3 ms·
I think the entire point is so that many with devices that will never see updates can still continue to use those devices.
by mjevans 2mo ago
I think the entire point is so that many with devices that will never see updates can still continue to use those devices.
- ImPostingOnHN 2mo agowhat stops folks from continuing to use them as-is, aside from this threat to break TLS 1.2 for them? if a service runs TLS 1.2, and a client runs TLS 1.2, and they can talk to each other right now, why change the language? if you released a thing, and people are choosing not to use it, is the right move really to enshittify their current choice to force them off it?
- 10000truths 2mo agoIf you control both the client and server, then yeah, you can use whatever protocol you want. Doesn't even need to be TLS, you could roll your own thing. But if you only control one of the endpoints, then your ability to connect to a peer depends on what the peer thinks. And if the peer follows a standard that says your offered ciphersuites are all insecure, then you're out of luck.
- magicalhippo 2mo ago> And if the peer follows a standard that says your offered ciphersuites are all insecure, then you're out of luck. Not even that. Many peers disconnect you if you offer any insecure cipher suite, in order to avoid downgrade attacks[1] presumably. So if such a peer is updated to match this RFC, you'll have to follow the RFC too if you want to talk to them. [1]: https://en.wikipedia.org/wiki/Downgrade_attack https://en.wikipedia.org/wiki/Downgrade_attack
- bigfatkitten 2mo agoNobody is waiting on an RFC to make configuration changes to those devices to disable old cipher suites.