Comment by jedberg

Comment by jedberg a day ago

58 replies

Curious, when you tell someone they need to access a website securely (or any other case where you might use the term TLS or SSL), do you:

1. Say SSL or TLS?

2. How old are you (or did you start working before 1999?)

I'll reply with my answer too.

marginalia_nu a day ago

1. SSL. For a long time I didn't even know TLS was the "same thing", but even now that I know it is, I still say SSL 9 times out of 10.

2. 38 - Started working in 2011, but my first forays into network programming was in something like 2004-2005.

Looked over onto my other screen and sure enough the function I'd literally minutes before added an if statement to went

        public Builder sslCertNotBefore(Instant sslCertNotBefore) {
            if (sslCertNotBefore.isAfter(MAX_UNIX_TIMESTAMP)) {
                sslCertNotBefore = MAX_UNIX_TIMESTAMP;
            }
            this.sslCertNotBefore = sslCertNotBefore;
            return this;
        }
I think possibly part of the problem is that we as programmers typically don't deal with TLS directly. The code above is part of a system I wrote that extracts detailed certificate information from HTTPS connections, and man was it ever a hassle to wrestle all the information I was interested in out of the java standard library.

Sure on the one hand it's easier to not mess up if it's all automatic and out of sight, but at the same time, it's not exactly beneficial to the spread of deeper awareness of how TLS actually works when it's always such a black box.

israrkhan a day ago

I think most people call it SSL because they use OpenSSL library to deal with secure communication have SSL in their names. Openssl being the most dominant one). Other libraries are BoringSSL, LibreSSL, wolfSSL etc.

Libraries with TLS in their names are less frequently used

GnuTLS, mbedTLS, s2n-tls and RustTLS.

  • slt2021 a day ago

    SSL is used in websites. TlS is used in other applications, as in mTLS

    • ItsHarper 20 hours ago

      TLS is absolutely used in websites, and I'm pretty sure modern browsers refuse to use any version of SSL.

    • [removed] 21 hours ago
      [deleted]
    • throwaway843 9 hours ago

      Unfortunately you were voted down for answering OP.

      SSL for websies, TLS for email, tunnels, XMPP, etc.

cesarb a day ago

I usually say SSL, because it has a greater chance of being understood than the more correct TLS (nobody uses SSL 3.0 anymore). It's also in the name of many SSL (I mean, TLS) libraries, like the classic OpenSSL.

But yeah, I learned about SSL back in the crypto wars days of the 1990s, back when you had to pirate the so-called "US only" version of Netscape if you wanted decent SSL encryption, so I might be just using the old term out of habit.

brandonmenc a day ago

I say "https" because sometimes even regular people know what that means.

  • frollogaston 31 minutes ago

    And it's a bit more precise to say HTTPS if you're talking about HTTPS.

mindcrime a day ago

These days I tend to say "TLS" more and more, but until just a year or two ago it was almost always "SSL". And "SSL" still slips out occasionally.

I'm 51, started working in IT in the mid 90's.

invaliduser 19 hours ago

1. I say both somewhat 50/50. I say SSL instinctively, and TLS when I think about it and remember we don't say SSL anymore. It's been like that for around 10 years now, before that I'd only say SSL.

2. I started programming professionally in 1998 and I'm in my early 50s.

gryfft a day ago

Reflex is to say SSL but usually correct myself to TLS. Started in IT in 2006 (was a nerd a few years before that though)

  • romanhn 21 hours ago

    Exactly this for me as well. Started a few years earlier.

mbreese 20 hours ago

1) SSL, even though I know the difference. More accurately, I know there is a difference, but SSL gets the point across.

2) before 1999. IIRC, the first SSL certificate I was involved with getting required the use of a fax machine.

amiga386 a day ago

I say HTTPS certificate.

If I need to specifically say SSL or TLS, it's SSL (as in OpenSSL, LibreSSL, BoringSSL, SSL certificates, Qualys SSL Labs, SSL Server Test). TLS is a made up name for SSL.

I do say e.g. "TLSv1.2" if I need to name the specific protocol, that's about it.

I was working before 1999.

notpushkin a day ago

SSL, 27. I would call it `tls` in code, though (and maybe “SSL/TLS” in docs, for clarity).

tesseract a day ago

(1) SSL

(2) 37. I've been an Internet user since ~1995 and been working in tech since 2004.

