5 ms·
According to your linked article: > The OpenSSL 3.0 release schedule is documented on the OpenSSL 3.0 Release Schedule wiki page. We expect the final release t
by ldoughty 4y ago
According to your linked article:
> The OpenSSL 3.0 release schedule is documented on the OpenSSL 3.0 Release Schedule wiki page. We expect the final release to be in early Q4 2020.
Node 16 Release date:
> 2021-04-20
They gave themselves 3-6 months buffer from 3.0 release to Node 16 release, and decided to move forward when OpenSSL was 4-6 months behind schedule, with no idea when 3.0 would release
OpenSSL was then released in SEPTEMBER of 2021, nearly a year late, and 4 months after Node 16's LTS start date.... As of April, the Node team could not know if OpenSSL was going to be released tomorrow, next month, or next year
I think they made the right choice to keep moving forward instead of halting work waiting on OpenSSL to get back on schedule... by April 2021, when SSL 3.0 was already ~5-6 months behind, I would have expected them to extend support for 1.1.1 for another few months... they didn't but that's mostly a moot point -- OpenSSL has committed to security fixes through the Node 16 end-of-life.. but the Node team isn't comfortable with that, so they made a change
- electroly 4y agoIt seems I didn't make my suggestion clear, since you seem to be arguing against a point I didn't make. I'm saying they could have, and should have, announced the shortened LTS period when they released Node 16, after having already made the decision to ship with OpenSSL 1.1.1. The support period for OpenSSL 1.1.1 was known at the time -- why did it take this long for them to notice and pull back their LTS date accordingly? It could have been known on the day of Node 16's release. The important part of LTS releases is being able to make plans around firm dates; the specific length isn't important as long as it's known up front.