Re:Why TLS 1.3 isn't in browsers yet
by yeukhon on Wednesday December 27, 2017 @11:05PM
(#16020236)
> There is no signal to developers that an implementation is flawed, and so mistakes can happen without being noticed. That is, until a new version of the protocol is deployed and your implementation fails, but by then the code is deployed and it could take years for everyone to upgrade.
> If a protocol is designed with a flexible structure, but that flexibility is never used in practice, some implementation is going to assume it is constant.
Perhaps this is a naive thought. I remember several years ago Mozilla announced its experimental browser rendering engine (Servo) passed Acid 2 tests [1]. So why can't we come together and create such standard tests so that server implementers and middlebox implementers are encouraged to include them as part of their QA score?
I know this is an optional. There is no mandate, but it sounds like a start. Isn't there some network vendor organization the major players are part of?
> If a protocol is designed with a flexible structure, but that flexibility is never used in practice, some implementation is going to assume it is constant.
Perhaps this is a naive thought. I remember several years ago Mozilla announced its experimental browser rendering engine (Servo) passed Acid 2 tests [1]. So why can't we come together and create such standard tests so that server implementers and middlebox implementers are encouraged to include them as part of their QA score?
I know this is an optional. There is no mandate, but it sounds like a start. Isn't there some network vendor organization the major players are part of?
[1]: https://research.mozilla.org/2014/04/17/another-big-mileston...