Bluecobra 16 hours ago

1. SSL

2. I’m old enough to remember 56-bit SSL encryption in browsers

cobbaut 15 hours ago

1. SSL

2. I'm 56 and was active in computer clubs in the late 80s, no network, no hard drive, thousands of floppy's.

mogwire 21 hours ago

SSL - In my 40s, over 20 plus years.

When do I say TLS, when that one annoying guy joins the call that always corrects you. Everyone hates him, and he doesn’t care.

baobun 21 hours ago

TLS: Rolls off the tounge easier. Feels nicer in mouth. Easier to slur smoothly. Flows better on keyboard.

It's the ergonomic choice (;

  • baobun 21 hours ago

    Aside: I think this shared preference for efficiency/comfort/laziness is big part of why master -> main spread quickly while JavaScript -> ECMAScript never had a chance.

    I guess it follows that Twitter/X might never be able to pull off a rebrand again.

-t0mm 11 hours ago

1. TLS 2. 22. Started in 2024, but the SSL terminology is still widely used in the systems that I currently work with :p

justusthane 21 hours ago

SSL. Working as a sysadmin since 2010. It just feels more right to me, and honestly, it hasn’t been until recently that I’ve noticed more of a concerted effort to rebrand it to TLS — not sure if that’s just my perception or not.

colmmacc 21 hours ago

Nobody ever says "TLS Certificate". It's only an "SSL Certificate". On that alone, it's just easier to stick to "SSL" for consistency and everyone knows what you mean.

  • mr_mitm 16 hours ago

    They should be saying X.509 certificate though. I think I say "server certificate" most of the time.

curmudgeon22 a day ago

SSL, started computer science in 2010

  • jedberg a day ago

    I was going to reply to you and tell you that you're too young to be a curmudgeon, but then I realized, no, I'm just old!

sanswork a day ago

SSL 42-started studying security in mid 90s as a teen started working 2000

  • theK 20 hours ago

    Ah yes, it was a grand time, freeform studying IT security as a teen in the 90s!

    • Bluecobra 16 hours ago

      It’s probably a good thing I didn’t have the knowledge/skills I have now, it might have saved me from trouble. Back in those days I was more interested in getting Back Orfice to remotely open a CD-ROM tray on a friend’s computer. I remember when broadband was first being rolled out it seemed like everyone was hooking up their cable/DSL modems directly to their PC and having a public IP with no firewall. Good times.

    • sanswork 18 hours ago

      My mom bought me applied crypto when I was thirteen and I was really into trying to learn how to find exploits with idapro and learning to code in general. It wasn't really the other kind of Freeform studying lol I was terrified of the thought of prison.

anal_reactor a day ago

I always say HTTPS because in the context of my area of speciality, the details of how HTTPS works don't matter and neither do secure communication protocols besides HTTPS.

itake a day ago

TLS. 1989.

Even today, people and marketing pages promote "SSL" term. Unless you specifically google, "What is the deference between SSL and TLS?" most people would have no idea what TLS is.

bravesoul2 17 hours ago

TLS probably. 2004

I think the TLS v1.2 pushed me that way

garbagepatch 21 hours ago

To users: https

To devs: SSL

Did not start working before 1999. Started using Linux in 2003.

ThunderSizzle a day ago

1. SSL (probably https in that specific scenario)

2. Graduated and started in 2015.

zamadatix a day ago

1. Cloudflare could probably use my choice of the day as another source for their randomness.

2. Started my first IT job on a computer networking team in 2012.

Octoth0rpe a day ago

1. SSL 2. Started working in 2000, right on the boundary

tptacek a day ago

I say TLS, and started working in the field in 1994.

__s 13 hours ago

TLS (outside dealing with PG options named like sslmode)

No

Rendello a day ago

SSL, started programming in maybe 2012. Possibly because of HTTPS or similarity with SSH.

kasey_junk a day ago

Almost always ssl. Started professionally in 1999. But! mTLS is always mTLS

unethical_ban a day ago

Nice try, targeted advertiser!

Mid 30s, SSL.

I work in cybersecurity and all the tools in the firewall/cert world still say "SSL decryption" and "SSL certificate". TLS is just a "major version" of SSL in my mind.