4 ms·

1.0.1->1.0.2 is major upgrade (it's more like an "openssl 2.x to 3.x" type update). Static linking wouldn't help you because when you go to recompile you'll mos

by 0x0 10y ago

1.0.1->1.0.2 is major upgrade (it's more like an "openssl 2.x to 3.x" type update). Static linking wouldn't help you because when you go to recompile you'll most likely discover compilation fails because the API changed. For 1.0.1x->1.0.1y upgrades, dynamic linking means you just update the lib and restart running services, no recompilation needed. No random little-used binary hanging around with an old embedded static openssl, hopefully, as they will all pick up the patches as long as they dynamically link to the updated .so

wmf 10y ago
If it's a major upgrade then distros should make 1.0.1 and 1.0.2 parallel installable [1] so that apps can opt in to updating. [1] just kidding; I know distros don't have nearly enough resources to accomplish this
- 0x0 10y ago
  It would be technically possible but then they would end up having to maintain and offer two sets of every dependency, i.e. apache-ssl101 and apache-ssl102. Also, distros usually freeze what they have, so this would only be of interest for backports or perhaps if there was a need to supply old openssl versions even if a newer one is available before the freeze. The "solution" here is just to wait it out for new major releases of the various distros, and not expect everyone to change core libraries every six months :)
  - wmf 10y ago
    For example, Debian Jessie shipped with 1.0.1 even though 1.0.2 was already out, probably because not every app had been ported to 1.0.2 yet. But their "megafreeze" development model amplifies a 6-month scale problem into a many-year problem. If they had shipped both 1.0.1 and 1.0.2 then apps could have incrementally switched over at their own pace. Naturally, each app would only link against one version of OpenSSL so there'd be no need for apache-ssl101 and apache-ssl102.
    - 0x0 10y ago
      Well, Jessie froze on November 5th 2014, and OpenSSL 1.0.2 was released on January 22nd 2015. I do appreciate the "megafreeze" to work out all the quirks for a few months so I can have a stable release that works well for several years. If you only have one single app to host, I can see it's annoying to be stuck with last year's software. When you have dozens or hundreds of small websites and app backends, you really start to appreciate stable versions. :)

by 0x0 10y ago

wmf 10y ago

If it's a major upgrade then distros should make 1.0.1 and 1.0.2 parallel installable [1] so that apps can opt in to updating. [1] just kidding; I know distros don't have nearly enough resources to accomplish this

0x0 10y ago
It would be technically possible but then they would end up having to maintain and offer two sets of every dependency, i.e. apache-ssl101 and apache-ssl102. Also, distros usually freeze what they have, so this would only be of interest for backports or perhaps if there was a need to supply old openssl versions even if a newer one is available before the freeze. The "solution" here is just to wait it out for new major releases of the various distros, and not expect everyone to change core libraries every six months :)
- wmf 10y ago
  For example, Debian Jessie shipped with 1.0.1 even though 1.0.2 was already out, probably because not every app had been ported to 1.0.2 yet. But their "megafreeze" development model amplifies a 6-month scale problem into a many-year problem. If they had shipped both 1.0.1 and 1.0.2 then apps could have incrementally switched over at their own pace. Naturally, each app would only link against one version of OpenSSL so there'd be no need for apache-ssl101 and apache-ssl102.
  - 0x0 10y ago
    Well, Jessie froze on November 5th 2014, and OpenSSL 1.0.2 was released on January 22nd 2015. I do appreciate the "megafreeze" to work out all the quirks for a few months so I can have a stable release that works well for several years. If you only have one single app to host, I can see it's annoying to be stuck with last year's software. When you have dozens or hundreds of small websites and app backends, you really start to appreciate stable versions. :)