Follow @Openwall on Twitter for new release announcements and other news
[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Date: Tue, 14 Oct 2014 08:23:23 -0700
From: Alex Gaynor <>
Subject: Re: Truly scary SSL 3.0 vuln to be revealed soon:

At what point are we going to decide that it's absurd for every single TLS
deployment to need to reconfigure everything in order to achieve strong
security, and say that OpenSSL (or even Apache/Nginx/HAProxy/etc.) should
just configure things reasonably out of the box?


On Tue, Oct 14, 2014 at 7:38 AM, Reed Loden <> wrote:

> Hash: SHA1
> On Tue, 14 Oct 2014 13:15:41 +0200
> Hanno Böck <> wrote:
> > A number of people already recommend disabling SSLv3, e.g. the Qualys
> > configuration guide. Disable it now - no matter if the rumors about a
> > serious vuln are true, you'll be safe.
> has some great info
> on configuring your web servers and load balancers to have the best
> possible SSL/TLS settings, including specific example configs to help
> you out.
> ~reed
> Version: GnuPG v2.0.22 (GNU/Linux)
> upwAn0TxonRRgEPZYyqUaTIsRlgKkqm7
> =fmf8

"I disapprove of what you say, but I will defend to the death your right to
say it." -- Evelyn Beatrice Hall (summarizing Voltaire)
"The people's good is the highest law." -- Cicero
GPG Key fingerprint: 125F 5C67 DFE9 4084

Powered by blists - more mailing lists

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.