Newsgroups: php.internals
Path: news.php.net
Xref: news.php.net php.internals:71764
Mailing-List: contact internals-help@lists.php.net; run by ezmlm
Received-SPF: pass (pb1.pair.com: domain gmail.com designates 209.85.160.175 as permitted sender)
MIME-Version: 1.0
In-Reply-To: <CAH8MpnmVnYiw7nJ11v+h=31+p+HBopBjJ80afpZkW-bW1LJb2A@mail.gmail.com>
References: <CAH8MpnmVnYiw7nJ11v+h=31+p+HBopBjJ80afpZkW-bW1LJb2A@mail.gmail.com>
Date: Thu, 30 Jan 2014 00:16:32 +0000
Message-ID: <CALwr1GnCqXZUk5zDfmtBa8cqmZS9qiGxVtc0JAbpShsJPodhtw@mail.gmail.com>
To: Daniel Lowrey <rdlowrey@gmail.com>
Cc: "internals@lists.php.net" <internals@lists.php.net>
Content-Type: multipart/alternative; boundary=001a11c2009e3bfe1604f124f854
Subject: Re: [PHP-DEV] Re: Improved TLS Defaults
From: padraic.brady@gmail.com (=?UTF-8?Q?P=C3=A1draic_Brady?=)

--001a11c2009e3bfe1604f124f854
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: quoted-printable

Hi Daniel,

On 29 January 2014 19:10, Daniel Lowrey <rdlowrey@gmail.com> wrote:

> Hello internals!
>
> I've added a major new section to the Improved TLS Defaults RFC which can
> be found here:
>
> https://wiki.php.net/rfc/improved-tls-defaults#stream_wrapper_creep
>
> I was initially hesitant to include these changes in the RFC because they
> have no BC implications. However, upon further contemplation I think the
> proposed deprecations in the new "Stream Wrapper Creep" section are
> important to incorporate as part of the larger theme of improving the
> default level of TLS security in 5.6. In my opinion it's only sensible to
> apply as many TLS improvements as possible in one release instead of
> stringing them out across multiples.
>

Here's a good recent study on SSL/TLS use in the Alexa Top 1,000,000 sites:
https://jve.linuxwall.info/blog/index.php?post/TLS_Survey

What I took away from it was that SSLv2 was exclusively used by only 38
sites (so time for that to go in line with everyone else out there!). SSLv3
has an exclusive use rate of just under 1%. These are likely holdouts that
will fade in time, but a 1% rate isn't quite to the point of extinction. I
think we should hold off on throwing errors until v3 drops to a more
negligible level. The current supported range on Firefox, for example, has
a minimum of SSLv3. Yes, this is hardly paradise, but so long as we're
negotiated from TLS 1.2 down (presumably the case at present!) then we
should let users accept the risk for SSLv3 only sites without kicking up
too much of a fuss for now.

SSLv2 - nuke it :P

Paddy

--
P=C3=A1draic Brady

http://blog.astrumfutura.com
http://www.survivethedeepend.com
Zend Framework Community Review Team
Zend Framework PHP-FIG Representative

--001a11c2009e3bfe1604f124f854--