6 ms·
> And by widely leveraged, I mean almost completely ubiquitous, if you’re using HTTPS, chances are you’re using OpenSSL. Almost everyone is. This is probably a
by mmwelt 4y ago
> And by widely leveraged, I mean almost completely ubiquitous, if you’re using HTTPS, chances are you’re using OpenSSL. Almost everyone is.
This is probably a bit of an exaggeration. There are quite a few other SSL implementations that actually are also "widely leveraged"[1]. In particular, LibreSSL was forked and cleaned up after Heartbleed. Google uses BoringSSL. GnuTLS is widely used and unrelated to OpenSSL.
[1] https://en.wikipedia.org/wiki/Comparison_of_TLS_implementations https://en.wikipedia.org/wiki/Comparison_of_TLS_implementati...
- woodruffw 4y agoIs GnuTLS widely used? People bring it up, but I've never actually seen it in a codebase (and I deal with a lot of x509 + PKCS code). I've seen more wolfSSL and mbedTLS than GnuTLS.
- SSLy 4y agowidely? depends on your viewpoint, but there are quite few consumers (look at the right column) https://archlinux.org/packages/core/x86_64/gnutls/ https://archlinux.org/packages/core/x86_64/gnutls/
- shandor 4y agoHow is wolfSSL/SSH? I have come across them a couple of times, but not having anyone/anything ”famous” behind them when compared to GNUtls or mbedtls always made me somewhat wary.
- saghm 4y agoFrom looking at my currently installed packages, there are quite a few that depend on gnutls: ffmpeg, gnupg, libcups, vlc, and wget look like the ones that would be most well known. It's possible that they only use it as an option, but normally I'd expect it to only be an optional dependency if that were the case. I haven't looked at any of their codebases though, so no idea what they use it for!
- Conan_Kudo 4y agoOne lesser known common user of GnuTLS is GNOME. Pretty much the entire GNOME ecosystem uses it.
- mmwelt 4y agoOne probably important project that uses it is OpenConnect, as the VPN servers would probably be listening on a port reachable on the open internet.
- JSGdev 4y agoYep we've been using rustls for most of a year no issues. Memory safety go brrr :) Would encourage others to take a look at it. Ring is a good base that's been audited and the lower attack surface from no old openssl bloat code makes a difference.
- justinjlynn 4y agoRing, unfortunately, has quite toxic project leadership with a history of making hostile decisions towards their contributors and userbase ( see https://github.com/briansmith/ring/issues/774 https://github.com/briansmith/ring/issues/774 for one example ). Something to be aware of if you're considering building with it.
- drran 4y agoIt looks like author of ring library tries to protect their user base from security vulnerabilities, but hit by bug(?) in cargo, which changed from warning to error for yanked libraries. Anyway, no promises until API version 1.0.
- justinjlynn 4y agoThat's a rather charitable interpretation of events. Events which didn't need to happen. Events which happened for dubious reasons and which depended dubious reasoning.
- drran 4y agoDemand your money back!
- justinjlynn 4y agoOh no. Just because they donate their time and effort the community can't criticise them; even if how they work and interact with the community hurts and embarrasses the community... it was all free after all and the community added nothing to it! /s That's really not how it works when you work with others and use other's resources and time. Nobody's entitled to their effort, but they're also not immune to criticism from others for that effort if they hold that effort out for others - if they expect immunity because it's 'free' they're just wasting people's time and preventing the development of a solution which doesn't.
- thayne 4y agoNot to mention that a lot of places are still using openssl 1.1.1.