<commit_before>---
layout: post
title: GitLab.com and Logjam
date: 2015-06-16
author: <NAME>
author_twitter: maxlazio
---

We've previously announced [security advisory for Logjam vulnerability](https://about.gitlab.com/2015/05/21/security-advisory-for-logjam-vulnerability/). In that announcement we've mentioned that GitLab.com is using 1028-bit DH groups to retain compatibility with older Java-based clients.

We've updated recommended SSL ciphers for all GitLab installations and implemented new ciphers on GitLab.com.

<!--more-->

After some reasearch and testing we've decided to change the SSL cipher suite served by the web server/load balancer.

This decision was made after weighing on the trade-offs between having the stronger DH params and denying access to Java 6 based clients.


#### Using 2048-bit DHE params

Generating the 2048-bit DHE params was advised to help against the Logjam vulnerability. While this is a way to go for most servers, with GitLab.com we have to keep in mind that we have users using older Java-based clients.
Adopting the stronger params suites would prevent those users using GitLab.com completely.
Although the number of these users is not high, denying them access does not seem like an option.

#### Removing DHE suites<commit_msg>Say default/recommended and a number typo<commit_after>---
layout: post
title: GitLab.com and Logjam
date: 2015-06-16
author: <NAME>
author_twitter: maxlazio
---

We've previously announced [security advisory for Logjam vulnerability](https://about.gitlab.com/2015/05/21/security-advisory-for-logjam-vulnerability/). In that announcement we've mentioned that GitLab.com is using 1024-bit DH groups to retain compatibility with older Java-based clients.

We've updated the default/recommended SSL ciphers for all GitLab installations and implemented new ciphers on GitLab.com.

<!--more-->

After some reasearch and testing we've decided to change the SSL cipher suite served by the web server/load balancer.

This decision was made after weighing on the trade-offs between having the stronger DH params and denying access to Java 6 based clients.


#### Using 2048-bit DHE params

Generating the 2048-bit DHE params was advised to help against the Logjam vulnerability. While this is a way to go for most servers, with GitLab.com we have to keep in mind that we have users using older Java-based clients.
Adopting the stronger params suites would prevent those users using GitLab.com completely.
Although the number of these users is not high, denying them access does not seem like an option.

#### Removing DHE suites
{'fraction_non_alphanumeric': 0.06081601231716705, 'fraction_numerical': 0.022324865280985373, 'mean_word_length': 4.518046709129512, 'pattern_counts': {'":': 0, '<': 7, '<?xml version=': 0, '>': 7, 'https://': 2, 'lorem ipsum': 0, 'www.': 0, 'xml': 0}, 'pii_count': 0, 'substrings_counts': 0, 'word_list_counts': {'cursed_substrings.json': 0, 'profanity_word_list.json': 0, 'sexual_word_list.json': 0, 'zh_pornsignals.json': 0}}
{'dir': 'git-commits-cleaned', 'id': '4260544', 'n_tokens_mistral': 765, 'n_tokens_neox': 660, 'n_words': 353}