This working group has failed

Re:This working group has failed by vacri on Tuesday January 07, 2014 @04:52AM (#7016456)

Following the thread, the TLS 1.2 spec was completed in 2008, but it wasn't supported in OpenSSL until mid-2012 - so anything that depends on OpenSSL had to wait until at least then, then go through the implentation and reshipping, then trickle on down to the end vendors. And with no-one using TLS 1.2 or having a need for it because it wasn't available, it was back-burnered by the browsers.

The follow-up comments paint a much fuller picture of why things are delayed, where the failures are, and what's going on.

[ Parent | on HN ]

Re:This working group has failed by makomk on Tuesday January 07, 2014 @06:12AM (#7016650)

If you read the follow-ups, it's not just that no-one used TLS 1.2 because it wasn't available, enabling support for it actually broke stuff for end users[1] - and the browser developers knew this was almost certain to be the case even without looking, because it almost always is.

Also, as the linked email points out, we shouldn't have needed TLS 1.2 in the first place in order to be secure. It was already known at the time TLS 1.0 was designed that they were doing things in ways likely to be insecure for no good reason, but they did it anyway.

[1] https://www.ietf.org/mail-archive/web/tls/current/msg10614.h...

[ Parent | on HN ]

Re:This working group has failed by fulafel on Tuesday January 07, 2014 @12:12PM (#7018360)

Buggy Middleboxes broke. They're increasingly preventing deployment of new protocols and apps on the internet.

[ Parent | on HN ]