Re: SSL Cipher Support and V7R1... and so it begins

On Tue, Jul 11, 2017 at 8:43 AM, DrFranken <midrange@xxxxxxxxxxxx> wrote:

b. IBM does do hiper and maintenance fixes for 7.1 - it's just that IBM is
more selective about what they will fix.

If it's broken they fix it. But adding new ciphers isn't really 'broken'
it's enhancing. They are no longer enhancing i 7.1 and said that a year ago.

Larry, I understand your (and IBM's) position, but it is not helpful
or convincing to frame it in this manner.

In the security world, if something becomes insecure just because the
technology of potential attackers has improved, then the old system
*has* become broken. For IBM to *call* plugging security holes an
"enhancement" rather than a "security fix" only makes IBM sound like
they are not serious about security.

Please understand, I am not saying that IBM is unjustified for not
providing a fix in this case. I am saying they should absolutely not
use *that* particular terminology-based argument to justify this
position. Because it comes across (to anyone outside the choir) as
disingenuous.

They absolutely can and absolutely should emphasize the technical
issues instead (saying things like the scope of the patch would be
impractically large, would incur cost they can't afford, etc).

Honestly, I would be less put off if IBM merely said "sorry, but we
have always reserved the right to not do any work, for any reason, and
this is one case where we are exercising that right" and leave it at
that.

John Y.