Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Why SSL was renamed to TLS in late 90s (2014)

tim.dierks.org

Post reply on HN
Print view View original

141–150 of 237 posts

Re: Why SSL was renamed to TLS in late 90s (2014)

#141

Post by foresterre »

israrkhan wrote: post #78
jedberg wrote: post #27

Curious, when you tell someone they need to access a website securely (or any other case where you might use the term TLS or SSL), do you: 1. Say SSL or TLS? 2. How old are you (or did you start working before 1999?) I'll reply with my answer too.

I think most people call it SSL because they use OpenSSL library to deal with secure communication have SSL in their names. Openssl being the most dominant one). Other libraries are BoringSSL, LibreSSL, wolfSSL etc. Libraries with TLS in their names are less frequently used GnuTLS, mbedTLS, s2n-tls and RustTLS.

The Rust library is possibly funnily, possibly confusingly called RusTLS (1). It makes pronunciation a tad harder.

(1) https://crates.io/crates/rustls

Re: Why SSL was renamed to TLS in late 90s (2014)

#142

Post by account42 »

pcthrowaway wrote: post #114
ekr____ wrote: post #99

Earlier quoted context omitted.

Moreover, there's not really much in the way of choices here. If you don't have this kind of automatic version negotiation then it's essentially impossible to deploy a new version.

You could deploy a new version, you'd just have older clients unable to connect to servers implementing the newer versions. It wouldn't have been insane to rename https to httpt or something after TLS 1.2 and screw backwards compatibility (yes I realize the 's' stands for secure, not 'ssl', but httpt would have still worked as "HTTP with TLS")

Yes it would absolutely have been insane.

Re: Why SSL was renamed to TLS in late 90s (2014)

#143

Post by cobbaut »

jedberg wrote: post #27

Curious, when you tell someone they need to access a website securely (or any other case where you might use the term TLS or SSL), do you: 1. Say SSL or TLS? 2. How old are you (or did you start working before 1999?) I'll reply with my answer too.

1. SSL

2. I'm 56 and was active in computer clubs in the late 80s, no network, no hard drive, thousands of floppy's.

Re: Why SSL was renamed to TLS in late 90s (2014)

#144

Post by account42 »

cpach wrote: post #135
josephg wrote: post #120

Earlier quoted context omitted.

> It wouldn't have been insane to rename https to httpt or something after TLS 1.2 and screw backwards compatibility That would have been at least little bit insane, since then web links would be embedding the protocol version number. As a result, we'd need to keep old versions of TLS around indefinitely to make sure old URLs still work. I wish we could go the other way - and make http:// implicitly use TLS when TLS…

Regarding your last paragraph: Isn’t that pretty much solved thanks to HSTS preload? A non-technical author of a small recipe blog might not know how to set it up, but a bank ought to have staff (and auditors) who takes care of stuff like that.

It doesn't solve the problem of a client having to treat https:// and http:// URLs with the same string after the :// as distinct resources.

Re: Why SSL was renamed to TLS in late 90s (2014)

#145

Post by account42 »

Timothycquinn wrote: post #66

Considering that Microsoft was a completely different beast in that time, I'm not surprised it does not seem that silly. M$ (appropriate name for that time) of the day was doing its best to own everything and the did not let up on trying to hold back the open source internet technologies until the early 2010's I believe. Its my opinion that they were successful in killing Java Applets, which were never able to improv…

Microsoft hasn't really changed that much besides getting a better PR department.

Re: Why SSL was renamed to TLS in late 90s (2014)

#146

Post by cubefox »

int_19h wrote: post #111
Timothycquinn wrote: post #66

Considering that Microsoft was a completely different beast in that time, I'm not surprised it does not seem that silly. M$ (appropriate name for that time) of the day was doing its best to own everything and the did not let up on trying to hold back the open source internet technologies until the early 2010's I believe. Its my opinion that they were successful in killing Java Applets, which were never able to improv…

I don't think it was Microsoft that killed Java applets. I mean, for one thing, they always worked in IE, which was really the only avenue through which MS could have affected them. No, Java applets failed because they became the poster child for "Java is slow" take. Even though it wasn't exactly true in general, it was certainly true of applets, what with waiting for them to download and then waiting for the JVM to…

Java Applets also froze the entire browser when loading. Even more so than the Windows Media / QuickTime / Real Player plug-ins. Only the Flash plug-in didn't noticeably freeze the browser. It was heavily CPU optimized and even used AVX for rendering, as far as I remember.

