[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Message-ID: <ZrJQpDftQthxOT2g@symphytum.spacehopper.org>
Date: Tue, 6 Aug 2024 17:34:44 +0100
From: Stuart Henderson <stu@...cehopper.org>
To: oss-security@...ts.openwall.com
Subject: Re: feedback requested regarding deprecation of TLS
1.0/1.1
On 2024/08/06 17:12, Marco Moock wrote:
> Am Tue, 6 Aug 2024 05:02:14 -0400
> schrieb Neil Horman <nhorman@...nssl.org>:
>
> > 1) Are distributions/users comfortable with this approach in the time
> > frame proposed?
>
> As a user, this is acceptable for me, but I know there are still
> machines outside that only offer such old versions.
> Some of them can't be upgraded easily because the vendor doesn't
> provide any new versions.
BTW, mainstream web browsers disabled pre-1.2 TLS by default around 2020.
> > 3) If the deprecated protocols are re-enabled, what would constitute a
> > reasonable warning mechanism to inform users that these protocols are
> > going away at some point in the future to pressure users to update to
> > a newer, more secure protocol?
>
> Is it reasonable to output that on STDERR any time those protocols are
> used?
>From a library?!
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
