Hacker News new | ask | show | jobs
by kazinator 924 days ago
When standards remove the requirements for something after a period of obsolescence, that tends to send a message to the implementors to remove that from the software.

Users who still rely on that have to use the old software, against which there can be barriers:

- old executables don't run on newer OS (particularly in the Unix world).

- old source code won't build.

- old code won't retrieve the old data from the newer server it has been migrated do.

Things like that.

The barriers could be significant that even someone skilled and motivated such as myself would be discouraged.
1 comments
Avamander 924 days ago
> Users who still rely on that have to use the old software, against which there can be barriers

Not all reliance is reasonable though.

Some legacy software can only do SSLv3 or lower, does that mean the rest of the internet has to carry that support around? Abso-f-lutely not.

The same applies here. If you really need that ancient stuff that loses support, repackage them in newer encryption or remove the obsolete layer. It's highly probable that information no longer needs to stay encrypted at rest anyways.

link
kazinator 924 days ago
In my opinion, the Internet should not be removing support for older SSL. The highest SSL version that is common to server and client should always be used.
link
woodruffw 924 days ago
> The highest SSL version that is common to server and client should always be used.

That is how it works. What you're missing is that everyone, both servers and clients, agrees that supporting old SSL versions is a bad idea. And they're right.

link
kazinator 924 days ago
Since I don't agree, it cannot be everyone.

More precisely, I don't agree with web clients not connecting to old servers.

link
dale_glass 924 days ago
Security done properly requires some sacrifices. Keeping old insecure versions working means exposing users to trivial ways of breaking encryption.
link
kazinator 923 days ago
If that were the actual principle being accurately followed, the first feature to have been removed from browsers would have been plain HTTP before any version of SSL.

Plain HTTP is what people resort to when their browser refuses to connect to an old device or server using HTTPS, which is worse than old SSL.

link