Re: [TLS] Deployment ... Re: This working group has failed

[Watson Ladd <[e-mail]>]

TLS 1.2 solves the same problem as TLS 1.0. It should therefore have
the same API.
Somehow, having a state machine driven by data coming from a socket
driven by various options is
hard to design a good API around. (Seriously, transition(stateobject,
data_fed_in, length of data, data_maybe_coming_out, length_out) and
getcurrentstate(stateobject) together with some queries and setup of
options would do just fine.)

Part of the reason for the lack of updates is good Internet
citizenship brings no rewards. F5 customers don't give a damn about
holding the rest of
us back so long as that little lock icon still appears, embedded
device makers see no reason to upgrade, etc. Add this to the fight of
browser makers for market share, and anything that is good to do/has a
risk of breaking some sites will not get done.

The complexity of OpenSSL building, and most of the complexity of
OpenSSL is purely gratuitous. There is no reason it cannot be as clear
as the Go TLS library or PolarSSL.

This of course means that we have to live with whatever choices we
make for a long time, and ensure that implementations are simple
enough
to be bug-free.
Sincerely,
Watson Ladd