3 ms·

OpenSSL098-64.50.6 sigh What do we have to do to get Apple to actually update OpenSSL? It's beyond ridiculous. They're shipping the OS with a version of Ope

OpenSSL098-64.50.6 sigh What do we have to do to get Apple to actually update OpenSSL? It's beyond ridiculous. They're shipping the OS with a version of OpenSSL that is completely unsupported, and doesn't support newer security features.

strmpnk 9y ago
I believe Apple has adopted the BoringSSL fork that Google started. I bet this code is there for legacy reasons.
- alwillis 9y ago
  Apple wrote their own SSL/TLS stack a while ago; they haven't used OpenSSL for quite a while: https://developer.apple.com/security/ https://developer.apple.com/security/
- Twirrim 9y ago
  Right, but things compile against it. Having it on the system is arguably worse than dropping it entirely.
btgeekboy 9y ago
I suspect it's there for backwards compatibility only. OpenSSH on this OS version is compiled against LibreSSL, for example.
oneplane 9y ago
Because they patched it and they don't use it themselves, it's only for backwards compatibility. On top of that, it is not 'supported' by Apple, all programs for macOS use Objective-C and Swift libraries that abstract crypto to the point where it doesn't matter if under water some OpenSSL/LibreSSl/BoringSSL call is made.
- slrz 9y ago
  You are aware that one can write macOS programs in languages different from ObjC and Swift, right?
  - oneplane 9y ago
    Yes, and you are aware that you are free to use other libraries not supplied by the OS vendor, right?
larkost 9y ago
Apple announced many years ago now that they were not going to update the version of OpenSSL, and that the reason they were not going to do that was because of binary (and source) incompatibilities that OpenSSL routinely causes in major updates. This is very old news, and has been hashed out many times. The thing I don't understand is why no-one has created a shim on top of Apple's SecurityFramework to mimic OpenSSL, so things could be compiled against it. While it would be near-impossible to do this for all of OpenSSL's many features/modes (most people hate this), my bet is that it would not take much to completely cover what 90+% of projects need.

strmpnk 9y ago

I believe Apple has adopted the BoringSSL fork that Google started. I bet this code is there for legacy reasons.

alwillis 9y ago
Apple wrote their own SSL/TLS stack a while ago; they haven't used OpenSSL for quite a while: https://developer.apple.com/security/ https://developer.apple.com/security/
Twirrim 9y ago
Right, but things compile against it. Having it on the system is arguably worse than dropping it entirely.

btgeekboy 9y ago

I suspect it's there for backwards compatibility only. OpenSSH on this OS version is compiled against LibreSSL, for example.

oneplane 9y ago

Because they patched it and they don't use it themselves, it's only for backwards compatibility. On top of that, it is not 'supported' by Apple, all programs for macOS use Objective-C and Swift libraries that abstract crypto to the point where it doesn't matter if under water some OpenSSL/LibreSSl/BoringSSL call is made.

slrz 9y ago
You are aware that one can write macOS programs in languages different from ObjC and Swift, right?
- oneplane 9y ago
  Yes, and you are aware that you are free to use other libraries not supplied by the OS vendor, right?

larkost 9y ago

Apple announced many years ago now that they were not going to update the version of OpenSSL, and that the reason they were not going to do that was because of binary (and source) incompatibilities that OpenSSL routinely causes in major updates. This is very old news, and has been hashed out many times. The thing I don't understand is why no-one has created a shim on top of Apple's SecurityFramework to mimic OpenSSL, so things could be compiled against it. While it would be near-impossible to do this for all of OpenSSL's many features/modes (most people hate this), my bet is that it would not take much to completely cover what 90+% of projects need.