Re: Why SSL was renamed to TLS in late 90s (2014)

#147

Post by tialaramex »

mcpherrinm wrote: post #108
frollogaston wrote: post #103

Earlier quoted context omitted.

If a protocol is widely used wrongly, I consider it a flaw in the protocol. But overall, SSL standardization has gone decently well. I always bring it up as a good example to contrast with XMPP as a bad example.

Well, my only real point is that it’s not the version negotiation in TLS that’s broken. It’s the workaround for intolerance of newer versions that had downgrade attacks. Fortunately that’s all behind us now, and transitioning from 1.2 to 1.3 is going much smoother than 1.0 to 1.2 went.

One of the big differences was in attitude. The TLS 1.3 anti-downgrade feature was not compatible with some popular middlebox products. Google told people too bad, either your vendor fixes it (most shipped free bug fixes for this issue, presumably "encouraged" by the resulting customer anger) or you can't run Chrome once this temporary fudge goes away in a year's time.

Previously (in earlier protocol versions) nobody stood up to the crap middleboxes even though it's bad for all normal users.

Re: Why SSL was renamed to TLS in late 90s (2014)

#148

Post by cubes »

This brought me back. I was a member of the UC Berkeley Computer Science Undergraduate Association (https://www.csua.berkeley.edu) in the early aughts. Through the CSUA I came across a job posting for a sysadmin job at Skotos Tech (https://www.skotos.net/), the multiplayer text games company Christopher Allen founded after his work at Consensus Development/Certicom to develop the SSL/TLS implementation for Netscape. It's been a long and strange road.

Re: Why SSL was renamed to TLS in late 90s (2014)

#149

Post by [deleted] »

jeroenhd wrote: post #5
pkulak wrote: post #4

“Transport Layer Security” really is a better name though. I also like to say “TLS”. Two Ses in a row makes you sound like a snake.

I think SSL is a better fit, actually. In theory TLS could be a transport-layer security mechanism that would let arbitrary protocols run on top of it (like IPSec does), but in practice it's pretty much tied up to TCP sockets. The UDP variant (DTLS, and I suppose QUIC) isn't part of the TLS spec for instance. Of course we have kernel TLS on Linux now, and Windows also has infrastructure like that, but it isn't as eas…

[deleted]

Re: Why SSL was renamed to TLS in late 90s (2014)

#150

Post by aoetalks »

LukeShu wrote: post #41
jeroenhd wrote: post #5

Earlier quoted context omitted.

I think SSL is a better fit, actually. In theory TLS could be a transport-layer security mechanism that would let arbitrary protocols run on top of it (like IPSec does), but in practice it's pretty much tied up to TCP sockets. The UDP variant (DTLS, and I suppose QUIC) isn't part of the TLS spec for instance. Of course we have kernel TLS on Linux now, and Windows also has infrastructure like that, but it isn't as eas…

No? The "transport" layer is layer 4 in the 7-layer OSI model (physical/datalink/network/transport/session/presentation/application) and 5-layer IP model (physical/network/internetwork/transport/application). That is: the "transport" provides reliable continuous data-stream abstraction over the lower-layers' discreet and unreliable packets; e.g. TCP. And that data-stream the interface that TLS provides; to the higher…

I was about to agree with you, and then I read the article on DTLS.

> And that data-stream the interface that TLS provides

That’s exactly the problem. You might lose a UDP packet. That would corrupt data encrypted with stream cipher.

With DTLS, each packet is encrypted individually.

https://en.m.wikipedia.org/wiki/Datagram_Transport_Layer_Sec...

Post reply on HN