<html><head><style type='text/css'>p { margin: 0; }</style></head><body><div style='font-family: arial,helvetica,sans-serif; font-size: 10pt; color: #000000'>If you want the increased security and can afford so, by all means use it.<br><br>If you cannot afford the increased security, I guess the response is to just bugger off... we don't need your kind?<br><br><div><span name="x"></span><br><br>-----<br>Mike Hammett<br>Intelligent Computing Solutions<br>http://www.ics-il.com<br><br>Midwest-IX<br>http://www.midwest-ix.com<span name="x"></span><br></div><br><hr id="zwchr"><div style="color:#000;font-weight:normal;font-style:normal;text-decoration:none;font-family:Helvetica,Arial,sans-serif;font-size:12pt;"><b>From: </b>"Matt Harris" <matt@netfire.net><br><b>To: </b>"Matt Hoppes" <mattlists@rivervalleyinternet.net><br><b>Cc: </b>"Constantine A. Murenin" <mureninc@gmail.com>, "North American Network Operators' Group" <nanog@nanog.org><br><b>Sent: </b>Tuesday, December 31, 2019 10:02:26 AM<br><b>Subject: </b>Re: Wikipedia drops support for old Android smartphones; mandates TLSv1.2 to read<br><br><div dir="ltr"><div dir="ltr">On Tue, Dec 31, 2019 at 2:30 AM Matt Hoppes <<a href="mailto:mattlists@rivervalleyinternet.net" target="_blank">mattlists@rivervalleyinternet.net</a>> wrote:<br></div><div class="gmail_quote"><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex">Why do I need Wikipedia SSLed? I know the argument. But if it doesn’t work why not either let it fall back to 1.0 or to HTTP. <br>
<br>
This seems like security for no valid reason.</blockquote><div><br></div><div>Being able to authenticate that the content you've requested is coming from the source from which you requested it seems like a pretty valid reason to me. If you live in a privileged nation with democratic governance, and you have ISP choice and your ISP doesn't and won't hijack your connections and you're not otherwise in an environment where your connections may be hijacked for any number of reasons by any number of parties, then you may not think about this very much. Employing the best (popular, well-supported, well-documented, completely open) current standard, TLS 1.2, instead of supporting deprecated, known-flawed previous versions of that protocol also seems like an entirely reasonable idea, too. </div><div><br></div><div>If you don't like that this potentially disenfranchises users of old devices (and there's perhaps a case to be made here), then the ire should be imho directed towards the device vendors for not issuing security updates for whatever version you wish were able to support modern technology. Not at free web-based services for ending support for deprecated, known-flawed protocols/ciphers/etc. If google wanted to issue an update for older android versions to support TLS1.2 then they absolutely could, though users may see some detrimental performance impact to using modern technology on an outdated device. </div><div><br></div><div>This isn't a new issue, and we as the greater internet community have generally tackled it by taking aggressive measures towards deprecating known-flawed technologies on a conservative timeline. </div><div><br></div><div>RFC5246 was published over a decade ago. </div><div><br></div><div>- mdh</div><div><br></div></div></div>
</div><br></div></body></html>