3 ms·

So this isn't just a thing where I update openssl? I have to learn about configuring cyphers on short notice?

• orblivion 12y ago
  I hate to be a jerk about this, but this isn't a rhetorical question. Are there any simple instructions? 1 2 3 and you're fixed? Why didn't this come on the same page as the disclosure? (that last question can be taken as rhetorical, for now) https://wiki.mozilla.org/Security/Server_Side_TLS#Recommended_configurations https://wiki.mozilla.org/Security/Server_Side_TLS#Recommende... That's not exactly simple. http://blog.commando.io/the-perfect-nginx-ssl-configuration/ http://blog.commando.io/the-perfect-nginx-ssl-configuration/ That isn't very simple either, and it's only for nginx. This is all asking me to learn about ciphers to patch a security hole (and know for sure that it's patched). I don't think it's unreasonable to expect otherwise for a security hole. A few people voted up my parent comment so I don't think I'm alone in this. For me personally, the only important thing I have is on Heroku, which I presume has its own set of instructions, which they somehow haven't executed themselves or emailed us about yet. Unless this also affects SSH?