Re: Disable SSL2 and SSL3 in ssl.el?

At the same time we would want to help the users do informed decisions so that they not by mistake use not secure protocols. So it is a tradeoff. So setting the default to TLS 1.0 and at the same time document how to customize that to lower levels seems reasonable too me. And in the cases where it is implemented with openssl I guess the user is anyway at the mercy of that implementation. However we also have the problem that not all encrypted traffic passes through ssl.el. So we would have to see to so that supported-tls-protocols is respected by all places where encrypted traffic takes place. You see, triggered by this thread, I noticed that gnus uses openssl directly and, as it seems, could even try to use sslv2 in case that sslv3 does not work. That does not sound good. I have also been ignorant and not been looking into the tls-support recently added to the core. So I don't know if that is applicable here but from the name is sounds like we should start using that and only fall back to ssl, and other implementations (openssl!?), if the user requests it!? Yours -- %% Mats _______________________________________________ XEmacs-Beta mailing list XEmacs-Beta(a)xemacs.org http://lists.xemacs.org/mailman/listinfo/xemacs-beta