News for hackers. Stuff that matters.
Re:Removing Old Versions of TLS by jandrese on Monday October 15, 2018 @08:17PM (#18225324)
I kind of wish they'd leave the option to re-enable them in extreme circumstances. It's really annoying to try to bring up the web interface on some crusty old piece of hardware and discovering that the SSL/TLS negotiation can't find a workable solution.
Re:Removing Old Versions of TLS by Klathmon on Tuesday October 16, 2018 @05:10AM (#18227865)
At some point that code has to be removed. They can't keep every old option and code path around forever, it's just not sustainable.

There's a cost to using outdated systems, and this is it. If you need it, you can proxy requests to upgrade their protocol to something newer browsers speak, upgrade the device in question, keep old versions of browsers around for those single purposes (and probably gap that device as much as possible as it's now a much easier target for attackers).

Calling for all software to support all outdated options and code paths forever or even to always keep the code and flags or settings to enable it is absurd, and leads to unsustainable software that becomes impossible to change and improve.

Re:Removing Old Versions of TLS by CorpusCalcium on Monday October 15, 2018 @10:27PM (#18225908)
Assuming that device is actually worth accessing, then you could still keep and use an old version of a browser for that purpose. Newer browser versions should be pushing the web forward where possible.
Re:Removing Old Versions of TLS by jeroenhd on Tuesday October 16, 2018 @06:10AM (#18228094)
I agree with you in the case of old encryption methods (plain DES, RC4, NULL cipher) but not all protocol problems are because of the lack of a recent encryption algorithm.

There's heaps of old modems that use a weak DH key and will never see a firmware update. You're left with either accessing the device insecurely over HTTP, hoping your ISP will send you a new one (good luck with that) or paying for your own modem which will probably never be allowed on the ISPs network.

Weak DH keys should not be that hard to keep in the code base yet still most browsers will present an impassable TLS error screen.

Re:Removing Old Versions of TLS by CorpusCalcium on Tuesday October 16, 2018 @04:12PM (#18232829)
Those modems should no longer be being used, period. If someone cannot afford a replacement and has an incompetent ISP incapable of providing them with a subsidized replacement, then that is a separate problem that needs addressing as soon as possible.

Perpetuating it won't do, and if in doing so we're perpetuating a larger impending security issue, then we need to resolve it stat, not defer everything because there is heaps of old hardware lying around.

That may be easy to say and harder to resolve, but there comes a time when problems need to be resolved. Maybe that won't be 2020, if the desired timeline proves unrealistic, but two years is plenty of time to move on it. It generally takes far longer to deprecate and remove protocols from the web than it does to get a replacement modem.