Re: null ciphers in 9.2.2

Nicholas,

I was not implying that FF has done anything wrong and it is good to know
that there is a configuration to turn off 9.2.2 checking.

But my point remains. if 9.2.2 is configurable, then a server cannot know
on what basis a cipher is offered - is it a h1 fallback cipher or a
configured weak cipher.  If the server guesses wrong communication failure
results even though the pair might have protocol/cipher choices that are
acceptable.

The argument made when the fragile handshake was pointed out was that 9.2.2
could never ever be implemented differently and thus would not be subject
to configuration.   So when I point out that null ciphers/weak/unusual
ciphers might have niche use-cases, it can't be argued that acceptable
ciphers are indeed configurable.

regards



-- 
Greg Wilkins <gregw@intalio.com>
http://eclipse.org/jetty HTTP, SPDY, Websocket server and client that scales
http://www.webtide.com  advice and support for jetty and cometd.