Yo Richard! On Fri, 1 Feb 2019 21:24:06 -0600 Richard Laager via devel <devel@ntpsec.org> wrote:
> On 2/1/19 9:07 PM, Richard Laager wrote: > > On 2/1/19 7:56 PM, Gary E. Miller via devel wrote: > >> "tlsver [1.2 1.3]* > > If forcing a maximum version (e.g. for testing) is important, tlsver > > seems like a good approach. > > Another approach would be to allow specifying a minimum and maximum > version. That's what Firefox recently did, citing "We need policies > for min/max TLS to be consistent Chrome and for the DOD STIG." > > https://bugzilla.mozilla.org/show_bug.cgi?id=1522182 That could work. I am used to how Apache, sendmail and postfix do it, which is by using a plain list. The problem is when the change from TLS to XXX, like the change from SSL to TLS, which broke all the softeare using a min/max. > So maybe that's a better way. Flip a coin. > I'm not familiar with DOD security policies, so I'm not able to find a > reference either way as to whether a _maximum_ TLS version setting is > required. As a practical matter, in the current world where TLS 1.3 does not really exist, a max of 1.2 makes sense. Gonna be a long time before 1.3 works. RGDS GARY --------------------------------------------------------------------------- Gary E. Miller Rellim 109 NW Wilmington Ave., Suite E, Bend, OR 97703 g...@rellim.com Tel:+1 541 382 8588 Veritas liberabit vos. -- Quid est veritas? "If you can’t measure it, you can’t improve it." - Lord Kelvin
pgpnoBk0odkmp.pgp
Description: OpenPGP digital signature
_______________________________________________ devel mailing list devel@ntpsec.org http://lists.ntpsec.org/mailman/listinfo/devel
