glib-networking supports insecure TLS protocol version fallback for compatibility with broken TLS servers. Recently Firefox [1] and now Chrome [2] have both removed support for these broken servers, and it's time to do so in WebKit as well. I think it's surely safe for libsoup to do this, as any affected HTTP servers are already inaccessible with major browsers. That way we won't need any changes in WebKit, and anything using libsoup will benefit. If we had this we would not have been vulnerable to e.g. the POODLE attack.

We really ought to remove insecure protocol version fallback from glib-networking, where it's implemented. But I suppose that is more likely to break something.

[1] https://bugzilla.mozilla.org/show_bug.cgi?id=1084025
[2] https://bugs.chromium.org/p/chromium/issues/detail?id=583787#