|
Message-ID: <CALi+ztEa-M_-WRoFN6bfBSyfQ+D4rgYa1dka1BV8-EMR7noV+A@mail.gmail.com> Date: Fri, 15 Nov 2013 11:18:33 -0800 From: Chris Palmer <snackypants@...il.com> To: oss-security@...ts.openwall.com Subject: Re: cryptographic primitive choices [was: Re: Microsoft Warns Customers Away From RC4 and SHA-1] On Thu, Nov 14, 2013 at 10:58 PM, Kurt Seifried <kseifried@...hat.com> wrote: > Compatibility, for example HTTPS, you can disable a lot but if you > only allowed one cipher chances are a good chunk of clients wouldn't > be able to connect. There's a LOT of software out there, some open > source, some commercial, some written in house, it all uses encryption > and signing (usually wrongly, sigh) and a lot of it cannot or will not > be updated any time soon, if at all. Think of all the devices that act > as a web client and will never have TLS 1.2 support (e.g. "smart" TVs) > for example. Would I prefer the world to ditch SSL, TLS 1.0 and 1.1 > and move to TLS 1.2 entirely? Of course. Is it going to happen? Not > for a loooong time. > > Think of all the things that currently use (often older versions of) > OpenSSL/PolarSSL/GnuTLS/etc and will never get updated... I posit that there is a strong correlation between un-updated, un-updatable software that did not ship with (for example) support for modern cipher suites and protocols, and software that should be recalled for a variety of reasons. Random example: https://securityledger.com/2013/08/samsung-smart-tv-like-a-web-app-riddled-with-vulnerabilities/ Let's unpack your use of the passive voice: Who, exactly, is choosing not to update the OpenSSL they ship? Why do we forgive that? To an extent, even security engineers are acting as enablers, allowing obsolete software/protocols/cipher suites to live far longer than they should have. "LTS", "ESR", and not EOL'ing Windows XP 4+ years ago is a significant part of the problem.
Powered by blists - more mailing lists
Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.
Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.