Re: [TLS] TLS 1.3 and vendor strings?

In this case, the pre-10.8.4 versions of OS X lost marketshare pretty quickly, I think by now it is less than 0.1% now.

----------------------------------------
> Date: Thu, 21 May 2015 22:46:33 -0400
> From: noloader@gmail.com
> To: tls@ietf.org
> Subject: [TLS] TLS 1.3 and vendor strings?
>
> Are there any plans to support free form vendor strings?
>
> The use case is similar to Apple's buggy ECDHE-ECDSA SecureTransport
> for OS X 10.8 and iOS 7.
>
> In this case, OpenSSL had to jump through a number of hoops to
> identify the potentially affected clients via fingerprinting.
> Fingerprinting was not precise, and it potentially captured unaffected
> clients when Apple patched at OS X 10.8.4 and iOS 7.0.3. That is, an
> OS X 10.8.5 or iOS 7.0.4 client would potentially be identified as
> buggy even though it was patched.
>
> Or is there another way to handle the occasional implementation bug like this?
>
> (And to be clear: patching is not always an option. Apple is not like
> Microsoft or Linux. Rather, they left a number of hosts unpatched for
> the ECDHE-ECDSA bug; and did the same with CVE-2015-1130 (Goto Fail);
> and did the same with CVE-2015-1130 (Hidden Backdoor)).
>
> _______________________________________________
> TLS mailing list
> TLS@ietf.org
> https://www.ietf.org/mailman/listinfo/tls