{"action":"opened","issue":{"url":"https://api.github.com/repos/awslabs/s2n/issues/78","labels_url":"https://api.github.com/repos/awslabs/s2n/issues/78/labels{/name}","comments_url":"https://api.github.com/repos/awslabs/s2n/issues/78/comments","events_url":"https://api.github.com/repos/awslabs/s2n/issues/78/events","html_url":"https://github.com/awslabs/s2n/issues/78","id":92077563,"number":78,"title":"Why be SSLv3, RC4, & DHE implemented if \"s2n avoids implementing rarely used options and extensions, as well as features with a history of triggering protocol-level vulnerabilities.\"?","user":{"login":"BigBoneDaddy","id":13056703,"avatar_url":"https://avatars.githubusercontent.com/u/13056703?v=3","gravatar_id":"","url":"https://api.github.com/users/BigBoneDaddy","html_url":"https://github.com/BigBoneDaddy","followers_url":"https://api.github.com/users/BigBoneDaddy/followers","following_url":"https://api.github.com/users/BigBoneDaddy/following{/other_user}","gists_url":"https://api.github.com/users/BigBoneDaddy/gists{/gist_id}","starred_url":"https://api.github.com/users/BigBoneDaddy/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/BigBoneDaddy/subscriptions","organizations_url":"https://api.github.com/users/BigBoneDaddy/orgs","repos_url":"https://api.github.com/users/BigBoneDaddy/repos","events_url":"https://api.github.com/users/BigBoneDaddy/events{/privacy}","received_events_url":"https://api.github.com/users/BigBoneDaddy/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"milestone":null,"comments":0,"created_at":"2015-06-30T12:17:22Z","updated_at":"2015-06-30T12:17:22Z","closed_at":null,"body":"Hello my many friends! The README.md file has brought me some confusions! It says `s2n avoids implementing rarely used options and extensions, as well as features with a history of triggering protocol-level vulnerabilities.` but it also has wording that say `SSLv3, RC4, and DHE are each disabled by default for security reasons.`. I am no security guru but it is of my complete and total understanding that SSLv3 should not be used and there is even https://tools.ietf.org/html/rfc7568 RFC deprecating it! I know not if there are RFCs for deprecating RC4 and DHE but I have been told by those in the know that I should not be using of those technologies. So if these are technologies that people in the know say should no be used and if they are disabled by default in s2n but s2n tries to avoid implementing rarely used options and extensions and broken ones is there reason why these possibly dangerous and harmful technologies were implemented in first place? Is not it most sensible to be removing them completely so there is more safety even if maybe less compatibility in corner case?"}}