I-GitHub inqume ukuyeka ukuxhasa i-TLS 1.0 kunye ne-1.1 kwindawo yokugcina iphakheji ye-NPM kunye nazo zonke iziza ezinxulumene nomphathi wephakheji ye-NPM, kubandakanywa npmjs.com. Ukuqala ngo-Oktobha 4, ukudibanisa kwindawo yokugcina, kuquka ukufaka iipakethi, kuya kufuna umxhasi oxhasa ubuncinane i-TLS 1.2. Kwi-GitHub ngokwayo, inkxaso ye-TLS 1.0/1.1 yayekwa ngoFebruwari 2018. Injongo kuthiwa kukuxhalabisa ukhuseleko lweenkonzo zayo kunye nokugcinwa kwemfihlo kwedatha yomsebenzisi. Ngokutsho kweGitHub, malunga ne-99% yezicelo kwi-NPM yokugcina sele yenziwe ngokusebenzisa i-TLS 1.2 okanye i-1.3, kwaye i-Node.js ifake inkxaso ye-TLS 1.2 ukususela ngo-2013 (ukususela ekukhululweni kwe-0.10), ngoko ke utshintsho luya kuchaphazela kuphela inxalenye encinci abasebenzisi.
Masikhumbule ukuba iiprotocol ze-TLS 1.0 kunye ne-1.1 ziye zahlelwa ngokusemthethweni njengetekhnoloji ephelelwe lixesha yi-IETF (i-Internet Engineering Task Force). Inkcazo ye-TLS 1.0 yapapashwa ngoJanuwari 1999. Kwiminyaka esixhenxe kamva, uhlaziyo lwe-TLS 1.1 lwakhutshwa ngophuculo lokhuseleko olunxulumene nokuveliswa kweevektha zokuqalisa kunye nokukhuselwa. Phakathi kweengxaki eziphambili ze-TLS 1.0 / 1.1 kukungabikho kwenkxaso ye-ciphers yanamhlanje (umzekelo, i-ECDHE kunye ne-AEAD) kunye nobukho kwinkcazo yemfuno yokuxhasa i-ciphers endala, ukuthembeka kwayo okubuzwayo kwinqanaba langoku. uphuhliso lobuchwepheshe bekhompyutha (umzekelo, inkxaso ye-TLS_DHE_DSS_WITH_3DES_EDE_CBC_SHA iyafuneka ukujonga imfezeko kunye nokuqinisekiswa kusetyenziswa i-MD5 kunye ne-SHA-1). Inkxaso ye-algorithms yakudala sele ikhokelele kuhlaselo olunje ngeROBOT, DROWN, BEAST, Logjam kunye neFREAK. Nangona kunjalo, ezi ngxaki azizange ziqwalaselwe ngokuthe ngqo ukuba buthathaka kweprotocol kwaye zasonjululwa kwinqanaba lokuphunyezwa kwayo. Iiprothokholi ze-TLS 1.0/1.1 ngokwazo azinawo ubuthathaka obubalulekileyo obunokusetyenziswa ukwenza uhlaselo olubonakalayo.
umthombo: opennet.ru