5 ms·

why is a bug in developer.palm.com opened in mozilla ? I think I'm missing some context here, what does the last comment mean: "I will remove this site from t

why is a bug in developer.palm.com opened in mozilla ? I think I'm missing some context here, what does the last comment mean: "I will remove this site from the whitelist in the next update."

wyldfire 11y ago
Refer to the product identified as having the bug: > Product: Tech Evangelism > For reporting web pages that need to be upgraded to support web standards and Gecko-based browsers. And for reporting add-ons that exhibit common problems that make Firefox run sub-optimally. It's not clear to me what the whitelist referred to is.
- wtallis 11y ago
  Sounds to me like there is or was a list of important sites that were known to only support older versions of SSL/TLS that Firefox would otherwise refuse to connect to.
- mcpherrinm 11y ago
  The whitelist was introduced here: https://hg.mozilla.org/releases/mozilla-aurora/rev/1e9694bbffaa https://hg.mozilla.org/releases/mozilla-aurora/rev/1e9694bbf... https://bugzilla.mozilla.org/show_bug.cgi?id=1128227 https://bugzilla.mozilla.org/show_bug.cgi?id=1128227 It's described as "TLS Intolerance fallback whitelist". It seems to allow RC4 and SSL3
  - yuhong 11y ago
    Background: Servers are supposed to respond to ClientHellos indicating newer versions of SSL/TLS with a ServerHello indicating the latest version the server supports. However not all servers did that properly. Thus browsers used to fall back to ClientHellos indicating old TLS and SSLv3 versions to support them. In this case, this server incorrectly responded to ClientHellos indicating SSL/TLS versions other than 1.0 with a SSLv3 ServerHello!