Re:Why TLS 1.3 isn't in browsers yet
by jchw on Wednesday December 27, 2017 @07:43PM
(#16019394)
But this isn't fail-closed. The specification allows for newer versions. The problem is, you are supposed to spit back the version you actually support instead of disconnecting. I don't understand how this can be interpreted as anything but non-compliance of the standard.
[ Parent
| on HN ]
I would say that technically it's complaint because there's nothing saying a server can't tear down a connection whenever it wants.
Our InfoSec friends are rightfully suspicious of 'weird' looking packets and data from clients. It's one of the few ways to catch/stop zero day vulns. It does make things difficult when legitimate traffic is caught in the crossfire but such is the nature of most security practices.