From: ori@eigenstate.org
To: 9fans@9fans.net
Subject: [9fans] intent to delete: devssl, cpu, oexportfs, import
Date: Fri, 22 Oct 2021 19:43:15 -0400 [thread overview]
Message-ID: <8B3ADC2544348BBAA8EFB0A66615C430@eigenstate.org> (raw)
SSL 3.0 is implemented by devssl. It has been broken
since the POODLE and BEAST attacks in 2014.
However: it's hard-coded in cpu(1), oexportfs(4), and
import(4) via a call to pushssl(). I don't think it's
possible to upgrade them and keep the the protocol
compatible.
To use a working version of the TLS protocol, there's
going to have to be a clean break. The SSL and TLS
record formats seem incompatible, and there's no
version negotiation in cpu.
9front already deprecated cpu/import, with rcpu and
rimport as replacements, so this only affects 9legacy
to 9front communication.
It'd be nice to keep things interoperable without
patching.
Is there a path forward that doesn't leave us dragging
along a broken, obsolete SSL version forever?
------------------------------------------
9fans: 9fans
Permalink: https://9fans.topicbox.com/groups/9fans/T45587a22bb317243-Md4aba3c3b058795195e54f3d
Delivery options: https://9fans.topicbox.com/groups/9fans/subscription
reply other threads:[~2021-10-22 23:43 UTC|newest]
Thread overview: [no followups] expand[flat|nested] mbox.gz Atom feed
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=8B3ADC2544348BBAA8EFB0A66615C430@eigenstate.org \
--to=ori@eigenstate.org \
--cc=9fans@9fans.net \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).