Subject: [TLS] FW: [saag] getting rid of fairly old stuff (was: Re: POODLE avant le chein)

From: "Salz, Rich" <[email-masked]>
Date: Wed, 15 Oct 2014 12:26:52 -0400

>From Mr. Farrell in the SAAG mailing list:

>If they can now get rid of SSLv3 within say a couple of months, (and I hope they can), then we should maybe be asking ourselves if we (the IETF) can help 'em somehow not let such stuff linger for so long in future. Not sure how, but say if we'd published an "SSLv3 considered possibly harmful" RFC about 8 years after RFC 2246 was published, do we think that might have helped, or might an equivalent help in future? Looking about randomly, I see TLS1.1 is 8 years old now:-)

> And just to clarify, my question isn't really about TLS, but about whether there's an IETF thing to be done here that might help. (And the answer for now is I'm not sure.)

I'd like suggest we spend some time chatting about this.  Maybe it's just over fine bottled water at dinner, or maybe it's an official agenda item.  While he's right to be concerned about the larger problem, I think that as the "canary in the coal mine" and the most bruised and battered protocol, we might be a very group to help kickstart this.