Hacker News Reader

Comment by ping_pong | Hacker News Reader

"Deprecate" means "to discourage use of", and it doesn't mean "to end support or to desupport". But it's the most misused word in tech that I've seen in the past 25 years.

So I'm not actually sure if this RFC is using it in the correct way, or the incorrect way.

View on HN

https://www.merriam-webster.com/dictionary/deprecate

> to withdraw official support for

> Deprecation of these versions is intended to assist developers as additional justification to no longer support older (D)TLS versions and to migrate to a minimum of (D)TLS 1.2.

Seems to me like this document is trying to be a tool for developers to support telling decision makers that using those versions is discouraged.

Right. One of the things it does is Update existing RFCs which are otherwise unrelated except that they say you must use TLS (fine) and that TLS 1.0 is Mandatory To Implement.

Without this RFC, inevitably a bureaucrat in some organisation is going to argue that the shiny 2021 project to implement Protocol X must offer the horribly obsolete TLS 1.0 or a 3DES ciphersuite because it says so in this document written in 2010 and surely if that wasn't important it wouldn't say that.

This RFC means you get to say no, see, that document you're pointing at has been updated by this newer document which says I can use TLS 1.2 and AES-128 instead as I was planning to before this stupid Zoom call I'm in now.

IETF is a standards body. It doesn't provide support for implementations so im not sure how it could withdraw what it doesn't provide in the first place.

Regardless i think you're splitting hairs in the definition.

What sort of "support" do you imagine the IETF should be offering, and to whom?

   The mission of the IETF is to produce high quality, relevant
   technical and engineering documents that influence the way people
   design, use, and manage the Internet in such a way as to make the
   Internet work better.  These documents include protocol standards,
   best current practices, and informational documents of various kinds.

https://datatracker.ietf.org/doc/rfc3935/

This RFC is labeled "Best Current Practice".

What else is "discouraging use of" if not publishing a document that asserts that the best current practice is to not use it?

If you want the TLS 1.0 protocol specification, they still provide it in the same place as before, https://datatracker.ietf.org/doc/rfc2246/

The intent seems clear, though: "TLS 1.0 MUST NOT be used" "TLS 1.1 MUST NOT be used"

It's interesting that you're both literally incorrect from the perspective of the English language, but also incorrect with regards to the goal of the announcement. Kudos!

I'm literally correct. Look up "to deprecate" in the dictionary. In APIs like Java it's clear that you can still use the API, but its use is discouraged because it will soon become unsupported.

A deprecated API is one that you are no longer recommended to use, due to changes in the API. While deprecated classes, methods, and fields are still implemented, they may be removed in future implementations, so you should not use them in new code, and if possible rewrite old code not to use them.

https://docs.oracle.com/javase/8/docs/technotes/guides/javad...

Yeah, I mean, you look it up? lol someone even linked it elsewhere.

And the article is about recommending against its use.

Are you under the impression its now impossible to use TLS1.0? What exactly do you think would happen? The web security police come and arrest you?

Reply on news.ycombinator.com