Re: [TLS] Proposed text for removing renegotiation

["[e-mail]" <[e-mail]>]

On 17 Jun 2014, at 22:56, Daniel Kahn Gillmor <[e-mail]> wrote:

> 
> But I suspect most application developers who use TLS don't understand
> that the authentication state or cryptographic protections of the
> connection may change mid-stream.  Of the minority that does understand
> that this state may change, i suspect that many of them don't actually
> handle the situation well (if at all).
> 
> if we want to avoid this on the implementation side, do we need more
> guidance to implementers of TLS stacks?  or guidance for
> application-layer users of those stacks?  or both?


Take this as someone who has come from Java land and has recently moved to Scala-land.
In Java in 1995 the aim was to make APIs very easy to use, for developers used to
thinking in single threaded manners. But currently with the deployment of
multi-core cpus ( Eg. Sun Microsystems T5 with 16 cores and 8 threads per
core for a total of 128 threads, which in an 8 socket system can lead to 
1024 thread system ) and the growth of web apis, functional programming languages 
such as Scala are coming to the fore. Very good libraries are being developped there such
as the actor framework at https://akka.io/ with very good marketing for
concepts such as reactive programming ( http://www.reactivemanifesto.org/ )
and Reactive Streams ( http://spray.io/scaladays2014/ ) which is making it
much easier to code such mid-stream changes, and to think about these issues.

In the past few years of programming in this space I have learned more than
I had in the previous 10 years of programming. In short: programming has become 
enjoyable again, and in great part due to the development of these frameworks.

I just thought I'd mention that, as what may have been difficult 10 years ago,
has perhaps now become easy. So such implementor guidance should take into
account these changes.

All the best,

	Henry Story

PS. a bit of background on me:
   http://www.australianscience.com.au/interviews/henry-story-a-social-web-architect/

Social Web Architect
http://bblfish.net/