Subject: Re: [TLS] Terminology clarification around SSL & TLS

From: Julien ÉLIE <[email-masked]>
Date: Thu, 1 Sep 2016 21:17:50 +0200

Hi,

>> The technology is SSL, and is sometimes also refered to as
>> SSL/TLS.
>
> please no. the technology is TLS.
+
> i would like to continue to be able to say unambiguously that all
> known versions of SSL are badly broken and should be avoided. Let's
> not muddy those waters further.
+
> Let's not use a proprietary protocol name for a standard protocol.
> Conveniently, all SSL is broken now, long live TLS!

There's still something I find confusing:  on the one hand, SSL is badly 
broken and "diediedied", it is a proprietary protocol name, and the 
consensus in the TLS WG seems to be "long live TLS" but on the other 
hand major SSL/TLS implementations keep the SSL name living.

When people look for TLS implementations, they will find OpenSSL, 
BoringSSL, LibreSSL, MatrixSSL, wolfSSL, etc.
Besides, a developer will often use "-lssl" to link against TLS libraries.

So, if the consensus is to prevent people who speak about or work on TLS 
from constantly viewing the SSL name, will forthcoming software releases 
change their name?
Otherwise, confusion keeps being sustained...

-- 
Julien ÉLIE

« En voyant le lit vide, il le devint. » (Ponson du Terrail)

---

From: Dave Garrett <[email-masked]>
Date: Thu, 1 Sep 2016 19:29:55 -0400

> hand major SSL/TLS implementations keep the SSL name living.

Arguably, renaming SSL to TLS and restarting the version numbering was a bad decision. SSL/TLS is a 21 year old protocol. It's got more than a few bad decisions in it, at least in hindsight.

I too wish that major organizations would ditch the SSL naming for TLS, however until very recently many still supported SSL in some form (which is it's own problem). It is unfortunately not easy to convince everyone to update things.

Dave