4 ms·
Wasn't OpenSSL quite vulnerable and not recommended to use few years back and people were phasing it out? Or am I mistaking this with something else?
by rplnt 11y ago
Wasn't OpenSSL quite vulnerable and not recommended to use few years back and people were phasing it out? Or am I mistaking this with something else?
- chadzawistowski 11y agoYes, the OpenBSD folks have forked it as LibreSSL.
- benchaney 11y agoThere was a pretty serious security issue in it, but it was fixed. A lot of people were predicting the end of OpenSSL, but at the end of the day, most viable alternatives came around too late for people to phase it out.
- DiabloD3 11y agoYou're a bit mistaken. A lot of FOSS political warrghble happened, but OpenSSL still remains the most audited and used SSL library out there. Yes, it may have bugs. Yes, the NSA may have tampered with the standards themselves (that everyone else must also implement, else risk compatiblity issues in some areas). But there are no drop in alternatives that aren't based on the same codebase, and almost no one is using any alternatives: NSS (Mozilla's framework) is rarely used outside of Firefox, GnuTLS is rarely used, I've never heard of anyone using PolarSSL outside of very specific embedded projects, and LibreSSL (a OpenSSL fork) is being adopted only as a license-related political response, and BoringSSL is Google's response to the entire thing (their own OpenSSL fork that they control, to just ignore the entire political bullshit).
- jlgaddis 11y agoFWIW, LibreSSL replaced OpenSSL in OpenBSD 5.6 -- over a year ago.
- DiabloD3 11y agoOpenBSD started the LibreSSL project, so, naturally, they would adopt it. OSX has also adopted it for purely license politics reasons, El Capitan shipped with it: $ /usr/bin/ssh -V OpenSSH_6.9p1, LibreSSL 2.1.8
- jlgaddis 11y ago> "... license-related political reasons ..." > "... license politics reasons ..." I'm not sure exactly what you mean by this? I mentioned OpenBSD replacing OpenSSL with it simply because the "official" OpenSSH is now developed against it. I'm not sure if LibreSSL is being used for the portable version yet but if/when that happens, I expect people will begin to "trust" it more, leading to more projects potentially deciding to also replace OpenSSL with LibreSSL (i.e. for valid technical reasons, not for "political" ones).
- DiabloD3 11y agoUntil the announcement in August 2015, OpenSSL was dual licensed ASL1 + SSLeay License (and by dual licensed, OpenSSL means both apply, instead of choose one), the terms of which make it GPL incompatible, and also has questionable patent issues (a problem for commercial software). The announcement was that they are moving to Apache License 2.0, thus solving both issues. However, this move has not happened yet.
- marcosdumay 11y agoDebian stable is using LibreSSL for around a year already (Debian started switching just after the fork).
- rplnt 11y agoAnd I believe RHEL/Fedora use NSS?
- DiabloD3 11y agoNSS is not an OpenSSL drop in. Firefox, Chrome on platforms other than Android, OSX, and iOS (although I think they have completed removal of the NSS interface and gone with OpenSSL on all platforms, now served by Google's own BoringSSL fork), the mod_nss module for Apache, some Java projects (including some from Redhat and Sun/Oracle) that don't want to use Java's own SSL API, all use NSS.
- jlgaddis 11y agocf. heartbleed [0] [0]: https://en.wikipedia.org/wiki/Heartbleed https://en.wikipedia.org/wiki/Heartbleed