Conversation
Notices
-
So this is really bad. Again. You may be wide open to MITM. Not just OpenSSL, also JSSE, LibRe-, Boring-, Mono ... https://www.smacktls.com/
- lnxw48 (Linux Walt) repeated this.
-
@clacke @lnxw48 I think this notion that SSL implementations must continue to support all ciphers, good, bad, or indifferent, needs to be deep-sixed. If a cipher is shit, it needs to be flushed down the toilet, hopefully never to be smelled again.
-
@benfell I think that notion is already more or less dead and this batch of vulnerabilities are more due to neglect than active choice.
-
It may be dead, but I would argue that to leave these ciphers around is negligent; to have them used by …
-
@benfell I agree.