<!DOCTYPE html PUBLIC "-//W3C//DTD HTML 4.0 Transitional//EN" "http://www.w3.org/TR/REC-html40/loose.dtd">
<html lang="en">
<head>
<meta content="text/html; charset=utf-8" http-equiv="Content-Type">
<title>
GitLab
</title>
<style>img {
max-width: 100%; height: auto;
}
</style>
</head>
<body>
<div class="content">
<div>
<p dir="auto">What is the intention, is to allow an operating system to say something like this: "by default applications should not be able to negotiate ssl3.0". The problem comes from the fact that very few applications use <code>gnutls_set_default_priority()</code> because for example they needed to add a parameter (e.g., enable PSK ciphersuites with <code>+PSK</code>, or enable compatibility mode with <code>%COMPAT</code>.</p>
<p dir="auto">In gnutls 3.6.3 <code>gnutls_set_default_priority_append()</code> was added to address that thing, but I'm pretty sure it is going to take years for applications to switch. As such any system wide enforcement of settings will be restricted to some applications only.</p>
<p dir="auto">The options are:</p>
<ol dir="auto">
<li>Discourage applications from setting their own priority string and move them to use <code>gnutls_set_default_priority_append()</code> or <code>gnutls_set_default_priority()</code>; the question is how to do that?</li>
<li>The "Set global TLS options which no application could override; this should include" above</li>
</ol>
</div>
</div>
<div class="footer" style="margin-top: 10px;">
<p style="font-size: small; color: #777777;">
—
<br>
Reply to this email directly or <a href="https://gitlab.com/gnutls/gnutls/issues/587#note_107211054">view it on GitLab</a>.
<br>
You're receiving this email because of your account on gitlab.com.
If you'd like to receive fewer emails, you can
<a href="https://gitlab.com/sent_notifications/2355959620341e541bee599354b2eacb/unsubscribe">unsubscribe</a>
from this thread or
adjust your notification settings.
<script type="application/ld+json">{"@context":"http://schema.org","@type":"EmailMessage","action":{"@type":"ViewAction","name":"View Issue","url":"https://gitlab.com/gnutls/gnutls/issues/587#note_107211054"}}</script>
</p>
</div>
</body>
</html>