Hacker News new | ask | show | jobs
by tyxodiwktis 2003 days ago
Speaking from personal experience, it is necessary to update these references, because people implementing them have no choice but to follow the letter of the law. I have worked on govt projects where we had to downgrade to an insecure cipher suite to comply with outdated regulations.

Putting on my govt contractor hat, there may be a business opportunity here to set up VMs running Win95/Netscape Communicator for use by all the civil servants looking to comply with the law. Could charge a pretty penny too - it’ll all get budgeted as “Brexit compliance” costs.
2 comments
sonotmyname 2003 days ago
> there may be a business opportunity here to set up VMs running Win95/Netscape Communicator for use by all the civil servants looking to comply with the law.

The text quoted in the linked article in no way mandates the use of Netscape Navigator or Mozilla Mail - it merely references them as being widely distributed software capable of using RSA 1024 and SHA-1 (which it does appear to mandate).

link
colejohnson66 2003 days ago
It does mention AES-256. The pairing of that with SHA-1 and RSA-1024 is peculiar.
link
Natsu 2003 days ago
> Speaking from personal experience, it is necessary to update these references, because people implementing them have no choice but to follow the letter of the law.

That reminds me of FIPS for some reason...

link