5 ms·

FWIW, LibreSSL replaced OpenSSL in OpenBSD 5.6 -- over a year ago.

DiabloD3 11y ago
OpenBSD started the LibreSSL project, so, naturally, they would adopt it. OSX has also adopted it for purely license politics reasons, El Capitan shipped with it: $ /usr/bin/ssh -V OpenSSH_6.9p1, LibreSSL 2.1.8
- jlgaddis 11y ago
  > "... license-related political reasons ..." > "... license politics reasons ..." I'm not sure exactly what you mean by this? I mentioned OpenBSD replacing OpenSSL with it simply because the "official" OpenSSH is now developed against it. I'm not sure if LibreSSL is being used for the portable version yet but if/when that happens, I expect people will begin to "trust" it more, leading to more projects potentially deciding to also replace OpenSSL with LibreSSL (i.e. for valid technical reasons, not for "political" ones).
  - DiabloD3 11y ago
    Until the announcement in August 2015, OpenSSL was dual licensed ASL1 + SSLeay License (and by dual licensed, OpenSSL means both apply, instead of choose one), the terms of which make it GPL incompatible, and also has questionable patent issues (a problem for commercial software). The announcement was that they are moving to Apache License 2.0, thus solving both issues. However, this move has not happened yet.
- marcosdumay 11y ago
  Debian stable is using LibreSSL for around a year already (Debian started switching just after the fork).
  - DiabloD3 11y ago
    Debian is not using LibreSSL, I just checked. Sid currently ships OpenSSL 1.0.2e, and Jessie currently ships 1.01k.
    - ausjke 11y ago
      openssl is still the most popular one everywhere, it will probably be so for a long time.
    - marcosdumay 11y ago
      Ouch, you are correct. Something changed a while ago, my software stopped working with it, and I could only fix once I followed some LibreSSL guidelines. I thought it was this change, looks like I was wrong.
rplnt 11y ago
And I believe RHEL/Fedora use NSS?
- DiabloD3 11y ago
  NSS is not an OpenSSL drop in. Firefox, Chrome on platforms other than Android, OSX, and iOS (although I think they have completed removal of the NSS interface and gone with OpenSSL on all platforms, now served by Google's own BoringSSL fork), the mod_nss module for Apache, some Java projects (including some from Redhat and Sun/Oracle) that don't want to use Java's own SSL API, all use NSS.

OpenBSD started the LibreSSL project, so, naturally, they would adopt it. OSX has also adopted it for purely license politics reasons, El Capitan shipped with it: $ /usr/bin/ssh -V OpenSSH_6.9p1, LibreSSL 2.1.8

jlgaddis 11y ago
> "... license-related political reasons ..." > "... license politics reasons ..." I'm not sure exactly what you mean by this? I mentioned OpenBSD replacing OpenSSL with it simply because the "official" OpenSSH is now developed against it. I'm not sure if LibreSSL is being used for the portable version yet but if/when that happens, I expect people will begin to "trust" it more, leading to more projects potentially deciding to also replace OpenSSL with LibreSSL (i.e. for valid technical reasons, not for "political" ones).
- DiabloD3 11y ago
  Until the announcement in August 2015, OpenSSL was dual licensed ASL1 + SSLeay License (and by dual licensed, OpenSSL means both apply, instead of choose one), the terms of which make it GPL incompatible, and also has questionable patent issues (a problem for commercial software). The announcement was that they are moving to Apache License 2.0, thus solving both issues. However, this move has not happened yet.
marcosdumay 11y ago
Debian stable is using LibreSSL for around a year already (Debian started switching just after the fork).
- DiabloD3 11y ago
  Debian is not using LibreSSL, I just checked. Sid currently ships OpenSSL 1.0.2e, and Jessie currently ships 1.01k.
  - ausjke 11y ago
    openssl is still the most popular one everywhere, it will probably be so for a long time.
  - marcosdumay 11y ago
    Ouch, you are correct. Something changed a while ago, my software stopped working with it, and I could only fix once I followed some LibreSSL guidelines. I thought it was this change, looks like I was wrong.

rplnt 11y ago

And I believe RHEL/Fedora use NSS?

DiabloD3 11y ago
NSS is not an OpenSSL drop in. Firefox, Chrome on platforms other than Android, OSX, and iOS (although I think they have completed removal of the NSS interface and gone with OpenSSL on all platforms, now served by Google's own BoringSSL fork), the mod_nss module for Apache, some Java projects (including some from Redhat and Sun/Oracle) that don't want to use Java's own SSL API, all use NSS.