@voltone We’re now four years further. There are some new OTP versions with updates to the :ssl and related modules, and libraries like mint and HTTP-clients built on top of it (mojito, yet another tesla backend) have been built, how does the HTTP client security landscape look now?
Qqwy
TypeCheck Core Team
2
voltone
:ssl has improved a bit: it removed support for SSL 3.0, it added TLS 1.3 (still a bit flaky) along with some new ciphers/curves, and better handling of out-of-order certificates coming from the server. But what hasn’t changed is the default of verify: :verify_none, both for :ssl.connect/2,3,4 and the :httpc application.
HTTPotion seems to be ‘soft deprecated’.
Hackney has had a few issues lately due to :ssl changes. Sometimes it was possible to work around them, until a new version would land, by passing custom ssl options. The major catch there is that any custom ssl options passed to Hackney (and therefore HTTPoison and Tesla) will overwrite the secure defaults. So passing something like ssl: [versions: [:tlsv1_2]] reverts the :verify option back to :verify_none!
Mint attempts to merge custom ssl options with its own secure defaults (which is not trivial to do, since the individual options are inter-dependent). Any libraries that build on Mint should be fine too.
You can consider my ElixirConf EU 2019 talk ‘Learn you some :ssl for much security’ to be an updated version of the blog post referenced earlier in this thread. It is already a year old, but still mostly relevant.
7
Qqwy
TypeCheck Core Team
Exadra37
This an underlying problem of the Erlang core, where the :ssl just doesn’t do what the name stands for, aka by default doesn’t check TLS certificates… seriously???
I just don’t get why in the Erlang/Elixir community this considerable to be an acceptable thing and not considered as a security vulnerability worth of opening a CVE against it… I just don’t get it!!!t
Why its allowed to continue like this for so many years??? I ask because if it was in one of that programming languages that everyone likes to shame, the CVE would be open immediately.
1
Exadra37
I would love to know Erlang to make the merge request to fix the current one.
It’s really necessary to replace it to fix it?
Even if the module needs replacement it should be fixed.
If is a :ssl module it should not ask us to configure it to verify certificates, because that is the main reason the module exists or is the module meant to be for other things and just got a bad name?
As it stands now is like an engineering building an home and asking if we want doors, roof or windows on it.
0