Date: Thu, 14 May 2015 10:24:18 -0500 From: Karl Denninger <karl@denninger.net> To: freebsd-security@freebsd.org Subject: Re: Forums.FreeBSD.org - SSL Issue? Message-ID: <5554BE22.1000407@denninger.net> In-Reply-To: <C6A26209-6DB6-4842-9810-B670E3461AAE@patpro.net> References: <CACRVPYOALi-V8D34zeJTYdSwHshYrqtttqVV3=aP8Yb6ZAxfyg@mail.gmail.com> <2857899F-802E-4086-AD41-DD76FACD44FB@modirum.com> <05636D22-BBC3-4A15-AC44-0F39FB265CDF@patpro.net> <20150514193706.V69409@sola.nimnet.asn.au> <555476CB.2010005@ivpro.net> <1431608885.1875421.268665801.1220FE34@webmail.messagingengine.com> <CAKE2PDtM6q14q2BdmB5PNht=Q3Q0VQRh64nh1Lfd9Y9uCryibw@mail.gmail.com> <C6A26209-6DB6-4842-9810-B670E3461AAE@patpro.net>
next in thread | previous in thread | raw e-mail | index | archive | help
[-- Attachment #1 --]
On 5/14/2015 10:20, Patrick Proniewski wrote:
> On 14 mai 2015, at 16:13, jungle Boogie wrote:
>
>> On 14 May 2015 at 06:08, Mark Felder <feld@freebsd.org> wrote:
>>> TLS 1.0 is dead and is even now banned in new installations according to
>>> the PCI DSS 3.1 standards. Nobody should expect TLS 1.0 to be supported
>>> by *any* HTTPS site now.
>>
>> Here, here! We ONLY have 1.0 enabled until the hardware vendor can
>> upgrade their software. I'm looking to celebrate the day when we have
>> 1.1 and 1.2 enabled.
>
> That's always the problem with guys like you and me who live in the real world. We can't cope with "what should be dead and no longer used". Deprecated tomcat/Java/SSL/You-name-it software that you can't just upgrade because it's used with hardware/software you can't get rid of.
> At work we are in the ridiculous state where we have to package old browser + old Java into VMware ThinApp "bubbles" to access production tools.
>
> Removing TSL 1.0 is not a good move. It's possible to provide SSL with TLS 1.2, having protection against protocol downgrade, and still provide TLS 1.1 and 1.0 for older browsers.
>
> patpro
> _______________________________________________
>
I'd love to lock out TLS 1.0 but if you do that anyone still running
anything that uses XP cannot connect.
There ARE people out there still using that in the wild. Not a huge
number, but a material number. On several relatively large systems I
monitor the "in the wild" user count for Windows XP is still around 4%
of all users to the sites.
Same problem with RC4. I'd love to lock that out too, but see above --
that means 4% of the users can't connect (at all.)
--
Karl Denninger
karl@denninger.net <mailto:karl@denninger.net>
/The Market Ticker/
[-- Attachment #2 --]
0 *H
01 0 + 0 *H
_0[0C)0
*H
01 0 UUS10UFlorida10U Niceville10U
Cuda Systems LLC1 0UCuda Systems LLC CA1"0 *H
Cuda Systems LLC CA0
150421022159Z
200419022159Z0Z1 0 UUS10UFlorida10U
Cuda Systems LLC1 0 UKarl Denninger (OCSP)0"0
*H
0
X@vkY
Tq/vE]5#֯MX \8LJ/V?5Da+
sJc*/r{ȼnS+ w")ąZ^DtdCOZ ~7Q '@a#ijc۴oZdB&!Ӝ-< ? HN5y
5}F|e f"V لio74zn">a1qWuɖbFeGE&3(KhixG3!#e_XƬ Ϝ/,$+;4y 'Bz<qT9_?rRUpn5
Jn&Rx/p Jyel*pN8/#9u/YP EC)TY>~/˘N[vyiDKˉ ,^" ?$T8 v& K%z8C @?K{9f`+@,| Mbia 007++0)0'+0http://cudasystems.net:88880 U 0 0 `HB0 U 0, `HB
OpenSSL Generated Certificate0 U -h\Ff Y0 U #0$q}ݽʒm50 U 0karl@denninger.net0
*H
Owbabɺx&Uk[ (Oj!%p MQ0I!#QH}.>~2&D}<wm_>V6 v ]f>=Nn+8;q wfΰ/RLyUG#b}n!Dր _up|_ǰc/%ۥ
nN8:d;-UJd/m1~VނיnN I˾$tF1&}|?q?\đXԑ&\4V<lKۮ3%Am_(q -(cAeGX)f}-˥6cv~Kg8m~v ;|9:-iAPқ6ېn-.)<[$KJtt/L4ᖣ^Cmu4vb{+BG$M0c\[MR|0FԸP&78"4p# }D Z9;V9#>Sw"[UP710001 0 UUS10UFlorida10U Niceville10U
Cuda Systems LLC1 0UCuda Systems LLC CA1"0 *H
Cuda Systems LLC CA)0 + !0 *H
1 *H
0 *H
1
150514152418Z0# *H
1Ynhc@e5І70l *H
1_0]0 `He*0 `He0
*H
0*H
0
*H
@0+0
*H
(0 +71001 0 UUS10UFlorida10U Niceville10U
Cuda Systems LLC1 0UCuda Systems LLC CA1"0 *H
Cuda Systems LLC CA)0 *H
101 0 UUS10UFlorida10U Niceville10U
Cuda Systems LLC1 0UCuda Systems LLC CA1"0 *H
Cuda Systems LLC CA)0
*H
K\PS=6ڎcZif oM0o\XPOI@ו )e$M|Eǧ9$&f3TۘD` -YbA< ^hD%O _)&c WS@ c_,ZVđVMwEC)"Ui%OE<z*)(NWJLX$q7ތ'TVuf\|^F6/ȱ1xTa*q{
Mkg澮'nw"@h#O"&(EhF'Zx;'0pogLe>>] 鬤3 U;QEbݣį43P6
1 dl/,
S1r!Ձ<J o}xiT<FPi. ⢓K~z)o ny[Dsy0P)qSwN%OczJ77E<6aW^sĬE{y S;ԸMuCO G
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?5554BE22.1000407>