Newsgroups: php.internals
Path: news.php.net
Xref: news.php.net php.internals:99226
Mailing-List: contact internals-help@lists.php.net; run by ezmlm
Received-SPF: pass (pb1.pair.com: domain gmail.com designates 209.85.223.170 as permitted sender)
MIME-Version: 1.0
In-Reply-To: <CANUQDChAh6pQb4P5Rk_39rwGyYtyq9_aSC6BSdC+od0mU-ceFg@mail.gmail.com>
References: <CANUQDChAh6pQb4P5Rk_39rwGyYtyq9_aSC6BSdC+od0mU-ceFg@mail.gmail.com>
Date: Mon, 29 May 2017 12:56:45 +0200
Message-ID: <CAF+90c83w0HrPssGvn72EBdGwUqrnPHCeuknaAgNfyE0QhLdUg@mail.gmail.com>
To: Niklas Keller <me@kelunik.com>
Cc: PHP Internals <internals@lists.php.net>
Content-Type: multipart/alternative; boundary="001a113effc600d04c0550a78b86"
Subject: Re: [PHP-DEV] [RFC][VOTE] Improved SSL / TLS constants
From: nikita.ppv@gmail.com (Nikita Popov)

--001a113effc600d04c0550a78b86
Content-Type: text/plain; charset="UTF-8"

On Mon, May 29, 2017 at 9:48 AM, Niklas Keller <me@kelunik.com> wrote:

> Morning,
>
> I hereby open the vote on the "Improved SSL / TLS constants" RFC.
>
> This RFC proposes to change PHP's TLS constants to sane values. This change
> has been avoided by the previous RFC for PHP 5.6 due to BC reasons. This
> RFCs favors better security instead of backwards compatibility with version
> intolerant and out of date servers.
>
> You can find the full RFC here:
> https://wiki.php.net/rfc/improved-tls-constants
>
> Regards, Niklas
>

I'd really prefer if this RFC targeted current patch branches. I see
minimal BC impact from the change (issues may only arise when communicating
with broken TLS implementations), while *not* making the change is
effectively a BC break as more servers stop supporting TLS 1.0.

For the lifetime of the 7.0 and 7.1 releases, it appears much more likely
to me that there will be more servers not supporting TLS 1.0 than servers
supporting only TLS 1.0 *and* having a broken version negotiation
implementation.

Nikita

--001a113effc600d04c0550a78b86--