Top all-time · #10263
Tim Dierks
Personal blog · tim.dierks.org · on HN as timdierkssecurityprogramming
Tim Dierks's personal blog at tim.dierks.org covers security and programming. Since 2009, 7 different Hacker News readers have linked it 8 times, most often “Why TLS is called "TLS", not "SSL 3.1"”. The last post was in 2014, but the archive is still widely read.
Too few sampled comments (4) to say how often HN recommends it.?
Why HN links it
HN links this blog as a reference on the history and naming of SSL and TLS, and on attempts at encryption in browser JavaScript. The comments cite it for context and do not judge it.
Summarised by Claude from a sample of 4 HN comments that link here. Each comment is marked recommending, critical or neutral (citing without judging); how this works.
Most-linked posts?
- Why TLS is called "TLS", not "SSL 3.1"4 people · 4 mentions · first linked 2014-05-23
What Hacker News says?
It should, or 'TLS/SSL'. But so many people - even in tech - still use 'SSL' as a synonym for 'PKI on the web' that it's better to be understood than correct (and yes it's a bit sad). Also: SSLv3 and TLSv1 are very similar: http://tim.dierks.org/2014/05/security-standards-and-name-ch...
Comment linking /2014/05/security-standards-and-name-changes-in.html
on “Mozilla SSL Configuration Generator”Submitted Why SSL was renamed to TLS in late 90s (2014) as a story · 549 points
HN discussionSSL and TLS are really the same protocol, except that newer versions are called TLS. Many software stacks still refer to both as SSL, but these days we only use TLS. My understanding is that the renaming was mostly politics between Microsoft, Netscape, and the IETF in the 90s. See more details here: http://tim.dierks.org/2014/05/security-standards-and-name-ch...
Comment linking /2014/05/security-standards-and-name-changes-in.html
on “Go 1.12 Released”Submitted Why TLS is called "TLS", not "SSL 3.1" as a story · 229 points
HN discussion> I don't generally like being a pedant, but SSL and TLS are different things that attempt to solve the same problem, much like WEP and WPA. That is not really accurate - TLS 1.0 is very similar to SSL 3.0. They're so similar that implementations use much of the same code for both. TLS 1.0 should have been called SSL 3.1, but because of the browser wars between Netscape and Microsoft it was renamed (SSL was invented…
Comment linking /2014/05/security-standards-and-name-changes-in.html
on “What web developers should know about SSL”Submitted In-browser password checker as a story · 2 points
HN discussionSo, you're saying in effect there's no way to properly do encryption in pure JavaScript at all? That you'd have to get the random numbers from a Java applet or something of the sort? I came across this attempt: http://tim.dierks.org/2007/03/secure-in-browser-javascript-p... But Billy Hoffman disapproves: http://www.webappsec.org/lists/websecurity/archive/2008-01/m...
Comment linking /2007/03/secure-in-browser-javascript-password.html
on “JCryption - JavaScript data encryption”Submitted Why TLS 1.0 isn't just SSL 3.1 (2014) as a story · 1 points
HN discussion
