Re: [TLS] assert TLSext in renego-ServerHello instead of disable renego

[Bodo Moeller <[e-mail]>]

On Nov 15, 2009, at 12:02 PM, Marsh Ray wrote:
> Bodo Moeller wrote:

>> Why make a client send it on the initial handshake if that client
>> wouldn't have plans to abort the connection if the server doesn't
>> acknowledge it?  Interoperability seems easier if you don't send it.
>
> Network monitoring, intrusion detection, firewall systems.
>
> It seems client and server aren't the only parties to the protocol  
> anymore.

I've seen this line of argument in the discussion before.  However, I  
don't think it strongly suggests a particular answer to this question:

Arguably I'd rather have monitoring tell me about clients that will  
*tolerate* a handshake with a server that doesn't support the  
extension (not so much about clients that don't support the extension  
at all).  In that case, I wouldn't want these clients to send the  
extension on the initial handshake.

Bodo