Re: ZEO SSL support and Daft docs

Jens Vagelpohl <[email protected]> Thu, 23 Jun 2016 10:12:28 +0200

Newsgroups	gmane.comp.web.zope.zodb
Message-ID	<[email protected]>

> On 23 Jun 2016, at 5:29 , Vincent Pelletier <[email protected]> wrote:
> 
> On Wed, 22 Jun 2016 17:38:03 -0700,
> Patrick Strawderman <[email protected]> wrote :
>> I was going to advocate only supporting TLS 1.2 as well, but didn't have
>> time to think about the implications. I believe it means OpenSSL >= 1.0.1
>> would be a requirement (which was released 4 years ago). Note that it seems
>> like OS X (10.11.5) still ships with OpenSSL 0.9.8 :-(. Anyway, TLS 1.2 is
>> definitely attractive, because of ECC, perfect forward secrecy, etc.
> 
> Ah yes, I did not think about the implications on dependencies.
> I would tend to think these would be second to security as "the future
> will be here soon" (ie, don't hesitate to depend on newer stuff, as it
> will be widespread before you know it), but your OSX example shows even
> the distant past is not quite there yet…

Worrying about support for ancient OpenSSL versions is misguided here. You’re not breaking anyone’s existing ZEO setup because the TLS feature is new, anyway. Just mention the minimum OpenSSL requirement in the docs and do the right thing by only supporting TLS 1.2.

jens


-- 
You received this message because you are subscribed to the Google Groups "zodb" group.
To unsubscribe from this group and stop receiving emails from it, send an email to [email protected].
For more options, visit https://groups.google.com/d/optout.

signature.asc (application/pgp-signature, 801 B)