Subject: [TLS] TLS 1.3 and vendor strings?

From: Jeffrey Walton <[email-masked]>
Date: Thu, 21 May 2015 22:46:33 -0400

Are there any plans to support free form vendor strings?

The use case is similar to Apple's buggy ECDHE-ECDSA SecureTransport
for OS X 10.8 and iOS 7.

In this case, OpenSSL had to jump through a number of hoops to
identify the potentially affected clients via fingerprinting.
Fingerprinting was not precise, and it potentially captured unaffected
clients when Apple patched at OS X 10.8.4 and iOS 7.0.3. That is, an
OS X 10.8.5 or iOS 7.0.4 client would potentially be identified as
buggy even though it was patched.

Or is there another way to handle the occasional implementation bug like this?

(And to be clear: patching is not always an option. Apple is not like
Microsoft or Linux. Rather, they left a number of hosts unpatched for
the ECDHE-ECDSA bug; and did the same with CVE-2015-1130 (Goto Fail);
and did the same with CVE-2015-1130 (Hidden Backdoor)).

---

From: Yuhong Bao <[email-masked]>
Date: Thu, 21 May 2015 20:17:44 -0700

In this case, the pre-10.8.4 versions of OS X lost marketshare pretty quickly, I think by now it is less than 0.1% now.

----------------------------------------
> Date: Thu, 21 May 2015 22:46:33 -0400
> From: [email-masked]
> To: [email-masked]
> Subject: [TLS] TLS 1.3 and vendor strings?
>
> _______________________________________________
> TLS mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/tls

---

From: Jeffrey Walton <[email-masked]>
Date: Thu, 21 May 2015 23:30:30 -0400

> In this case, the pre-10.8.4 versions of OS X lost marketshare pretty quickly, I think by now it is less than 0.1% now.
Unfortunately, I have two OS X machines that are still in the 10.8
series. That's because of Xcode/iOS support. I still need to support
older version of iOS; and for that, I need an older version of Xcode;
and for that, I need an older version of OS X.

... and the worst part is, its for dumb reasons, like Apple changed UI
scheme to light blue text on white background. I literally cannot read
the text, and had to hold back on upgrades so I could see it.

Jeff

---

From: Yuhong Bao <[email-masked]>
Date: Thu, 21 May 2015 20:39:05 -0700

I know, but they released an update to the 10.8 series to fix the problem and most users has installed it by now.

> Date: Thu, 21 May 2015 23:30:30 -0400
> Subject: Re: [TLS] TLS 1.3 and vendor strings?
> From: [email-masked]
> To: [email-masked]
> CC: [email-masked]
>