg_autovacuum b/contrib/pg_autovacuum/README.pg_autovacuum
index 9b8a64d..64c5eb5 100644 (file)
--- a/contrib/pg_autovacuum/README.pg_autovacuum
+++ b/contrib/pg_autovacuum/README.pg_autovacuum
@@ -36,9 +36,9 @@ list.
 
 pg_autovacuum requires that the statistics system be enabled and
 reporting row level stats.  The overhead of the stats system has been
-shown to have a significant cost under certain workloads.  For
-instance, a tight loop of queries performing "select 1" was found to
-run nearly 30% slower when stats were enabled.  However, in practice,
+shown to be significant under certain workloads.  For instance, a
+tight loop of queries performing "select 1" was found to run nearly
+30% slower when row-level stats were enabled.  However, in practice,
 with more realistic workloads, the stats system overhead is usually
 nominal.
 
@@ -127,8 +127,11 @@ pg_autovacuum has the following optional arguments:
 -U username: Username pg_autovacuum will use to connect with, if not
    specified the current username is used.
 -P password: Password pg_autovacuum will use to connect with. *WARNING*
-   When installed as a Windows Service, this option will be stored in plain
-   text in the registry.
+   This option is insecure. When installed as a Windows Service, this
+   option will be stored in plain text in the registry. When used with
+   most Unix variants, other users will be able to see the argument to
+   the "-P" option via ps(1). The ~/.pgpass file can be used to
+   specify a password more securely.
 -H host: host name or IP to connect to.
 -p port: port used for connection.
 -h help: list of command line options.