4 ms·
Wouldn't that be insecure? (using an old version of OpenSSL). Why don't you modify the hard-coded `no-ssl3` config and try re-compiling?
by gnulinux 4y ago
Wouldn't that be insecure? (using an old version of OpenSSL). Why don't you modify the hard-coded `no-ssl3` config and try re-compiling?
- Taywee 4y agoNot really insecure, because all communication over the public Internet is done on TLS 1.2+. Really, it's at worst as insecure as just using HTTP to the mitm proxy and then having the proxy do the encryption to the outside world, given that the SSL3 connection is entirely contained in a private network. I had actually suggested that initially, but the software refuses to communicate without SSL (which was a fine policy at the time). Also, SSL3 isn't actually that insecure when there is no possibility of controlling any aspect of client communication. > Why don't you modify the hard-coded `no-ssl3` config and try re-compiling? I was actually missing an option, but it still doesn't work with OpenSSL 3.0. Fortunately, 1.1.1 works with it just fine, including the latest version released just today.
- bombcar 4y agoThe idea is to wrap the insecure program in a system/network that “translates” it to whatever the current hotness is.