<story><title>Announcing SSL Labs Grading Changes for 2017</title><url>https://blog.qualys.com/ssllabs/2016/11/16/announcing-ssl-labs-grading-changes-for-2017</url></story><parent_chain></parent_chain><comment><author>Panino</author><text>All good changes.&lt;p&gt;I&amp;#x27;d also like to see the Handshake Simulation improved by splitting ancient clients out into their own section.  Call it Obsolete or Legacy.  Populate it with all the clients that don&amp;#x27;t support ECDHE or TLS 1.2.  With that change, people won&amp;#x27;t feel pressured to support IE6 on Windows XP or other such combos.  In the real world, a big majority of TLS 1.0 traffic is either 1) unknown web crawlers that don&amp;#x27;t matter, or 2) zombies running on ancient hacked machines looking to replicate.  It&amp;#x27;s mostly unwanted traffic.&lt;p&gt;You might say it does no harm to enable connections to IE6 on Windows XP, but I can think of two reasons why it does: First, enabling more ciphersuites in OpenSSL (or other) increases your attack surface, and as for me, I&amp;#x27;m way more interested in reducing my attack surface than in talking to a computer that was last updated in 2001.  Second, these XP machines will hang around the Internet so long as they&amp;#x27;re useful.  We  cancel the driving priveleges of drunk and senile people, and we should do the same at the protocol level for XP machines.&lt;p&gt;And anyway, it&amp;#x27;s incoherent to mark an IE6&amp;#x2F;XP connection failure in red (which means bad), while simultaneosly saying that SSL3 is bad.  Some cruft has built up over the years, and it needs to be periodically removed.</text></comment>
<story><title>Announcing SSL Labs Grading Changes for 2017</title><url>https://blog.qualys.com/ssllabs/2016/11/16/announcing-ssl-labs-grading-changes-for-2017</url></story><parent_chain></parent_chain><comment><author>meta_AU</author><text>I like how informal systems like this drive feature development in reverse proxies. Nginx has great support for automated OSCP now, but I wonder if that would have come to pass without some group saying it is important and giving it a (somewhat arbitrary) rating.</text></comment>