3 ms·

Seems to indicate it wasn't as urgent to disable these as professed. I think browser vendors are sometimes a little too quick to break things, glad to see this

Seems to indicate it wasn't as urgent to disable these as professed. I think browser vendors are sometimes a little too quick to break things, glad to see this pragmatism.

gpvos 7y ago
In the interest of security you can't wait for every last site to upgrade. But yes, reverting this is the right priority for the moment.
untog 7y ago
I’m not sure anyone ever indicated that it was urgent... it’s taken a long time for them to take this step! There’s an element of carrot and stick here, the browser vendors sometimes have to push people in the right direction. I think they’ve made the right call both in pushing for deprecation and altering their plans when circumstances have changed.
user5994461 7y ago
I assure you the browsers were not quick to disable TLS 1.0. They've dragged down their feet as long as they could and beyond. TLS 1.0 and previous protocols have been prohibited from usage since around 2017 by PCI DSS and most regulations. Any company that gets a basic security audit or self-submit their website to https://www.ssllabs.com/ssltest/ https://www.ssllabs.com/ssltest/ would have been red flagged for using TLS 1.0 for years. I've worked on the TLS upgrade in some financial institutions that notoriously always lag behind and even them have been ready for a while. At this stage websites stuck on TLS 1.0 are either unmaintained for years or purposefully trying to support a Windows XP and Java 7 audience.
- psadauskas 7y ago
  > At this stage websites stuck on TLS 1.0 are either unmaintained for years or purposefully trying to support a Windows XP and Java 7 audience. Or are using Heroku Automated Certificate Management https://help.heroku.com/G0YVUNPG/how-do-i-disable-support-for-tls-1-0-or-1-1-on-a-heroku-app https://help.heroku.com/G0YVUNPG/how-do-i-disable-support-fo...
  - 43920 7y ago
    As long as you support 1.2 as well (which Heroku does), you're fine; this is about sites that _only_ support 1.0 or 1.1.
  - deleted 7y ago
    [deleted]
detaro 7y ago
years after fatal flaws are known is "urgent"?

Seems to indicate it wasn't as urgent to disable these as professed. I think browser vendors are sometimes a little too quick to break things, glad to see this pragmatism.

gpvos 7y ago

In the interest of security you can't wait for every last site to upgrade. But yes, reverting this is the right priority for the moment.

untog 7y ago

I’m not sure anyone ever indicated that it was urgent... it’s taken a long time for them to take this step! There’s an element of carrot and stick here, the browser vendors sometimes have to push people in the right direction. I think they’ve made the right call both in pushing for deprecation and altering their plans when circumstances have changed.

user5994461 7y ago

I assure you the browsers were not quick to disable TLS 1.0. They've dragged down their feet as long as they could and beyond. TLS 1.0 and previous protocols have been prohibited from usage since around 2017 by PCI DSS and most regulations. Any company that gets a basic security audit or self-submit their website to https://www.ssllabs.com/ssltest/ https://www.ssllabs.com/ssltest/ would have been red flagged for using TLS 1.0 for years. I've worked on the TLS upgrade in some financial institutions that notoriously always lag behind and even them have been ready for a while. At this stage websites stuck on TLS 1.0 are either unmaintained for years or purposefully trying to support a Windows XP and Java 7 audience.

psadauskas 7y ago
> At this stage websites stuck on TLS 1.0 are either unmaintained for years or purposefully trying to support a Windows XP and Java 7 audience. Or are using Heroku Automated Certificate Management https://help.heroku.com/G0YVUNPG/how-do-i-disable-support-for-tls-1-0-or-1-1-on-a-heroku-app https://help.heroku.com/G0YVUNPG/how-do-i-disable-support-fo...
- 43920 7y ago
  As long as you support 1.2 as well (which Heroku does), you're fine; this is about sites that _only_ support 1.0 or 1.1.
- deleted 7y ago
  [deleted]

detaro 7y ago

years after fatal flaws are known is "urgent"?