Slash Boxes

SoylentNews is people

SoylentNews is powered by your submissions, so send in your scoop. Only 11 submissions in the queue.
posted by NCommander on Wednesday July 05 2023, @02:23AM   Printer-friendly
from the ssl-negotations-are-complex dept.

So, I know its been a bit quiet here, but we're working through getting through the last few items relating to cutting over to newer infrastructure. As such, its been working through the bug list, and there's one issue I want to get some feedback on.

Back in November when the infrastructure was upgraded to Ubuntu 22.04, a few users with older devices stopped being able to connect to SoylentNews. This confused me, since we've been using the same NGINX SSL termination setup that has been in use since at least 2016. Well, I finally found the root cause, and as it turns out, Canonical bumped up the minimum OpenSSL security level, which disabled several ciphers, and broke devices not supporting TLS 1.2 or later.

By testing the site with the SSL Labs site checker, it appears anything older than Android 4.0, or iOS 5 is broken. This mostly seems to be devices that are over a decade old at this point, and won't be able to browse the vast majority of sites on the Internet as is. We discussed this internally a bit, and I'm of the opinion that its not worth re-enabling the older ciphers to allow these devices to reconnect, especially since we're working to modernize the stack, and get it as up to date as we can get it. I also believe we had very few users who were actually affected by this, however, as the editors did get a few emails about SN breaking after the site upgrade, I wanted to poll the community, and make sure this is not a more widespread issue than initially believed.

Ultimately, this is going to be part of a broader discussion on what we will and won't support on SoylentNews going forward, and this seems as good of place as any to get the ball rolling.

~ NCommander

This discussion has been archived. No new comments can be posted.
Display Options Threshold/Breakthrough Mark All as Read Mark All as Unread
The Fine Print: The following comments are owned by whoever posted them. We are not responsible for them in any way.
  • (Score: 2) by ledow on Thursday July 06 2023, @11:44AM (1 child)

    by ledow (5567) on Thursday July 06 2023, @11:44AM (#1314727) Homepage

    I'd rather you were getting A or A+ on SSL Labs than you bothered about devices too old to allow that.

    That's what I do, personally and professionally, in a public-facing way for multiple services for thousands of users... nobody complains.

    We used to get complaints about Safari - because Mac OS stops updating Safari when it goes out of support - all the time for this, but we just used to tell them that their computer simply wasn't capable of browsing modern websites and they'd say "Oh, yes, my bank, etc. keep saying that too" and eventually they buy a vaguely modern machine.

    But Android 4.0 and iOS 5? They are not only "broken", but they deserve to be now.

    Run an SSL Labs test every few months, keep it up to date. You'll probably never get a "perfect" (A+) score, but for sure you should be getting A's.

    Hell, even where I'm forced to offer IIS services, I use "IIS Crypto" to turn off the old protocols and operate on its "Best Practice" settings, which effectively does the same... obsoletes all the old insecure crypto algorithms for SSL, RDP and RADIUS. Nobody cares.

    Starting Score:    1  point
    Karma-Bonus Modifier   +1  

    Total Score:   2  
  • (Score: 1, Interesting) by Anonymous Coward on Thursday July 06 2023, @12:20PM

    by Anonymous Coward on Thursday July 06 2023, @12:20PM (#1314732)

    Run an SSL Labs test every few months, keep it up to date. You'll probably never get a "perfect" (A+) score, but for sure you should be getting A's.

    Did that already []

    And SN gets an A+