A question that had been asked about 3 years ago (Sep 11 2009) and that I answered last week as just been closed as not constructive: Functional implications of differences in SSL and TLS
This is a fairly simple question and I'd consider it on-topic.
For a long time, the best rated answer was this one. Unfortunately, this answer is incorrect. I made a simple comment to point this out on Sep 22 2010. For some reason, I noticed later on that its score kept increasing so I left another comment on Dec 5 2011. I felt it might be a bit inappropriate, but I was a least linking to another similar question on Security.SE, which had a number of answers with references.
Again, later, I noticed that its score kept increasing, despite the fact it was still wrong. At this point, I felt that writing any more comments would definitely be inappropriate. Therefore, I took a fair amount of time to write an answer with substantial references. This is after all the way SE should work.
Now, the question has just been closed as "not constructive":
This question is not a good fit to our Q&A format. We expect answers to generally involve facts, references, or specific expertise; this question will likely solicit opinion, debate, arguments, polling, or extended discussion. See the FAQ for guidance on how to improve it.
OK, there was a slight debate, only because some the other answers didn't necessarily involve "facts, references, or specific expertise" (most specifically the one that had been so far the most highly upvoted). It's not my fault or the asker's fault.
This question CAN be answered with facts and references. Although a lot of people seem to be mistaken about this (possibly because they haven't read the actual specifications and may have been mislead by configuration options in well known pieces of software), I think it's fine to leave this question open and to answer it.
Why was it closed?
(I'll admit that my comment to the question itself could be deleted...)
EDIT: The question is now locked.
Thanks for re-opening it, but I'm not sure locking it is great either.
The description for Locked says "it is not considered a good, on-topic question for this site", but I still think it can be on-topic.
I agree this is a broad question, but I still think it could stay open. I think it's relevant for sysadmins to know how SSL, TLS and STARTTLS relate, even on a quite general basis. The secondary question ("When do I use which? When do I not use which?") can be actually quite relevant in general, especially because the answer will be more or less the same for LDAPS/LDAP+STARTLS, IMAPS/IMAP+STARTTLS, SMTPS/STMP+STARTTLS, ...
I would suggest to re-open it normally on the basis that:
- It's not that bad a question. There are certainly worse questions open. In my experience, mostly on the SO
ssltag, a number of questions are often not clear (and possibly too specific). - I would like to tweak my answer as I've found a couple of better links since. I just can't. (I can't even delete my comment to the question itself, which I would otherwise do.)
- In the gaming spirit of SE, I've still made fewer points than the wrong answer (18*10 - 5*2 is more than 14*10). I'm not sure why I should be prevented from getting any more votes (including potential downvotes: I'm willing to take that risk).
EDIT 2 to answer Chris's point.
It's a bad question and putting a positive light on it isn't going to change that. Also, we're NOT STACK OVERFLOW, and referencing them makes me scowl and want to pull out the mod hammer.
Sorry, I didn't mean to cause offense by mentioning SO. What I meant is that there are a lot a SSL/TLS questions out there that are not necessarily as clear as the general SE expectations. At least, this question had the advantage of going straight to the point (and being answerable, at the end of the day). You also get a number of SSL/TLS questions on SF that are not great (a lot of them are variants and almost duplicates of "How do I run multiple sites with a single IP address?", for example).
Wanting to edit your Answer is a valid point; the problem I've got is that it's still a bad question. This leads me to one obvious conclusion, the Question needs to be better. Votes are exceedingly difficult to get from curmudgeonly, misanthropic system administrators. Our chat room motto used to be "Abandon hope all ye who enter here". (the inscription on the gates to hell according to Dante).
The question itself has 14 upvotes, no downvotes, 5 of which where made after I posted my answer. My answer itself also got 14 upvotes in about a week. I'm merely arguing that a number of people don't seem to agree with you on this point. A question that's upvoted so much and that can lead to an answer of reasonable quality (admittedly, I'm biases on this), also relatively highly upvoted, can't be as bad a question as you think.
In addition, while the question is quite broad indeed, so are a number of questions in the canonical questions list, not all of which are inherently bad or up for closure/locking.
Could you re-open the question as a normal question, please?
EDIT 3 (29th Sep 2012)
Apologies for re-visiting this, but I've just re-read the newly edited question again, and it makes me realise that it's not quite right. It also appears that not all sysadmins understand the different between SSL, TLS and upgrading from a plain-text protocol to its SSL/TLS variant.
The initial question was quite plainly "What's the difference with SSL and TLS? (When do I use which? When do I not use which?)", a fairly short question, but straight to the point.
It was deemed not-constructive by some moderators, and re-written as "I know that TLS is essentially a newer version of SSL, and that it generally supports transitioning a connection from unsecured to secured (commonly through a STARTTLS command)." by Chris S.
I hadn't really paid attention after that discussion (and was quite happy with the compromise), but that sentence is actually not quite true.
- Firstly, most people don't seem to know that TLS is essentially a new version of SSL. They just seem to confuse TLS with START TLS.
- Secondly, saying that "it generally supports transitioning a connection from unsecured to secured (commonly through a STARTTLS command)" is actually misleading. There's more details in my answer to that question, but the fact that you can enabled SSL/TLS connection on an existing TCP connection using a STARTTLS-like command is actually orthogonal to the fact that it's using SSL or TLS. I'll admit that the STARTTLS-based specifications only mention TLS, but so does the HTTPS specification (HTTP over TLS, RFC 2818), which hasn't prevented most people from using SSLv3 (not TLS) for HTTPS for a while (TLS for HTTPS has become mainstream only a few years ago).
Could we have that question back as "What's the difference between SSL and TLS" or at least "What's the difference between SSL, TLS and STARTTLS?". It's a fair, straightforward, good and constructive question that's definitely on-topic for the ServerFault community.
(Sorry, I hadn't realised I had enough rep to edit it myself. Just done it.)
