3 ms·

"Deprecate" means "to discourage use of", and it doesn't mean "to end support or to desupport". But it's the most misused word in tech that I've seen in the pas

"Deprecate" means "to discourage use of", and it doesn't mean "to end support or to desupport". But it's the most misused word in tech that I've seen in the past 25 years. So I'm not actually sure if this RFC is using it in the correct way, or the incorrect way.

Bjartr 6y ago
> Deprecation of these versions is intended to assist developers as additional justification to no longer support older (D)TLS versions and to migrate to a minimum of (D)TLS 1.2. Seems to me like this document is trying to be a tool for developers to support telling decision makers that using those versions is discouraged.
- tialaramex 6y ago
  Right. One of the things it does is Update existing RFCs which are otherwise unrelated except that they say you must use TLS (fine) and that TLS 1.0 is Mandatory To Implement. Without this RFC, inevitably a bureaucrat in some organisation is going to argue that the shiny 2021 project to implement Protocol X must offer the horribly obsolete TLS 1.0 or a 3DES ciphersuite because it says so in this document written in 2010 and surely if that wasn't important it wouldn't say that. This RFC means you get to say no, see, that document you're pointing at has been updated by this newer document which says I can use TLS 1.2 and AES-128 instead as I was planning to before this stupid Zoom call I'm in now.
zokier 6y ago
https://www.merriam-webster.com/dictionary/deprecate https://www.merriam-webster.com/dictionary/deprecate > to withdraw official support for
bawolff 6y ago
IETF is a standards body. It doesn't provide support for implementations so im not sure how it could withdraw what it doesn't provide in the first place. Regardless i think you're splitting hairs in the definition.
staticassertion 6y ago
It's interesting that you're both literally incorrect from the perspective of the English language, but also incorrect with regards to the goal of the announcement. Kudos!
- ping_pong 6y ago
  I'm literally correct. Look up "to deprecate" in the dictionary. In APIs like Java it's clear that you can still use the API, but its use is discouraged because it will soon become unsupported. A deprecated API is one that you are no longer recommended to use, due to changes in the API. While deprecated classes, methods, and fields are still implemented, they may be removed in future implementations, so you should not use them in new code, and if possible rewrite old code not to use them. https://docs.oracle.com/javase/8/docs/technotes/guides/javadoc/deprecation/index.html https://docs.oracle.com/javase/8/docs/technotes/guides/javad...
  - staticassertion 6y ago
    Yeah, I mean, you look it up? lol someone even linked it elsewhere. And the article is about recommending against its use.
  - bawolff 6y ago
    Are you under the impression its now impossible to use TLS1.0? What exactly do you think would happen? The web security police come and arrest you?
rwbhn 6y ago
The intent seems clear, though: "TLS 1.0 MUST NOT be used" "TLS 1.1 MUST NOT be used"
tene 6y ago
What sort of "support" do you imagine the IETF should be offering, and to whom? The mission of the IETF is to produce high quality, relevant technical and engineering documents that influence the way people design, use, and manage the Internet in such a way as to make the Internet work better. These documents include protocol standards, best current practices, and informational documents of various kinds. https://datatracker.ietf.org/doc/rfc3935/ https://datatracker.ietf.org/doc/rfc3935/ This RFC is labeled "Best Current Practice". What else is "discouraging use of" if not publishing a document that asserts that the best current practice is to not use it? If you want the TLS 1.0 protocol specification, they still provide it in the same place as before, https://datatracker.ietf.org/doc/rfc2246/ https://datatracker.ietf.org/doc/rfc2246/

Bjartr 6y ago

> Deprecation of these versions is intended to assist developers as additional justification to no longer support older (D)TLS versions and to migrate to a minimum of (D)TLS 1.2. Seems to me like this document is trying to be a tool for developers to support telling decision makers that using those versions is discouraged.

tialaramex 6y ago
Right. One of the things it does is Update existing RFCs which are otherwise unrelated except that they say you must use TLS (fine) and that TLS 1.0 is Mandatory To Implement. Without this RFC, inevitably a bureaucrat in some organisation is going to argue that the shiny 2021 project to implement Protocol X must offer the horribly obsolete TLS 1.0 or a 3DES ciphersuite because it says so in this document written in 2010 and surely if that wasn't important it wouldn't say that. This RFC means you get to say no, see, that document you're pointing at has been updated by this newer document which says I can use TLS 1.2 and AES-128 instead as I was planning to before this stupid Zoom call I'm in now.

zokier 6y ago

https://www.merriam-webster.com/dictionary/deprecate https://www.merriam-webster.com/dictionary/deprecate > to withdraw official support for

bawolff 6y ago

IETF is a standards body. It doesn't provide support for implementations so im not sure how it could withdraw what it doesn't provide in the first place. Regardless i think you're splitting hairs in the definition.

staticassertion 6y ago

It's interesting that you're both literally incorrect from the perspective of the English language, but also incorrect with regards to the goal of the announcement. Kudos!

ping_pong 6y ago
I'm literally correct. Look up "to deprecate" in the dictionary. In APIs like Java it's clear that you can still use the API, but its use is discouraged because it will soon become unsupported. A deprecated API is one that you are no longer recommended to use, due to changes in the API. While deprecated classes, methods, and fields are still implemented, they may be removed in future implementations, so you should not use them in new code, and if possible rewrite old code not to use them. https://docs.oracle.com/javase/8/docs/technotes/guides/javadoc/deprecation/index.html https://docs.oracle.com/javase/8/docs/technotes/guides/javad...
- staticassertion 6y ago
  Yeah, I mean, you look it up? lol someone even linked it elsewhere. And the article is about recommending against its use.
- bawolff 6y ago
  Are you under the impression its now impossible to use TLS1.0? What exactly do you think would happen? The web security police come and arrest you?

rwbhn 6y ago

The intent seems clear, though: "TLS 1.0 MUST NOT be used" "TLS 1.1 MUST NOT be used"

tene 6y ago

What sort of "support" do you imagine the IETF should be offering, and to whom? The mission of the IETF is to produce high quality, relevant technical and engineering documents that influence the way people design, use, and manage the Internet in such a way as to make the Internet work better. These documents include protocol standards, best current practices, and informational documents of various kinds. https://datatracker.ietf.org/doc/rfc3935/ https://datatracker.ietf.org/doc/rfc3935/ This RFC is labeled "Best Current Practice". What else is "discouraging use of" if not publishing a document that asserts that the best current practice is to not use it? If you want the TLS 1.0 protocol specification, they still provide it in the same place as before, https://datatracker.ietf.org/doc/rfc2246/ https://datatracker.ietf.org/doc/rfc2246/