Newsgroups: php.internals
Path: news.php.net
Xref: news.php.net php.internals:101249
Mailing-List: contact internals-help@lists.php.net; run by ezmlm
Received-SPF: pass (pb1.pair.com: domain gmail.com designates 209.85.216.180 as permitted sender)
MIME-Version: 1.0
In-Reply-To: <02bbe666-d741-9bf0-3f01-760e15eadf11@rhsoft.net>
References: <a64088a5-e93b-3450-fe8c-8ba6ac9d851a@php.net> <CADNQb0VA+-E2B21EZCfzau7v0_0=SeheHB+cxZCsx7RoVNn8jA@mail.gmail.com>
 <41630a4e-8772-bdfb-e859-831a36dc67ea@rhsoft.net> <CANUQDCjsz31t-VqbLeUOc-qJd=wzQ8Tbk2UGhY-74xw+JaGHUA@mail.gmail.com>
 <e8b900c3-3d76-9fe0-7b96-3c1f468d160e@rhsoft.net> <CAESVnVqhNgge2dzHTbf1bCR0unGCYwEeDqS2ErWdyK34M26k6g@mail.gmail.com>
 <9f3d28e1-cc6d-d5dc-da04-7e3791070be8@rhsoft.net> <CAESVnVoWeNdh2R4KROe=CfACQVQJP9sf66iJASPp73nURi9ouw@mail.gmail.com>
 <35e8f8c5-8fe0-702b-f304-890cf902b390@rhsoft.net> <b9075c8d-a5e1-8b28-cde7-8a642abaf0d0@rhsoft.net>
 <CANUQDCgEqxAT4+kiTFsg7yxoktZ+upWV6OD7wW9ggME2OMcAfg@mail.gmail.com>
 <CAMPTd_A2DB4_mysLeaTkcNFTZtrseNqWsmtaxjG6E_vPo7ghkg@mail.gmail.com>
 <10a39b35-57e2-d6c4-ea3a-75b47d8df514@rhsoft.net> <CAMPTd_CrBtfh0BwP=_aqjyRV2qwTooDGAd+tU4+5m4cG=bsY4A@mail.gmail.com>
 <465bb952-7272-59fd-2232-10b41cd5efaf@rhsoft.net> <CAMPTd_DZmqQp92D+ZPJaux4vkRasmXh_htOPPdSaQx1+8Z-yDg@mail.gmail.com>
 <02bbe666-d741-9bf0-3f01-760e15eadf11@rhsoft.net>
Date: Tue, 5 Dec 2017 08:45:00 -0800
Message-ID: <CAMPTd_Bci1R47G-qgYUOEq8oUCxXKkF7RQMEMWx6d7Ri-_ANPA@mail.gmail.com>
To: "lists@rhsoft.net" <lists@rhsoft.net>
Cc: PHP Internals <internals@lists.php.net>
Content-Type: multipart/alternative; boundary="001a114a7bfa54af45055f9a8e30"
Subject: Re: [PHP-DEV] PHP 7.2.0 Released
From: walterp@gmail.com (Walter Parker)

--001a114a7bfa54af45055f9a8e30
Content-Type: text/plain; charset="UTF-8"

On Tue, Dec 5, 2017 at 12:54 AM, lists@rhsoft.net <lists@rhsoft.net> wrote:

>
>
> Am 05.12.2017 um 06:52 schrieb Walter Parker:
>
>> On Mon, Dec 4, 2017 at 6:27 PM, lists@rhsoft.net <mailto:lists@rhsoft.net>
>> <lists@rhsoft.net <mailto:lists@rhsoft.net>> wrote:
>>
>>     Am 05.12.2017 um 01:19 schrieb Walter Parker:
>>
>>         Oh, I see, this not about the actual change (the protocol
>>         version). This is about when using PHP on the client side, it
>>         does not support all/enough of the modern cipher suite list.
>>
>>         Now that we have identified the problem in question, this should
>>         help you when you create your RFC to fix issues with the cipher
>>         suite list.
>>
>>         FYI, the client and server send lists of ciphers that they
>>         support to each other, the server does an AND and picks the
>>         highest cipher in on the list. If the client sends only NULL,
>>         then NULL is the only valid cipher. OpenSSL has default list
>>         which includes weak ciphers (such as DES), so using the default
>>         list is bad idea
>>
>>     this is not true at all and that's why you use tools like
>>     https://www.ssllabs.com/ssltest/     and SSLHonorCipherOrder as
>> serveradmin for many years if you care
>>     about TLS at all
>>
>>     also the default openssl cipherlist is not just random
>>
>>     as you can see it prefers the ECDSA AES-GCM followed by the RSA
>>     AES-GCM and after the ECDHE it continues with other GCM ciphers na
>>     dthe DES/CBC stuff is at a place in the list which never is selected
>>     these days
>>
>> Your link doesn't say what you think it does
>>
>
> which one?
> https://www.ssllabs.com/ssltest/
>
> sorry, but if you don't know what ssllab does and how it is used by
> serveradmins to make sure clients using best possible encryption you are
> hardly in the position making comments like "OpenSSL has default list which
> includes weak ciphers (such as DES), so using the default list is bad idea"
> and instead abusive responses you could have entered the url of a TLS
> webserver
>
> Your follow up comments also appear to have little relevance to the topic
>> at hand.
>>
>
> correct and the reason is that i needed to give you some basic education
> how ciphers in the real world are negotiated
>
> Could someone please let me know if Lists ever get back on topic with
>> responses to the questions and statements made, rather than charging
>> sideways off the field?
>>
> go and provocate someone else when you make clueless statements like
> "OpenSSL has default list which includes weak ciphers (such as DES), so
> using the default list is bad idea"
>
>
> --
> PHP Internals - PHP Runtime Development Mailing List
> To unsubscribe, visit: http://www.php.net/unsub.php
>
> Lists, I give you the same advice. I know and use SSL Labs, I been a
subscriber to Ivan's mailing list for years. Older versions of Openssl had
a default list of +ALL, -aNULL, -eNULL as the default list of ciphers.
Before DES was removed in the new versions of openssl, that means the list
included things like DES and RC4. That is why server admins always spelled
out long lists of ciphers, to guarantee that weak ciphers would not appear
on older installs. I found this information by reading the code bases
themselves, where did you find your information?

I'm done with you. You don't understand and worse you don't want to
understand but think you understand. You just admitted to that. Please stop
until you get proper training as someone else on this list might make the
same mistakes that you are.



-- 
The greatest dangers to liberty lurk in insidious encroachment by men of
zeal, well-meaning but without understanding.   -- Justice Louis D. Brandeis

--001a114a7bfa54af45055f9a8e30--