Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Why SSL was renamed to TLS in late 90s (2014)

tim.dierks.org

Post reply on HN
Print view View original

111–120 of 237 posts

Re: Why SSL was renamed to TLS in late 90s (2014)

#111

Post by int_19h »

Timothycquinn wrote: post #66

Considering that Microsoft was a completely different beast in that time, I'm not surprised it does not seem that silly. M$ (appropriate name for that time) of the day was doing its best to own everything and the did not let up on trying to hold back the open source internet technologies until the early 2010's I believe. Its my opinion that they were successful in killing Java Applets, which were never able to improv…

I don't think it was Microsoft that killed Java applets. I mean, for one thing, they always worked in IE, which was really the only avenue through which MS could have affected them.

No, Java applets failed because they became the poster child for "Java is slow" take. Even though it wasn't exactly true in general, it was certainly true of applets, what with waiting for them to download and then waiting for the JVM to spin up.

What killed them was 1) HTML/JS itself getting better at dynamic stuff that previously required something like applets, and 2) Flash taking over the remaining niche for which HTML wasn't good enough.

Re: Why SSL was renamed to TLS in late 90s (2014)

#112

Post by theK »

sanswork wrote: post #75
jedberg wrote: post #27

Curious, when you tell someone they need to access a website securely (or any other case where you might use the term TLS or SSL), do you: 1. Say SSL or TLS? 2. How old are you (or did you start working before 1999?) I'll reply with my answer too.

SSL 42-started studying security in mid 90s as a teen started working 2000

Ah yes, it was a grand time, freeform studying IT security as a teen in the 90s!

Re: Why SSL was renamed to TLS in late 90s (2014)

#113

Post by grandiego »

Timothycquinn wrote: post #66

Considering that Microsoft was a completely different beast in that time, I'm not surprised it does not seem that silly. M$ (appropriate name for that time) of the day was doing its best to own everything and the did not let up on trying to hold back the open source internet technologies until the early 2010's I believe. Its my opinion that they were successful in killing Java Applets, which were never able to improv…

Applets died because of many reasons, like absurd startup time for the JRE (often just for silly animations), absurd memory requirements (for the time) and associated crashes, weird compatibility issues in the initial releases of the Java platform, a silly security model based on the assumption that only good actors will be able to get a CA certificate in order to do whatever they want in your PC, an immature sandboxing technology in browsers (not only IE), etc.

Re: Why SSL was renamed to TLS in late 90s (2014)

#114

Post by pcthrowaway »

ekr____ wrote: post #99
mcpherrinm wrote: post #92

Earlier quoted context omitted.

The downgrade attacks on TLS are only really present in the case of client behaviour where, on failing to achieve one version, they retry a new connection without it. This was necessary to bypass various broken server side implementations, and broken middleboxes, but wasn’t necessarily a flaw in TLS itself. But from the learnings of this issue preventing 1.2 deployment, TLS 1.3 goes out of its way to look very simila…

Moreover, there's not really much in the way of choices here. If you don't have this kind of automatic version negotiation then it's essentially impossible to deploy a new version.

You could deploy a new version, you'd just have older clients unable to connect to servers implementing the newer versions.

It wouldn't have been insane to rename https to httpt or something after TLS 1.2 and screw backwards compatibility (yes I realize the 's' stands for secure, not 'ssl', but httpt would have still worked as "HTTP with TLS")

Re: Why SSL was renamed to TLS in late 90s (2014)

#115

Post by OhNotAPaper »

> And of course, now, in retrospect, the whole thing looks silly.

Private enterprise should be the last people on earth to be allowed to label themselves. I have many marketer friends I love, but I truly think the practice of trying to pimp businesses to rich individuals has been probably the biggest waste of human effort in history (outside of maybe carbon-capture efforts). We're just stuck with shitty brands, broken products, and stupid consumers who think they're getting the best.

Re: Why SSL was renamed to TLS in late 90s (2014)

#116

Post by creatonez »

0xbadcafebee wrote: post #22
oc1 wrote: post #17

Earlier quoted context omitted.

Same. I feel so dumb now. After 15 years in this industry i finally figured out that ssl and tls are the same.

No no, they're not. They're names of specific protocols with specific capabilities and versions. "SSL 1.0" and "TLS 1.0" are very different. (see https://aws.amazon.com/compare/the-difference-between-ssl-an... ) The important bits: - "SSL" is a set of protocols so ridiculously old, busted and insecure that nobody should ever use them. It's like talking about Sanskrit; ancient and dead. - "TLS" is way better than "SSL…

The point is more that SSL 3.0 and TLS 1.0 were nearly identical. That is, the breaks in similarity were at SSL 2.0 -> SSL 3.0 (and TLS 1.2 -> TLS 1.3, to a lesser extent), as opposed to the common misconception that TLS 1.0 is what changed everything.

But yes, it's all a bit irrelevant now that anything below TLS 1.2 is sketchy to use.

Re: Why SSL was renamed to TLS in late 90s (2014)

#117

Post by invaliduser »

jedberg wrote: post #27

Curious, when you tell someone they need to access a website securely (or any other case where you might use the term TLS or SSL), do you: 1. Say SSL or TLS? 2. How old are you (or did you start working before 1999?) I'll reply with my answer too.

1. I say both somewhat 50/50. I say SSL instinctively, and TLS when I think about it and remember we don't say SSL anymore. It's been like that for around 10 years now, before that I'd only say SSL.

2. I started programming professionally in 1998 and I'm in my early 50s.

Re: Why SSL was renamed to TLS in late 90s (2014)

#118

Post by eptcyka »

notpushkin wrote: post #80
Timothycquinn wrote: post #66

Considering that Microsoft was a completely different beast in that time, I'm not surprised it does not seem that silly. M$ (appropriate name for that time) of the day was doing its best to own everything and the did not let up on trying to hold back the open source internet technologies until the early 2010's I believe. Its my opinion that they were successful in killing Java Applets, which were never able to improv…

> M$ (appropriate name for that time) It’s even more appropriate nowadays, I’d say.

Never not been appropriate.

Re: Why SSL was renamed to TLS in late 90s (2014)

#119

Post by wombatpm »

0xbadcafebee wrote: post #73
MOARDONGZPLZ wrote: post #49

Earlier quoted context omitted.

They are not. But a Chicago dog is meaningfully the same as a New York Dog (just with some more vegetables).

A Chicago dog is literally a hamburger with a different surface area. Same obscure ground beef, same vegetables, same bread. Just different dimensions. Who cares about the details, right?

I don’t know of anyone who puts celery salt on a hamburger.

Re: Why SSL was renamed to TLS in late 90s (2014)

#120

Post by josephg »

pcthrowaway wrote: post #114
ekr____ wrote: post #99

Earlier quoted context omitted.

Moreover, there's not really much in the way of choices here. If you don't have this kind of automatic version negotiation then it's essentially impossible to deploy a new version.

You could deploy a new version, you'd just have older clients unable to connect to servers implementing the newer versions. It wouldn't have been insane to rename https to httpt or something after TLS 1.2 and screw backwards compatibility (yes I realize the 's' stands for secure, not 'ssl', but httpt would have still worked as "HTTP with TLS")

> It wouldn't have been insane to rename https to httpt or something after TLS 1.2 and screw backwards compatibility

That would have been at least little bit insane, since then web links would be embedding the protocol version number. As a result, we'd need to keep old versions of TLS around indefinitely to make sure old URLs still work.

I wish we could go the other way - and make http:// implicitly use TLS when TLS is available. Having http://.../x and https://.../x be able to resolve to different resources was a huge mistake.

Post reply on HN