Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Why SSL was renamed to TLS in late 90s (2014)

tim.dierks.org

Post reply on HN
Print view View original

211–220 of 237 posts

Re: Why SSL was renamed to TLS in late 90s (2014)

#211

Post by frollogaston »

meepmorp wrote: post #171
frollogaston wrote: post #103

Earlier quoted context omitted.

If a protocol is widely used wrongly, I consider it a flaw in the protocol. But overall, SSL standardization has gone decently well. I always bring it up as a good example to contrast with XMPP as a bad example.

> I always bring it up as a good example to contrast with XMPP as a bad example. Could you expand a bit here? Do you just mean how extensions to the protocol are handled, etc., or the overall process and involved parties?

XMPP is too loose. Easiest comparison is security alone. XMPP auth and encryption are complicated, and they're optional for each of c2s, s2c, s2s (setting aside e2e). Clients and servers will quietly do the wrong thing if not configured exactly right. Email has similar problems, so bad that entire companies exist just to help set up stuff like DMARC, but that's a simpler app than instant messaging. The rest of the XMPP feature set is also super loose. Clients and servers never agree on what extensions to implement, even for very basic things like chat rooms. I really tried to like it before giving up.

Edit: https://wiki.xmpp.org/web/Securing_XMPP

SSL is appropriately strict. Auth and encryption, both c2s and s2c, go together. They were a bit lax on upgrades in the past, but as another comment said, Google just said you fix your stuff or else Chrome will show a very scary banner on your website. Yes you can skip it or force special things like auth without encryption, but it's impossible to do by accident.

Re: Why SSL was renamed to TLS in late 90s (2014)

#212

Post by meepmorp »

frollogaston wrote: post #211
meepmorp wrote: post #171

Earlier quoted context omitted.

> I always bring it up as a good example to contrast with XMPP as a bad example. Could you expand a bit here? Do you just mean how extensions to the protocol are handled, etc., or the overall process and involved parties?

XMPP is too loose. Easiest comparison is security alone. XMPP auth and encryption are complicated, and they're optional for each of c2s, s2c, s2s (setting aside e2e). Clients and servers will quietly do the wrong thing if not configured exactly right. Email has similar problems, so bad that entire companies exist just to help set up stuff like DMARC, but that's a simpler app than instant messaging. The rest of the XM…

thanks for taking the time to respond!

Re: Why SSL was renamed to TLS in late 90s (2014)

#213

Post by unaindz »

dylan604 wrote: post #177
ozim wrote: post #151

Earlier quoted context omitted.

It is like ages since SSL was obsoleted but people still refer to the name meaning encrypted network traffic. Would be much easier if everyone just talks about TLS to mean modern encrypted network traffic. Mention SSL if you really use it because you have legacy system running.

People still say Twitter instead of X. Of course people are going to continue using the name used when something was first introduced and engrained into their day to day vs the rebrand. It would be funny if ssl.com just redirects to tls.com and get upset when people still refer to it as ssl. The only successful rebrand attempts have been company names like when Comcast became Xfinity or MCI becoming Worldcom type sit…

I agree with all except your example. TLS and SSL are about the same memorability wise, Twitter and X are not. If we were talking about a porn website it would be the inverse.

Re: Why SSL was renamed to TLS in late 90s (2014)

#214

Post by dylan604 »

unaindz wrote: post #213
dylan604 wrote: post #177

Earlier quoted context omitted.

People still say Twitter instead of X. Of course people are going to continue using the name used when something was first introduced and engrained into their day to day vs the rebrand. It would be funny if ssl.com just redirects to tls.com and get upset when people still refer to it as ssl. The only successful rebrand attempts have been company names like when Comcast became Xfinity or MCI becoming Worldcom type sit…

I agree with all except your example. TLS and SSL are about the same memorability wise, Twitter and X are not. If we were talking about a porn website it would be the inverse.

The fact that they still refer to them as tweets is another thing. What would they call them instead, exes? Those are best kept in Texas.

Re: Why SSL was renamed to TLS in late 90s (2014)

#215

Post by adgjlsfhk1 »

tialaramex wrote: post #147
mcpherrinm wrote: post #108

Earlier quoted context omitted.

Well, my only real point is that it’s not the version negotiation in TLS that’s broken. It’s the workaround for intolerance of newer versions that had downgrade attacks. Fortunately that’s all behind us now, and transitioning from 1.2 to 1.3 is going much smoother than 1.0 to 1.2 went.

One of the big differences was in attitude. The TLS 1.3 anti-downgrade feature was not compatible with some popular middlebox products. Google told people too bad, either your vendor fixes it (most shipped free bug fixes for this issue, presumably "encouraged" by the resulting customer anger) or you can't run Chrome once this temporary fudge goes away in a year's time. Previously (in earlier protocol versions) nobody…

Any chance that can be used to undo lots of the ossification that made QUIC a UDP based hack rather than it's own level 4 protocol?

Re: Why SSL was renamed to TLS in late 90s (2014)

#217

Post by immibis »

Timothycquinn wrote: post #66

Considering that Microsoft was a completely different beast in that time, I'm not surprised it does not seem that silly. M$ (appropriate name for that time) of the day was doing its best to own everything and the did not let up on trying to hold back the open source internet technologies until the early 2010's I believe. Its my opinion that they were successful in killing Java Applets, which were never able to improv…

Microsoft is still trying to hold back everything they can - they're just losing.

Re: Why SSL was renamed to TLS in late 90s (2014)

#219

Post by timdierks »

disruptiveink wrote: post #23

Wait, but didn't TLS 1.0 have significant improvements over SSL 3.0? The article makes it seems that just a couple of things were tweaked just to make it different for the sake of being different.

The tweaks were minor (smaller than for any other version revision), and mostly just the IETF marking its territory and doing something other than blessing the SSL 3.0 protocol as-is.

Re: Why SSL was renamed to TLS in late 90s (2014)

#220

Post by timdierks »

cubes wrote: post #148

This brought me back. I was a member of the UC Berkeley Computer Science Undergraduate Association ( https://www.csua.berkeley.edu ) in the early aughts. Through the CSUA I came across a job posting for a sysadmin job at Skotos Tech ( https://www.skotos.net/ ), the multiplayer text games company Christopher Allen founded after his work at Consensus Development/Certicom to develop the SSL/TLS implementation for Netsca…

It has definitely been that.
Post reply on HN