News for hackers. Stuff that matters.
Re:Why SSL was renamed to TLS in late 90s (2014) by mcpherrinm on Monday June 16, 2025 @12:02AM (#44286517)
Well, my only real point is that it’s not the version negotiation in TLS that’s broken. It’s the workaround for intolerance of newer versions that had downgrade attacks.

Fortunately that’s all behind us now, and transitioning from 1.2 to 1.3 is going much smoother than 1.0 to 1.2 went.

Re:Why SSL was renamed to TLS in late 90s (2014) by tialaramex on Monday June 16, 2025 @05:23AM (#44287850)
One of the big differences was in attitude. The TLS 1.3 anti-downgrade feature was not compatible with some popular middlebox products. Google told people too bad, either your vendor fixes it (most shipped free bug fixes for this issue, presumably "encouraged" by the resulting customer anger) or you can't run Chrome once this temporary fudge goes away in a year's time.

Previously (in earlier protocol versions) nobody stood up to the crap middleboxes even though it's bad for all normal users.

Re:Why SSL was renamed to TLS in late 90s (2014) by drob518 on Monday June 16, 2025 @09:24AM (#44289283)
The service providers were the worst offenders here because they wanted to be the MIM to be able to look at the data and “add value” to their networks some how. Moving to TLS 1.3 took a lot of that away from them and it was only Google’s market power that could break them.
Re:Why SSL was renamed to TLS in late 90s (2014) by frollogaston on Monday June 16, 2025 @04:26PM (#44293083)
Similar thing has been happening with email sender auth, with Gmail and other big providers enforcing things
Re:Why SSL was renamed to TLS in late 90s (2014) by adgjlsfhk1 on Monday June 16, 2025 @03:18PM (#44292577)
Any chance that can be used to undo lots of the ossification that made QUIC a UDP based hack rather than it's own level 4 protocol?
Re:Why SSL was renamed to TLS in late 90s (2014) by frollogaston on Monday June 16, 2025 @03:56PM (#44292885)
It's probably too hard to get NATs to agree on a new L4 protocol.
Re:Why SSL was renamed to TLS in late 90s (2014) by ekr____ on Monday June 16, 2025 @07:21PM (#44294271)
Basically none.

First the success rate of any new IP-based protocol through most devices is incredibly low, especially now that NAT is so common.

Second, part of why QUIC runs over UDP is because the operating system generally won't let applications send raw IP datagrams.

Even running over UDP, QUIC has nontrivial failure rates and the browsers have to fall back to TLS over TCP.