4 ms·
I doubt it has anything to do with the ciphers itself. That would impact far more than just SSLv3 and would also be easy to mitigate, 'disable these ciphers', s
by daenney 12y ago
I doubt it has anything to do with the ciphers itself. That would impact far more than just SSLv3 and would also be easy to mitigate, 'disable these ciphers', so much less need for the whole cloak-and-dagger thing that's going on.
A heads up is always useful. Knowing that a vulnerability is being disclosed tonight means I'll make sure to track that and react the second it becomes clear what's going on. That in turn means we'll either disable SSLv3 directly or roll out the patch if that's directly available, instead of only being aware of this after you wake up in the morning and have to hope to god no one used the vulnerability on you in the mean time.
- jerf 12y ago"I doubt it has anything to do with the ciphers itself." Me too, I just wanted to give a rich range of examples. I fear it will end up being the "turn off SSL 3.0 everywhere, it's now been rendered useless". "A heads up is always useful." Yes, but one slightly more useful would be even more useful, without having to be anywhere near detailed enough to give away the problem. If anything argues against this being serious it is that it is apparently not such a big deal that the actual responsible people feel a need to issue any sort of warning. While I fear the worst, here's hoping the Register is just fearmongering, as is their wont.
- armb 12y agoSince the heads up _as given_ turned out to be detailed enough to give away the problem, that's clearly false. https://bugzilla.mozilla.org/show_bug.cgi?id=1076983#c51 https://bugzilla.mozilla.org/show_bug.cgi?id=1076983#c51