3 ms·

This change will break my (and others) scanning the internet and enumerating supported cipher suites and server behavior. At least other footguns in Go are stu

• tptacek 5y ago
  It's already pretty common for people using Go's (excellent) TLS library for scanners to fork it; it's probably what you should do, because there's lots of opportunity for instrumentation that the library easily hosts but doesn't provide out of the box.
• FiloSottile 5y ago
  My first intuition for how to do that would be to only enable one cipher suite at a time, which still works with this change. Still, do feel welcome to open an issue, I can’t promise any specific outcome but we’ll look at it. I’ll mention that we had to ignore the requirements of diagnostic and scanning tools in the past, and you might be better served by a fork like BoGo from the BoringSSL test suite. Fundamentally, what an application wants (“make a secure connection”) is at odds with what a test tool wants (“make a connection potentially broken in one of a thousand different ways, and tell me how it went”).
• Thorrez 5y ago
  Are you already lacking the ability to scan TLS 1.3 ciphers? Because it sounds like Go never provided the ability to order them.