[HTTPS-Everywhere] fetch.spec.whatwg.org and RC4-only tagging? [was: Re: Ruleset style guide]

Daniel Kahn Gillmor dkg at fifthhorseman.net
Fri Feb 13 11:12:22 PST 2015


On Fri 2015-02-13 12:53:36 -0500, Jacob Hoffman-Andrews wrote:
>> People whose browsers are configured to reject RC4 are likely to get a
>> "no matching ciphersuite" message when connecting to these servers.
>> 
>> We have flags for things like uses cacert.  Should we have a flag for
>> rc4-required?
>
> I'm very reluctant to add new platforms because it makes it so much
> harder to maintain the rulesets in good condition. Instead, once
> Firefox or another supported browser starts giving UI warnings for
> RC4 by default, I would like to simply disable the rules for
> RC4-only hosts altogether.

Is there a way that https-e keeps track of those hosts which are
RC4-only?

        --dkg


More information about the HTTPS-Everywhere mailing list