TLS 1.0 and 1.1 should be removed before the next update is final.

These are old and have been unsupported in other browsers for over three years and have known vulnerabilities.

Is there some real reason to keep them or is it just enabling downgrade attacks on the user for no real reason?

tls 1.0 1.1 and ssl 3.0 should be kept but disabled by default

there are still valid edge cases that would need em

routers are one

try and preserve as old of a spec as you can .. is my general recommendation but if it is critical as these old sec standards are they should have their checkboxes but functionality should be saved and activatable by pref

but do a pref reset of sec as a runonce in profile migration

.. Or do whatever you feel is best.

;)

It if now off by default for a few releases.

But as stated some old local gear might need it. I wouldn't still use a router needing it but there is still other stuff around.

i mean if it comes down to a hard nss requirement then maybe a little more thinking but if it is just your internal policy.. i encurage you to set sane defaults and perhaps remove a few ui checkboxes but leave the capability as long as it isn't a hinderance otherwise for such cases

i mean if it comes down to a hard nss requirement then maybe a little more thinking but if it is just your internal policy.. i encurage you to set sane defaults and perhaps remove a few ui checkboxes but leave the capability as long as it isn't a hinderance otherwise for such cases

in case matrix bridge didn't translate