Re: [TLS] Deployment ... Re: This working group has failed

[Hannes Tschofenig <[e-mail]>]

Hi Taylor,

Would be interesting to hear from someone working for Mozilla (like Ekr, 
our TLS WG chair) why things are progressing so slowly and what exactly 
their problem is.

Ciao
Hannes

Am 16.11.13 19:09, schrieb Taylor Hornby:
> On 11/16/2013 03:14 AM, Hannes Tschofenig wrote:
>> To be positive and constructive in the discussion I wonder what could be
>> done to improve the situation.
>>
>> Does the OpenSSL and the GnuTLS projects (and other projects) need more
>> contributors?
>>
>> Is there more awareness building needed to get companies to understand
>> what the different libraries provide and why they should use a
>> particular version?
>>
>> Where does the delay come from?
>>
>
> Firefox is one of the last browsers to get TLS 1.1 and TLS 1.2 support.
> It's still not enabled by default in the stable release. Looking at
> their development history is probably the best place to start.
>
> TLS 1.1:
>
> https://bugzilla.mozilla.org/show_bug.cgi?id=565047
> https://bugzilla.mozilla.org/show_bug.cgi?id=733647
>
> TLS 1.2:
>
> https://bugzilla.mozilla.org/show_bug.cgi?id=480514
> https://bugzilla.mozilla.org/show_bug.cgi?id=861266
>
> Most of the delay seems to be in Bug 565047. TLS 1.1 was standardized in
> 2006, but the *ticket* to implement TLS 1.1 was created FOUR YEARS
> later. Then, once it was, it took TWO YEARS to implement.
>
> Non-compliant servers are wasting a ton of time in QA, too:
>
> https://bugzilla.mozilla.org/show_bug.cgi?id=733647#c48
> https://bugzilla.mozilla.org/show_bug.cgi?id=839310
>
> Why doesn't TLS's fallback mechanism work?
>
> So, it seems to me that:
>
> 1. The most significant delay is between when the standard is released
> and when vendors realize they have to implement it. Until there's a
> problem with the old version, they're hardly thinking about it.
>
> 2. Once they do realize it's necessary, it takes a long time to implement.
>