4 ms·
Yikes. Backwards compatibility is tough. Strange that with the bump to 3.0 they didn’t at least announce the removal legacy primitives and TLS versions. Are th
by tatersolid 8y ago
Yikes. Backwards compatibility is tough.
Strange that with the bump to 3.0 they didn’t at least announce the removal legacy primitives and TLS versions. Are they going to support DES and RC4 forever?
- brians 8y agoIsn’t there something in here about a legacy module?
- userbinator 8y agoAre they going to support DES and RC4 forever? It might not be the exact use-case for OpenSSL but there's plenty of existing content or protocols using those algorithms, which no one is going to bother changing ("encrypted" PDFs come to mind). In any case not having RC4 isn't such a big deal; it's a tiny algorithm you could literally memorise and write into where it's needed (which I suspect is why it became so popular.) DES is a bit trickier though.
- tatersolid 8y agoLet PDF readers find their own DES library. Or at lest make its non-default part of the build. But even having it there as optional is risky and adds to an already huge maintenance burden. You know the distro packagers will enable every feature just like they did with DTLS support (which is what made Heartbleed pervasive). Packagers don’t want to deal with complaints and support tickets because their OpenSSL build doesn’t do 3DES. So they turn on all the things.