5 ms·

OSX 10.11 seems to ship with it too; /usr/bin/ssh -V OpenSSH_6.9p1, LibreSSL 2.1.7

by 0x0 11y ago

nailer 11y ago
The openssl binary in El Capitan (pretty sure this came with OS X 10.11 because of the path) is still on the 0.98 branch. Curious. $ openssl version OpenSSL 0.9.8zg 14 July 2015 $ which openssl /usr/bin/openssl
- deleted 11y ago
  [deleted]
- zacwest 11y ago
  Developers link against system OpenSSL, so Apple can basically never upgrade it.
  - vbezhenar 11y ago
    I'm not sure that Apple promised to stay with OpenSSL. Apple developed CryptoCommons wrapper for some OpenSSL methods and I'm sure, that they can make it work with LibreSSL. I was under impression that it was made specifically to be able to drop OpenSSL when they would want it.
    - zacwest 11y ago
      Those are the newer libraries you're _suppose_ to use, rather than OpenSSL. It's mostly older applications and codebases that limit Apple. I could imagine a stop-point but Apple obsesses a lot about not breaking backwards compatibility. Don't forget their version is ancient (API-wise; they back-port fixes) and LibreSSL is much newer, so it's not a drop in replacement for such an old version.
      - zw 11y ago
        > obsesses a lot about not breaking backwards compatibility Lo, how times have changed. ;-)
- X-Istence 11y ago
  Apple for the longest time shipped OpenSSL as a library that developers could link against in their binaries. Unfortunately OpenSSL even in minor versions could and would change function calls thereby making it almost impossible to keep up to date with OpenSSL for dynamic libraries because each new version required the developer to recompile the binary. Apple thus stopped shipping OpenSSL and has officially deprecated it, these days you won't find headers for it anywhere in the stock system and there is no official way to link against it anymore either in El Capitan. It just exists for backwards compatibility. If a developer now wants to use OpenSSL in their binary instead of the Common Crypto framework that Apple provides they will have to provide their own version of the library in their application, and they are then responsible for making sure users get patched in time.
  - nailer 11y ago
    Thanks. It looks like they're still shipping it (eg, it's in /usr/bin on El Capitan which is otherwise protected) but they're not shipping headers. Do you have a link for them deprecating it?
    - mrpippy 11y ago
      They put deprecation warnings in the headers starting with 10.7, and I'm pretty sure there was a WWDC talk (hopefully still available) mentioning it. These two links roughly explain the issues/reasoning: http://rentzsch.tumblr.com/post/33696323211/wherein-i-write-apples-technote-about-openssl-on http://rentzsch.tumblr.com/post/33696323211/wherein-i-write-... http://ludovicrousseau.blogspot.com/2011/08/mac-os-x-lion-and-openssl.html http://ludovicrousseau.blogspot.com/2011/08/mac-os-x-lion-an...
    - X-Istence 11y ago
      Yep, they are still shipping the binary, mostly for compatibility for scripts that require it. I have a feeling even that binary is eventually going to get dropped.

OSX 10.11 seems to ship with it too; /usr/bin/ssh -V OpenSSH_6.9p1, LibreSSL 2.1.7

by 0x0 11y ago

OSX 10.11 seems to ship with it too; /usr/bin/ssh -V OpenSSH_6.9p1, LibreSSL 2.1.7

The openssl binary in El Capitan (pretty sure this came with OS X 10.11 because of the path) is still on the 0.98 branch. Curious. $ openssl version OpenSSL 0.9.8zg 14 July 2015 $ which openssl /usr/bin/openssl

deleted 11y ago
[deleted]
zacwest 11y ago
Developers link against system OpenSSL, so Apple can basically never upgrade it.
- vbezhenar 11y ago
  I'm not sure that Apple promised to stay with OpenSSL. Apple developed CryptoCommons wrapper for some OpenSSL methods and I'm sure, that they can make it work with LibreSSL. I was under impression that it was made specifically to be able to drop OpenSSL when they would want it.
  - zacwest 11y ago
    Those are the newer libraries you're _suppose_ to use, rather than OpenSSL. It's mostly older applications and codebases that limit Apple. I could imagine a stop-point but Apple obsesses a lot about not breaking backwards compatibility. Don't forget their version is ancient (API-wise; they back-port fixes) and LibreSSL is much newer, so it's not a drop in replacement for such an old version.
    - zw 11y ago
      > obsesses a lot about not breaking backwards compatibility Lo, how times have changed. ;-)
X-Istence 11y ago
Apple for the longest time shipped OpenSSL as a library that developers could link against in their binaries. Unfortunately OpenSSL even in minor versions could and would change function calls thereby making it almost impossible to keep up to date with OpenSSL for dynamic libraries because each new version required the developer to recompile the binary. Apple thus stopped shipping OpenSSL and has officially deprecated it, these days you won't find headers for it anywhere in the stock system and there is no official way to link against it anymore either in El Capitan. It just exists for backwards compatibility. If a developer now wants to use OpenSSL in their binary instead of the Common Crypto framework that Apple provides they will have to provide their own version of the library in their application, and they are then responsible for making sure users get patched in time.
- nailer 11y ago
  Thanks. It looks like they're still shipping it (eg, it's in /usr/bin on El Capitan which is otherwise protected) but they're not shipping headers. Do you have a link for them deprecating it?
  - mrpippy 11y ago
    They put deprecation warnings in the headers starting with 10.7, and I'm pretty sure there was a WWDC talk (hopefully still available) mentioning it. These two links roughly explain the issues/reasoning: http://rentzsch.tumblr.com/post/33696323211/wherein-i-write-apples-technote-about-openssl-on http://rentzsch.tumblr.com/post/33696323211/wherein-i-write-... http://ludovicrousseau.blogspot.com/2011/08/mac-os-x-lion-and-openssl.html http://ludovicrousseau.blogspot.com/2011/08/mac-os-x-lion-an...
  - X-Istence 11y ago
    Yep, they are still shipping the binary, mostly for compatibility for scripts that require it. I have a feeling even that binary is eventually going to get dropped.