> why is a slow deploy cycle ok for non-TLS vulnerabilities? Okay, this is a fair point. I'd say that TLS is something where fixing it faster than the baseline

> why is a slow deploy cycle ok for non-TLS vulnerabilities? Okay, this is a fair point. I'd say that TLS is something where fixing it faster than the baseline is possible, if it had configurable knobs. In general we should of course strive to have fast deploy cycles for security vulnerabilities of all kinds.