logoalt Hacker News

ImPostingOnHNtoday at 3:46 AM1 replyview on HN

what stops folks from continuing to use them as-is, aside from this threat to break TLS 1.2 for them?

if a service runs TLS 1.2, and a client runs TLS 1.2, and they can talk to each other right now, why change the language?

if you released a thing, and people are choosing not to use it, is the right move really to enshittify their current choice to force them off it?


Replies

10000truthstoday at 6:13 AM

If you control both the client and server, then yeah, you can use whatever protocol you want. Doesn't even need to be TLS, you could roll your own thing.

But if you only control one of the endpoints, then your ability to connect to a peer depends on what the peer thinks. And if the peer follows a standard that says your offered ciphersuites are all insecure, then you're out of luck.