Drop support for weak cipher suites for TLS 1.2 on permission.site

[Kenneth-Barber]

Even though permission.site gives you the option to connect using HTTP instead of HTTPS, I still feel that it is important for HTTPS to be implemented securely. Please drop support for weak cipher suites for TLS 1.2. See the link below for more details: https://www.ssllabs.com/ssltest/analyze.html?d=permission.site

[lgarron]

permission.site is intended to be used across a wide variety of browsers.

Given that serious security concerns like downgrade attacks are well mitigated in browsers, I'd argue that compatibility with more cipher suites is more useful than the alternative.

In any case, this project uses GitHub Pages for hosting, and that does not allow this level of configuration. (Alternative hosting would raise barriers to maintenance and contribution.)

[Kenneth-Barber]

I would argue that browsers have good support for cipher suites, so security is more important.

Where can I leave this type of feedback for GitHub Pages?