 |
 |
SSL is security theatre unless people start doing it better. SSL is a layer of complexity, it's easy to get wrong and the library community is systematically getting it wrong (picking on some big names, because they're tough enough to take it, not because they noticeably do it any better or worse): https://www.ssllabs.com/ssltest/analyze.html?d=viaf.org https://www.ssllabs.com/ssltest/analyze.html?d=code4lib.org https://www.ssllabs.com/ssltest/analyze.html?d=loc.gov I'd implore you to check a couple of sites local to you and ping the administrators if it doesn't get the all clear. In some cases there are reasons why security might be lagging on a particular site (third party hosting, third party client connecting using out-of-date SSL libraries, need to support many-years-out-of-patch-cycle browsers, etc), but that's the kind of thing that needs to be an explicit policy. cheers stuart