Re: [DNG] openssl/libssl1 in Debian has disabled TLS 1.0 & 1.1

2017-08-17 Thread Arnt Gulbrandsen
ael writes: I am happy with that. Just as long as one can enable it when *necessary*. You have a compiler and building is easy. What is unacceptable is for Devuan to take away the freedom to read email or prevent communication with devices which cannot be updated. Keep in mind that

Re: [DNG] openssl/libssl1 in Debian has disabled TLS 1.0 & 1.1

2017-08-17 Thread ael
On Wed, Aug 16, 2017 at 01:27:33PM +0200, Alessandro Selli wrote: > On Wed, 16 Aug 2017 at 13:24:36 +0200 > Alessandro Selli wrote: > > > On Wed, 16 Aug 2017 at 11:56:46 +0100 > > ael wrote: > > > > [...] > > > > > Devuan needs to

Re: [DNG] openssl/libssl1 in Debian has disabled TLS 1.0 & 1.1

2017-08-16 Thread Alessandro Selli
On Wed, 16 Aug 2017 at 13:24:36 +0200 Alessandro Selli wrote: > On Wed, 16 Aug 2017 at 11:56:46 +0100 > ael wrote: > > [...] > > > Devuan needs to avoid importing this problem. > > It also needs to avoid been labelled as an

Re: [DNG] openssl/libssl1 in Debian has disabled TLS 1.0 & 1.1

2017-08-16 Thread Alessandro Selli
On Wed, 16 Aug 2017 at 11:56:46 +0100 ael wrote: [...] > Devuan needs to avoid importing this problem. It also needs to avoid been labelled as an unsafe distro, one of the few¹ to still support unsecure protocols. After all, TLS v. 2.0 is from 1995, quite a

[DNG] openssl/libssl1 in Debian has disabled TLS 1.0 & 1.1

2017-08-16 Thread ael
The Debian maintainer of openssl has unilaterally decided to disable TLS 1.0 and 1.1 with no option to re-enable. This breaks situations where users have no access to or influence on servers which still (unfortunately) use these old protocols. One case is offlineimap and there is a thread on the