3 ms·

> Today only 0.5% of HTTPS connections made by Chrome use TLS 1.0 or 1.1. Curious who the 0.5% are. Presumably Chrome is doing it's best to avoid falling back

by B-Con 8y ago

> Today only 0.5% of HTTPS connections made by Chrome use TLS 1.0 or 1.1. Curious who the 0.5% are. Presumably Chrome is doing it's best to avoid falling back to TLS 1.0 or 1.1 unless necessary, so presumably these are sites that just don't support 1.2. Apache added TLS 1.2 support 6.75 years ago: http://svn.apache.org/viewvc?view=revision&revision=1222922 http://svn.apache.org/viewvc?view=revision&revision=1222922 I'm curious how many of those sites just haven't upgraded their server in ~7 years.

tialaramex 8y ago
One thing that really stings here is that only the past few years have OS vendors, library vendors and so on started paying attention to how people use their crap to build things, and so software written / custom sites developed before that awakening are often flawed because the developers tried their best but weren't experts and weren't given the opportunity to ask for "You know, good security, whatever that is at the moment?" but had to pick specific values for things they didn't understand, including protocol versions, ciper suites, key lengths, trusted roots... For example, in Python you can ask for a specific TLS version ("Oooh, TLS 1.1 just came out, let's use that") or you can ask for what it calls "SSLv23" which means any protocol in the SSL/ TLS family whatsoever. But only in very recent 3.x Python releases can you easily specify "Um, anything above TLS 1.0 is OK?" even though that is clearly both more useful AND more likely to result in the software working as intended in future. In fact, software developers reading this: You probably didn't implement TLS yourself (OK, the six smug people thinking "Yes I did", this isn't for you, you've already read and perhaps written similar rants before). TLS 1.3 was finished earlier this year. How many programs that you wrote more than six months ago are you sure will "just work" with TLS 1.3 if the relevant libraries or OS features are upgraded to support it? How many do you think will tell the library/ OS/ framework/ whatever "Oh, no, I definitely want TLS 1.2" even though actually it wants security, and TLS 1.3 would improve that?
- regecks 8y ago
  > For example, in Python you can ask for a specific TLS version libcurl has the same thing. A really common problem in PHP ecommerce libraries and applications is the misuse of CURLOPT_SSLVERSION to pin a specific protocol version. Then their payments stop working every few years ...
zamadatix 8y ago
I wonder how much internal sites, hardware appliances, IPMIs, and other infrastructure hardware play into that number.

by B-Con 8y ago

tialaramex 8y ago

One thing that really stings here is that only the past few years have OS vendors, library vendors and so on started paying attention to how people use their crap to build things, and so software written / custom sites developed before that awakening are often flawed because the developers tried their best but weren't experts and weren't given the opportunity to ask for "You know, good security, whatever that is at the moment?" but had to pick specific values for things they didn't understand, including protocol versions, ciper suites, key lengths, trusted roots... For example, in Python you can ask for a specific TLS version ("Oooh, TLS 1.1 just came out, let's use that") or you can ask for what it calls "SSLv23" which means any protocol in the SSL/ TLS family whatsoever. But only in very recent 3.x Python releases can you easily specify "Um, anything above TLS 1.0 is OK?" even though that is clearly both more useful AND more likely to result in the software working as intended in future. In fact, software developers reading this: You probably didn't implement TLS yourself (OK, the six smug people thinking "Yes I did", this isn't for you, you've already read and perhaps written similar rants before). TLS 1.3 was finished earlier this year. How many programs that you wrote more than six months ago are you sure will "just work" with TLS 1.3 if the relevant libraries or OS features are upgraded to support it? How many do you think will tell the library/ OS/ framework/ whatever "Oh, no, I definitely want TLS 1.2" even though actually it wants security, and TLS 1.3 would improve that?

regecks 8y ago
> For example, in Python you can ask for a specific TLS version libcurl has the same thing. A really common problem in PHP ecommerce libraries and applications is the misuse of CURLOPT_SSLVERSION to pin a specific protocol version. Then their payments stop working every few years ...

zamadatix 8y ago

I wonder how much internal sites, hardware appliances, IPMIs, and other infrastructure hardware play into that number.