Looking at the SSL cipher suite list, there are some real insecure ones in there. Maybe someone could have a looksee at the library that's shipping, at least before Beta-1 or R1.
I see TLS_DHE_RSA_WITH_DES40_CBC_SHA, TLS_RSA_WITH_RC2_CBC_40_MD5, TLS_RSA_WITH_RC4_40_MD5, and TLS_DHE_DSS_WITH_DES40_CBC_SHA, which are mentioned in various online pieces as very bad.
Also there's TLS_ECDH_RSA_WITH_RC4_128_SHA, TLS_ECDH_ECDSA_WITH_RC4_128_SHA, TLS_RSA_WITH_RC4_128_SHA, TLS_RSA_WITH_RC4_128_MD5, TLS_ECDHE_RSA_WITH_RC4_128_SHA, TLS_ECDHE_ECDSA_WITH_RC4_128_SHA, TLS_DHE_RSA_WITH_DES_CBC_SHA, TLS_DHE_DSS_WITH_DES_CBC_SHA, and TLS_RSA_WITH_DES_CBC_SHA, all of which aren't given much better review than the first group. There may be other things in there that should be evaluated, so maybe an expert opinion (not mine, which is NOT expert) is a good idea. There may be new ciphers that have been issued since Haiku's version of the library (whether they're good or bad, I don't know).
The current lib uses TLS compression (which is considered bad), uses TLS 1.0, which was given bad reviews under certain conditions, and does not use TLS 1.2, which is considered better than TLS 1.0 under most conditions (non-expert opinion of what I've read). I think SSL3 isn't very good either, but probably should be evaluated. There could be more issues with the current setup (again - I'm not claiming to be any expert) - so it may be nice to check on this before R1- in any case.
