Re: Disable SSLv3 and set cipher list for bozohttpd

On Wed, Dec 09, 2015 at 08:33:35PM -0500, [email protected] wrote:
> 
> >Le 2015-12-08 21:58, [email protected] a ??crit??:
> >>Why not supply the ! list (the ones you want to remove)... It is shorter
> >>and easier to understand and maintain...
> 
> I agree, much simpler!

I don't.  Opinions may differ, but I am not a fan of this particular kind
of "algorithm agility".

Pick a small set of ciphersuites, chosen for backwards compatibility with peers
that do only the minimum the standards mandate as a first criterion, and
the consensus of experts about the best current and future alternatives,
and forget the rest.  Often all they can buy you is confusion and trouble.

I would like to see, at most, four ciphersuites supported by default.

Thor