Re: [TLS] TLS 1.3 and vendor strings?

[Yuhong Bao <[e-mail]>]

I know, but they released an update to the 10.8 series to fix the problem and most users has installed it by now.

----------------------------------------
> Date: Thu, 21 May 2015 23:30:30 -0400
> Subject: Re: [TLS] TLS 1.3 and vendor strings?
> From: [e-mail]
> To: [e-mail]
> CC: [e-mail]
>
> On Thu, May 21, 2015 at 11:17 PM, Yuhong Bao <[e-mail]> wrote:
>> In this case, the pre-10.8.4 versions of OS X lost marketshare pretty quickly, I think by now it is less than 0.1% now.
>>
> Unfortunately, I have two OS X machines that are still in the 10.8
> series. That's because of Xcode/iOS support. I still need to support
> older version of iOS; and for that, I need an older version of Xcode;
> and for that, I need an older version of OS X.
>
> ... and the worst part is, its for dumb reasons, like Apple changed UI
> scheme to light blue text on white background. I literally cannot read
> the text, and had to hold back on upgrades so I could see it.
>
> Jeff
>
>>> Date: Thu, 21 May 2015 22:46:33 -0400
>>> From: [e-mail]
>>> To: [e-mail]
>>> Subject: [TLS] TLS 1.3 and vendor strings?
>>>
>>> Are there any plans to support free form vendor strings?
>>>
>>> The use case is similar to Apple's buggy ECDHE-ECDSA SecureTransport
>>> for OS X 10.8 and iOS 7.
>>>
>>> In this case, OpenSSL had to jump through a number of hoops to
>>> identify the potentially affected clients via fingerprinting.
>>> Fingerprinting was not precise, and it potentially captured unaffected
>>> clients when Apple patched at OS X 10.8.4 and iOS 7.0.3. That is, an
>>> OS X 10.8.5 or iOS 7.0.4 client would potentially be identified as
>>> buggy even though it was patched.
>>>
>>> Or is there another way to handle the occasional implementation bug like this?
>>>
>>> (And to be clear: patching is not always an option. Apple is not like
>>> Microsoft or Linux. Rather, they left a number of hosts unpatched for
>>> the ECDHE-ECDSA bug; and did the same with CVE-2015-1130 (Goto Fail);
>>> and did the same with CVE-2015-1130 (Hidden Backdoor)).
>>>