Subject: Re: [TLS] Confirming consensus: TLS1.3->TLS*

From: Filippo Valsorda <[email-masked]>
Date: Sun, 20 Nov 2016 14:17:37 -0500

I'm definitely for 1.3.

I get where 4 is coming from, but 1.2 is not going anywhere soon, and we
spent the last 10 years training people that the high-numbered one is
bad, and that the 1.x ones are cool.

I really don't want to have the following conversation, with the exact
same people the proponents of 4 are trying to help:

"You only support 1.2, you should support 4"
"Oh, wasn't it that weird other way around where the high one was
broken?"
"Ah, no, 4 is the latest and greatest"
"Oh, ok, then I should support only 4 and 3?"
"Nono, 3 is terribly broken."
"Oh, so only 4? Do all clients support it?"
"Uh, you should keep 1.2"
"Ah, so 1.2 is better than 3 but worse than 4?"
"Yeah... I'm sorry"

"4 is great, 3 is bad, 1.2 is good" is harder than "3 is bad, 1.2 is
good" was, and harder than "3 is bad, 1.2 is good, 1.3 is great" would
be.

---

From: Eric Mill <[email-masked]>
Date: Sun, 20 Nov 2016 20:51:21 -0500

> good" was, and harder than "3 is bad, 1.2 is good, 1.3 is great" would

While this conversation might not be impossible, I think it's an unlikely
hypothetical. A change to TLS 4 wouldn't be to address confusion for those
who have already internalized the weird version history (which is mostly
people like us on-list), but for people who only think about TLS/SSL when
they're forced to think about it, once every year or few.

For those people, the real conversations I've had were based on superficial
glances and hazy memories of the protocol history that are reconstituted
every time the subject comes up. Naming it TLS 4 wouldn't fix it for
everyone, but it would be all-upside for some -- as well as providing a
helpful opportunity to drop the faux-minor version number and simplify the
numbering overall in the long term.

The near-term annoyance of renaming things by folks close to the WG, and
the chance of some confusion around the edges, seem like small issues
compared to a positive investment in bending the sanity curve of the next
20 years of lazy enterprise decisions.

-- Eric

>
> _______________________________________________
> TLS mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/tls
>

-- 
konklone.com | @konklone <https://twitter.com/konklone>

---

From: Peter Gutmann <[email-masked]>
Date: Mon, 21 Nov 2016 04:59:40 +0000

Eric Mill <[email-masked]> writes:

>The near-term annoyance of renaming things by folks close to the WG, and the
>chance of some confusion around the edges, seem like small issues compared to
>a positive investment in bending the sanity curve of the next 20 years of
>lazy enterprise decisions.

+1.  I was reading an article earlier today on a security web site (not a
general news site or even an IT news site but specifically a security web
site) where they mentioned that sensitive traffic wasn't SSL-protected.  Even
the security people are still calling it SSL.  So if you number it "4" or
"2017" it doesn't matter whether it's SSL or TLS, it's obvious that it's a
newer version than anything else out there.

Peter.