On Tuesday 2024-08-06 11:02, Neil Horman wrote: > >3) If the deprecated protocols are re-enabled, what would constitute a >reasonable warning mechanism to inform users that these protocols are going >away at some point in the future to pressure users to update to a newer, >more secure protocol?
I think the power of warnings is overestimated (which is to say users can be incredibly ignorant :-p) The ERR_ buffer API could be used to convey information. Problem I see is that, when the return code of some openssl function indicates "success", no program exercising the openssl API will think to evaluate err buffers at that point. stderr seems kind of a sensible target. It is redirected in graphical environments to e.g. ~/.xsession-errors, and I remember a time close to the end of the 90s when /usr/bin/xconsole was started as part of a desktop experience so you actually get to see the issues. But then desktops just stopped doing that without replacement, which, in retrospect, was a bad choice, as it could have been replaced by desktop notifications.
