3 ms·
This is something the TLS spec authors have prepared against with GREASE. The idea is the client adds some junk version information to its list of supported pro
by discreditable 10y ago
This is something the TLS spec authors have prepared against with GREASE. The idea is the client adds some junk version information to its list of supported protocols. To quote: "Correct server implementations will ignore these values and interoperate. Servers that do not tolerate unknown values will fail to interoperate with existing clients, revealing the mistake before it is widespread."
https://tools.ietf.org/html/draft-davidben-tls-grease-00 https://tools.ietf.org/html/draft-davidben-tls-grease-00
- throwaway2048 10y agoThis dosent really seem to solve anything, everyone now ignores the enumerated GREASE values as they are reserved upfront, and will continue to cause failures with other extended values. yay?
- dvorak42 10y agoThis at least means that the developer is aware that these parts of the spec are extensible, and by explicitly ignoring the GREASE values are explicitly choosing to potentially have a broken application in the future. This is a different class of problems than developers who weren't aware certain fields were extensible.