Re: [TLS] Analysis of Interop scenarios TLS extension RI w/MCSV

[Nelson B Bolyard <[e-mail]>]

On 2009-12-11 15:07 PST, Martin Rex wrote:

> When I complained to the supplier of our OEM SSL implementation about
> an interop problem with TLS (not extension, only { 0x03, 0x01 }) in
> August 2000, then they told me that the behaviour was according to
> the SSLv3 spec.

They were mistaken about that, of course.  There never was ANY doubt or
controversy about how version negotiation was supposed to work.  Some
vendors just got it wrong.


>>> You could have removed the explicit expiration notice on draft302.txt
>>> and you could have renamed it to "3.0 final SPEC", you could have
>>> removed the version that you condered outdated--or at least clearly
>>> marked it as outdated _in_the_document_ if that was what you or
>>> Netscape intended it to be.
>>
>> I consciously chose to make NO changes at all to any of those documents,
>> lest anyone accuse Netscape of continuing to try to revise the SSL 3.0
>> specification rather than (or in parallel with) adopting the TLS 1.0
>> specification.
> 
> Regrettably you did _NOT_ remove the expiration tag from the draft302
> and did _NOT_ take down the outdated draft either.
> 
> You should have put up the "Beware of the Leopard" sign on your
> overview page to make the picture complete.

Just call me "Pounce". :)