4 ms·

> Do you understand why I do not like SNI? It has nothing to do with getting these stupid hostnames. > It is a modification that needs to be made to software to

> Do you understand why I do not like SNI? It has nothing to do with getting these stupid hostnames. > It is a modification that needs to be made to software to accomodate the spread of the use of the SNI extension. As a user, I have no need for SNI. It's a modification that has already been made to software and widely deployed. The RFC was back in 2003. Are there even any TLS implementations that don't support SNI that aren't also so horribly out of date that they're full of since patched vulnerabilities? Also it sounded like you cared a ton about getting "these stupid hostnames", and if you don't I'm not even sure what your objection is. That you can't browse some websites on Windows XP anymore? If you care enough about security to complain that TLS sucks compared to CurveCP, you definitely shouldn't be using it anyway.

gwu78 10y ago
I do not use Windows. I do not use the kernel or the browser you use. It is not your business what I use anyway. Notice I never said TLS sucks, you did. Maybe I do not care about security and I just like carefully written software by people who do not make many mistakes? Is there something offensive about that? Am I allowed to make my own choices of software? This is all beside the point. I care about having to use SSL and now with SNI. It is a hassle. Whether one likes SSL or not. It makes everything more complicated. I believe there are too many websites encrypting content that honestly does not need to be encrypted. But I am sure they have their reasons. I know how old the RFC is, but only in recent years has SNI become widespread. Probably because of all the hype around https adoption. It is obvious that some people must care about privacy and/or security, or maybe they are just pretending to care? How else to explain the growth of https?
- openasocket 10y ago
  What browser are you using that makes SSL "a hassle," with or without SNI?
  - gwu78 10y ago
    Any sslclient that has not been modified to accomodate SNI. As someone else commented, SNI appeared in 2003. Was all SSL-enabled software written after 2003 SNI-enabled? Why not? There are still many https websites that do not require SNI. God bless them. Perhaps they can afford a dedicated IP and do not need to engage in virtual hosting.
- johncolanduoni 10y ago
  > I do not use Windows. I do not use the kernel or the browser you use. It is not your business what I use anyway. I just said that because it's the only one I can think of people still having around that doesn't support SNI. OpenSSL, NSS, etc. have all supported SNI for a decade. In fact, I can't find any TLS implementation that supports even TLS 1.1 that doesn't support SNI. So unless you have an example I'd say SNI reached fixation a long time ago. > Notice I never said TLS sucks, you did. From another one of your comments: "I would not use SSL. Why spend time learning and fiddling with something that is so flawed?". Using TLS definitely counts as fiddling with SSL (TLS is a derivative). > Maybe I do not care about security and I just like carefully written software by people who do not make many mistakes? Is there something offensive about that? Am I allowed to make my own choices of software? Sure, write your own SSL/TLS/CurveCP implementation. But you started with "Just say no to SNI" and claimed privacy advocates should push back on it, which obviously doesn't only apply to you.
  - gwu78 10y ago
    Do you like to make all sorts of assumptions about users, what software they use, what software they "should" use and what software "no one uses"? I don't. Unlike many forum commenters, I do not try to convince people what software to use. I am not telling any users to stop using SSL. (Even though I strongly dislike it myself.) I am only addressing SNI, an extension to SSL that has become widespread in recent years. Unlike you, I am not making presumptions about other users (except perhaps that some value privacy). They might know about some software I don't. I do not conclude "Well, that's all I can think of, so it must be everything that is worth considering." If someone asks me how to do something using SSL libraries I am always going to say I would not use those. I am just being honest. Next time I will not mention CurveCP. Then they will ask: So what would you use? If I say anything other than SSL/TLS, they will attack my choice even if they know nothing about it. A lot of very popular software is poor quality. That is my opinion. I do not choose software based on popularity. Sorry for not comporting to your assumptions. Pre-SNI: Domainnames encrypted. Post-SNI: Domainnames unencrypted. Fact. That is not the only reason a user could dislike SNI. But it is the one that is applicable to this news event. I think it is for users to decide whether they like SNI or not. And in my opinion silence does not necessarily mean they approve.

gwu78 10y ago

I do not use Windows. I do not use the kernel or the browser you use. It is not your business what I use anyway. Notice I never said TLS sucks, you did. Maybe I do not care about security and I just like carefully written software by people who do not make many mistakes? Is there something offensive about that? Am I allowed to make my own choices of software? This is all beside the point. I care about having to use SSL and now with SNI. It is a hassle. Whether one likes SSL or not. It makes everything more complicated. I believe there are too many websites encrypting content that honestly does not need to be encrypted. But I am sure they have their reasons. I know how old the RFC is, but only in recent years has SNI become widespread. Probably because of all the hype around https adoption. It is obvious that some people must care about privacy and/or security, or maybe they are just pretending to care? How else to explain the growth of https?

openasocket 10y ago
What browser are you using that makes SSL "a hassle," with or without SNI?
- gwu78 10y ago
  Any sslclient that has not been modified to accomodate SNI. As someone else commented, SNI appeared in 2003. Was all SSL-enabled software written after 2003 SNI-enabled? Why not? There are still many https websites that do not require SNI. God bless them. Perhaps they can afford a dedicated IP and do not need to engage in virtual hosting.
johncolanduoni 10y ago
> I do not use Windows. I do not use the kernel or the browser you use. It is not your business what I use anyway. I just said that because it's the only one I can think of people still having around that doesn't support SNI. OpenSSL, NSS, etc. have all supported SNI for a decade. In fact, I can't find any TLS implementation that supports even TLS 1.1 that doesn't support SNI. So unless you have an example I'd say SNI reached fixation a long time ago. > Notice I never said TLS sucks, you did. From another one of your comments: "I would not use SSL. Why spend time learning and fiddling with something that is so flawed?". Using TLS definitely counts as fiddling with SSL (TLS is a derivative). > Maybe I do not care about security and I just like carefully written software by people who do not make many mistakes? Is there something offensive about that? Am I allowed to make my own choices of software? Sure, write your own SSL/TLS/CurveCP implementation. But you started with "Just say no to SNI" and claimed privacy advocates should push back on it, which obviously doesn't only apply to you.
- gwu78 10y ago
  Do you like to make all sorts of assumptions about users, what software they use, what software they "should" use and what software "no one uses"? I don't. Unlike many forum commenters, I do not try to convince people what software to use. I am not telling any users to stop using SSL. (Even though I strongly dislike it myself.) I am only addressing SNI, an extension to SSL that has become widespread in recent years. Unlike you, I am not making presumptions about other users (except perhaps that some value privacy). They might know about some software I don't. I do not conclude "Well, that's all I can think of, so it must be everything that is worth considering." If someone asks me how to do something using SSL libraries I am always going to say I would not use those. I am just being honest. Next time I will not mention CurveCP. Then they will ask: So what would you use? If I say anything other than SSL/TLS, they will attack my choice even if they know nothing about it. A lot of very popular software is poor quality. That is my opinion. I do not choose software based on popularity. Sorry for not comporting to your assumptions. Pre-SNI: Domainnames encrypted. Post-SNI: Domainnames unencrypted. Fact. That is not the only reason a user could dislike SNI. But it is the one that is applicable to this news event. I think it is for users to decide whether they like SNI or not. And in my opinion silence does not necessarily mean they approve.