3 ms·
It wouldn’t have to be entirely different, it could just be a major version update. But the vast majority of sysadmins can understand and deploy a major version
by wrs 5y ago
It wouldn’t have to be entirely different, it could just be a major version update. But the vast majority of sysadmins can understand and deploy a major version update. The same cannot be said of specific algorithm ordering tradeoffs or other such detailed configuration.
- zamadatix 5y agoAgain you're just shifting the problem one layer up not solving it. The burden on the sysadmin is it knowing which version to connect with for a particular remote resource. They don't care if that's knowing it's algorithm set 4 or protocol version 4 (which uses algorithm set 4 behind the scenes) since the actual problem is they aren't checking the remote resource to see if it matches prior to connecting. And just the same as using algorithm set 3 to connect to a MITM proxy for a device that should have used algorithm set 4 you'll also have the same problem using protocol version 3 to a MITM proxy for a device that should have used protocol version 4.
- wrs 5y agoAgreed, it’s definitely best to just never change the protocol. But if you do have to change it someday (quantum cryptanalysis?) it’s better to have a single setting introduced at that point than to have 15 settings with no correct answer introduced at the very beginning.