tls: updated cipher defaults

[jasnell]

io.js recently updated the default cipher suite.
See
nodejs/node@77f3586
1e14f

This helps, for instance, with the "new" 13-year old
RC4 Bar Mitzvah vulnerability. This commit pulls over
the io.js commit.

[misterdjules]

I think it's important to keep the original author and commit message.

I've ported some changes from io.js in the past few weeks and I've started using the following form of commit messages: 61fe1fe.

What do you think?

[jasnell]

+1. Good plan. I can update the commit message for this one accordingly if
you'd like.
On Mar 30, 2015 4:23 PM, "Julien Gilli" notifications@github.com wrote:

I think it's important to keep the original author and commit message.

I've ported some changes from io.js in the past few weeks and I've started
using the following form of commit messages: 61fe1fe
61fe1fe
.

What do you think?

—
Reply to this email directly or view it on GitHub
#14192 (comment).

[misterdjules]

Yes please! Usually what I do is that I use the following command line to port a change from one repo (V8, libuv, io.js, etc.) to my local node repository:

git --git-dir=/path/to/local/repo/clone/.git/ format-patch -k -1 --stdout sha | git am

where sha is the commit hash of the change I want to port and /path/to/local/repo/clone is the path to a local clone of the repository where the change is.

Then I use git commit --amend (or git rebase and reword) to change the commit message.

[jasnell]

Replacing with another PR with the io.js pr commit message...

[piscisaureus]

@jasnell
I hope that you're aware that you can actually update an existing pull request? I notice that you always open new ones, but that really isn't necessary when you're just making small changes to a PR that's already open.

Try it out: git push <your-remote-name> +HEAD:tls-update-cipher-suite-defaults

[jasnell]

Thanks. I do. I just tend towards a natural aversion to changing history.
It's been a personal preference but I can edit the original ones just as
easily.
On Mar 30, 2015 5:32 PM, "Bert Belder" notifications@github.com wrote:

@jasnell https://github.com/jasnell
I hope that you're aware that you can actually update an existing pull
request? I notice that you always open new ones, but that really isn't
necessary.

Try it out: git push
+HEAD:tls-update-cipher-suite-defaults

—
Reply to this email directly or view it on GitHub
#14192 (comment).

[piscisaureus]

I just tend towards a natural aversion to changing history.

For repos that other people use like joyent/node, indeed, don't force push.
But for PRs it's fine; it keeps the noise down a little bit, and it makes it easier to track how a PR evolves over time.