Re: Poodle?
Matthias Hunstock <[email protected]> Fri, 17 Oct 2014 19:34:16 +0200
| Newsgroups | gmane.mail.perdition.user |
|---|---|
| Message-ID | <[email protected]> |
Am 15.10.2014 um 23:03 schrieb Vincent Fox: > Just catching up to this SSLv3 "Poodle" vulnerability. > > Should I do anything with my Perdition config? I think there is not much you can do, at least I don't see how it should be possible to disable SSLv3 via perdition config. Maybe your platform has some mechanism built into libssl, like setting environment variables or something like that. I made a small patch with some hard coded improvements, but I'm still testing. Just using ssllabs and similar is risky, because they only simulate browsers. No gain in security if you lock out some mail clients and their users just turn connection encryption off.... Regards Matthias ______________________________________________ Perdition-users mailing list [email protected] http://lists.vergenet.net/listinfo/perdition-users