Re: A couple of questions and concerns about Emacs network security

[Perry E. Metzger]

On Mon, 09 Jul 2018 15:43:43 +0200 Lars Ingebrigtsen <address@hidden>
wrote:
> Jimmy Yuen Ho Wong <address@hidden> writes:
> 
> > I thought about this, but there's no standard that bans TLS 1.1,
> > nor TLS client implementations that disabled it by default.
> > Besides, all the problems TLS 1.1 has is already checked by the
> > other checks. This reason I'm checking for TLS 1.0 is somewhat
> > arbitrary, as all the problems it has is already checked by other
> > checks too. So maybe even checking for 1.0 is already too strict,
> > but PCI DSS does ban it, so...  
> 
> For those who don't understand security acronym soup, the latter
> means "Payment Card Industry Data Security Standard".
> 
> And I don't think that's the level we should be considering for
> Emacs, even at the "high" level, because it's pretty...
> excessive.  Last time I checked.

I deal with PCI compliance a lot. It's not excessive. It's in fact
insufficient, but it's a nice minimum. More to the point, though,
it's less than what many of the browser vendors are doing.

-- 
Perry E. Metzger                address@hidden