3 ms·

Speaking from personal experience, it is necessary to update these references, because people implementing them have no choice but to follow the letter of the l

Speaking from personal experience, it is necessary to update these references, because people implementing them have no choice but to follow the letter of the law. I have worked on govt projects where we had to downgrade to an insecure cipher suite to comply with outdated regulations. Putting on my govt contractor hat, there may be a business opportunity here to set up VMs running Win95/Netscape Communicator for use by all the civil servants looking to comply with the law. Could charge a pretty penny too - it’ll all get budgeted as “Brexit compliance” costs.

Natsu 6y ago
> Speaking from personal experience, it is necessary to update these references, because people implementing them have no choice but to follow the letter of the law. That reminds me of FIPS for some reason...
sonotmyname 6y ago
> there may be a business opportunity here to set up VMs running Win95/Netscape Communicator for use by all the civil servants looking to comply with the law. The text quoted in the linked article in no way mandates the use of Netscape Navigator or Mozilla Mail - it merely references them as being widely distributed software capable of using RSA 1024 and SHA-1 (which it does appear to mandate).
- colejohnson66 6y ago
  It does mention AES-256. The pairing of that with SHA-1 and RSA-1024 is peculiar.