9front - general discussion about 9front
 help / color / mirror / Atom feed
From: "Lyndon Nerenberg (VE7TFX/VE6BBM)" <lyndon@orthanc.ca>
To: 9front@9front.org, ori@eigenstate.org
Subject: Re: [9front] [patch] devtls updates
Date: Mon, 31 May 2021 15:46:38 -0700
Message-ID: <0322caee1c31f2fc@orthanc.ca> (raw)
In-Reply-To: <46CB8AE4EC1E0CAA7422ED81FB575A3C@eigenstate.org>

> Do you have specifics? I'd like to at least
> try to remove the blatantly broken stuff.

Just off the top of my head, SSH needs aes128-cbc in order to talk
to our HP 5500s.  As of OpenBSD 6.7 or so I have to explicitly
enable that on the client side, otherwise it won't negotiate.  Our
budget 3Com switches in the office are in the same boat (I can't
connect to them from home so I can't give you a model number
off-hand).  The latter also suffer from ancient TLS implementations
that require frobbing of hashes and ciphers, but again, I can't get
to them from here to look up the specifics.

In a nutshell I would preserve the functionality needed to wind back
to TLS 1.0, but disable negotiating anything that isn't required
for >= TLS 1.2 unless explicitly asked for by the user.

--lyndon

  reply	other threads:[~2021-05-31 23:32 UTC|newest]

Thread overview: 8+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2021-05-30 15:05 fulton
2021-05-31  0:03 ` Lyndon Nerenberg (VE7TFX/VE6BBM)
2021-05-31 15:37   ` ori
2021-05-31 22:46     ` Lyndon Nerenberg (VE7TFX/VE6BBM) [this message]
2021-06-02  0:38       ` ori
2021-06-02  4:30         ` Lyndon Nerenberg (VE7TFX/VE6BBM)
2021-05-31 11:45 ` cinap_lenrek
2021-05-31 16:16   ` fulton

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=0322caee1c31f2fc@orthanc.ca \
    --to=lyndon@orthanc.ca \
    --cc=9front@9front.org \
    --cc=ori@eigenstate.org \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link

9front - general discussion about 9front

This inbox may be cloned and mirrored by anyone:

	git clone --mirror http://inbox.vuxu.org/9front

	# If you have public-inbox 1.1+ installed, you may
	# initialize and index your mirror using the following commands:
	public-inbox-init -V1 9front 9front/ http://inbox.vuxu.org/9front \
		9front@9front.org
	public-inbox-index 9front

Example config snippet for mirrors.
Newsgroup available over NNTP:
	nntp://inbox.vuxu.org/vuxu.archive.9front


AGPL code for this site: git clone https://public-inbox.org/public-inbox.git