[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Date: Tue, 14 Oct 2014 08:23:23 -0700
From: Alex Gaynor <alex.gaynor@...il.com>
To: oss-security@...ts.openwall.com
Subject: Re: Truly scary SSL 3.0 vuln to be revealed soon:
At what point are we going to decide that it's absurd for every single TLS
deployment to need to reconfigure everything in order to achieve strong
security, and say that OpenSSL (or even Apache/Nginx/HAProxy/etc.) should
just configure things reasonably out of the box?
Alex
On Tue, Oct 14, 2014 at 7:38 AM, Reed Loden <reed@...dloden.com> wrote:
> -----BEGIN PGP SIGNED MESSAGE-----
> Hash: SHA1
>
> On Tue, 14 Oct 2014 13:15:41 +0200
> Hanno Böck <hanno@...eck.de> wrote:
>
> > A number of people already recommend disabling SSLv3, e.g. the Qualys
> > configuration guide. Disable it now - no matter if the rumors about a
> > serious vuln are true, you'll be safe.
>
> https://wiki.mozilla.org/Security/Server_Side_TLS has some great info
> on configuring your web servers and load balancers to have the best
> possible SSL/TLS settings, including specific example configs to help
> you out.
>
> ~reed
> -----BEGIN PGP SIGNATURE-----
> Version: GnuPG v2.0.22 (GNU/Linux)
>
> iKYEARECAGYFAlQ9NV5fFIAAAAAALgAoaXNzdWVyLWZwckBub3RhdGlvbnMub3Bl
> bnBncC5maWZ0aGhvcnNlbWFuLm5ldDZCNTZGOUFDMDdCNjg1RDdEQzQ1NjBEQTZC
> QTIyMjI2RjNDMzNENUEACgkQa6IiJvPDPVpviQCgkXv+V3uzoLKuNAITQt33kSn5
> upwAn0TxonRRgEPZYyqUaTIsRlgKkqm7
> =fmf8
> -----END PGP SIGNATURE-----
>
--
"I disapprove of what you say, but I will defend to the death your right to
say it." -- Evelyn Beatrice Hall (summarizing Voltaire)
"The people's good is the highest law." -- Cicero
GPG Key fingerprint: 125F 5C67 DFE9 4084
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
