Skip to content

Conversation

@Martii
Copy link
Member

@Martii Martii commented Jun 15, 2018

  • This is a scheduled PR for no later than June 30th, 2018
  • TLSv1 is officially EOL on 2018-06-30 ... this may knock out some browsers from being able to login, or even visiting OUJS, (this is one of the ways how https holds everyone hostage albeit in the name of security... so catch 22... as compared to http)
  • Does work as it's already been tested on pro
  • If node has an update before then it may not be needed... however usually it's around the first week of the month e.g. past the deadline

Ref(s):

NOTES:

  • Didn't test Opera Presto (12.16.1860)... that's in the TODO after merge milestone... however one test site says it only supports TLSv1
  • @gera2ld sending you a courtesy ping for violentmonkey-oex since that's older Opera support from our last documentation e.g. most likely since the tester said it only supports TLSv1 this will knock that particular extension out (but you probably already know this). Thanks for the visit.

* This is a scheduled PR for no later than June 30th, 2018
* TLSv1 is officially EOL on 2018-06-30 ... this may knock out some browsers from being able to login *(this is one of the ways how https holds everyone hostage albeit in the name of security... so catch 22... as compared to http)*
* Does work as it's already been tested on pro
* If *node* has an update before then it may not be needed... however usually it's around the first week of the month e.g. past the deadline
@Martii Martii added security Usually relates to something critical. CODE Some other Code related issue and it should clearly describe what it is affecting in a comment. labels Jun 15, 2018
@Martii Martii added this to the #1430 milestone Jun 15, 2018
@Martii Martii added PR ONHOLD This is used to indicate that a pull request (PR) is NOT ready for evaluation a.k.a. WIP. needs mitigation Needs additional followup. labels Jun 15, 2018
@Martii
Copy link
Member Author

Martii commented Jun 22, 2018

FYI GitHub has already done this... so effectively one of our primary Auths won't work with OUJS in Opera Presto:

Ref:

  • Opera Presto TLSv1 disabled

@Martii Martii removed the PR ONHOLD This is used to indicate that a pull request (PR) is NOT ready for evaluation a.k.a. WIP. label Jun 22, 2018
@Martii Martii merged commit 94a27ca into OpenUserJS:master Jun 22, 2018
@Martii Martii deleted the tls1Disable branch June 22, 2018 22:03
@Martii
Copy link
Member Author

Martii commented Jun 22, 2018

And as stated in the PR summary.. here's the Opera Presto test for confirmation:

  • OUJS TLSv1 disabled

New "low end" browser tests will be IE 11... this probably knocks out lower than this version (may boot up my XP machine just for grins) and GH already has a notice banner stating it's deprecated in IE 11.

@OpenUserJS OpenUserJS locked as resolved and limited conversation to collaborators Jun 22, 2018
@Martii
Copy link
Member Author

Martii commented Oct 16, 2018

A little late for this at https://blog.mozilla.org/security/2018/10/15/removing-old-versions-of-tls/ plus if all the sites have this particular option disabled, like we do, then obviously the telemetry is going to show lower usage. Durr! ;) :)

Until the authorities well above Moz deprecate TLSv1.1 (node syntax of SSL_OP_NO_TLSv1_1) we'll still keep it. More hostage time. ;) :)

@Martii
Copy link
Member Author

Martii commented May 5, 2019

More hostage time.

If you haven't experienced or read these might want to give it a whirl over there...

This is precisely a real world example. I know bugs happen but this is pretty big from the "new" Moz teams.

@Martii Martii removed the needs mitigation Needs additional followup. label Jun 28, 2019
Sign up for free to subscribe to this conversation on GitHub. Already have an account? Sign in.

Labels

CODE Some other Code related issue and it should clearly describe what it is affecting in a comment. security Usually relates to something critical.

Development

Successfully merging this pull request may close these issues.

2 participants