4 ms·

> Another option is to purchase a premium support contract which offers extended support (i.e. ongoing access to security fixes) for 1.1.1 beyond its public EOL

> Another option is to purchase a premium support contract which offers extended support (i.e. ongoing access to security fixes) for 1.1.1 beyond its public EOL date. There is no defined end date for this extended support and we intend to continue to provide it for as long as it remains commercially viable for us to do so (i.e. for the foreseeable future). I think that's fair. If organizations running this EOL software aren't inclined to move away from it, and expect continued support... yeah, pay us. Maybe at some point they will look at the cost and decide it's worth fixing their shit.

Wowfunhappy 3y ago
Why do these fixes not end up becoming available to the public? I guess the organizations which pay for it aren't incentivized to redistribute it? (I assume they legally could under an OSS license.) But then it only takes one...
- planede 3y ago
  > I assume they legally could under an OSS license. I don't think that assumption holds. New patches might not get a permissive license.
- dspillett 3y ago
  > Why do these fixes not end up becoming available to the public? Presumably the patches are not open source, and given to the supported users under a licence that restricts their distribution. The licenses the main code is available under say nothing to stop this – even if the project was covered by some GPL variant they would still be able to do this (assuming all contributors have signed over relicensing rights or similar). > But then it only takes one... That one might be taking quite a risk though. They'd be in breach of whatever agreement the updates were handed to them under, so might stop getting future updates so had better not do this (well, get caught doing it!) while they still depend on timely security updates themselves. Even if they no longer need future updates, there will be potential for a costly legal argument.
  - Wowfunhappy 3y ago
    Ah, I see, OpenSSL is licensed under "an Apache-style license"[1], so they can distribute patches under non-OSS licenses if they so desire. I thought it was a GPL-style viral license for some reason. 1: https://www.openssl.org/ https://www.openssl.org/
    - yrro 3y ago
      That applies to OpenSSL 3.0. 1.1.1 and other versions are more MIT-like, but with advertising clauses that make them incompatible with the GPL: https://www.openssl.org/source/license-openssl-ssleay.txt https://www.openssl.org/source/license-openssl-ssleay.txt https://news.ycombinator.com/item?id=13945492 https://news.ycombinator.com/item?id=13945492
    - semiquaver 3y ago
      Even if OpenSSL were licensed under the GPL, nothing prevents the organization from releasing patches or separate distributions under a restrictive commercial license. They are the copyright holder. Viral open source licenses constrain _licensees_ to release derivative works under the same terms, but they can’t somehow destroy inherent ownership rights due to the copyright holder.
      - Wowfunhappy 3y ago
        Yes, but only if no one outside the organization has ever contributed code, or if everyone who did signed a CLA.
        semiquaver 3y ago
        I was going to add that OpenSSL does in fact have a strong CLA enforcement policy, as should anyone attempting to earn money from open source software. Of course you’re right, if the actual copyright ownership is in dispute then ownership rights associated with that ownership are difficult to invoke.
- dumpsterdiver 3y ago
  In short, it's because that work would not otherwise be done unless there are companies that demand it. Who wants to work on software that has been deemed "end of life"? There will be no further traction with that software, only the people who aren't willing or able to update their legacy code will benefit from that work. This type of work is the epitome of "pay me" kind of work. Edit: I have an strong assumption that these EOL patches will not be open source. I didn't mention that in my comment, and I should have at the very beginning.
  - SoftTalker 3y ago
    > Who wants to work on software that has been deemed "end of life"? People who are pragmatic about their work and don't let their ego tell them that they should only be working on bleeding-edge software that "matters." If people are using it, it matters. More people are using and depending on OpenSSL than 90% of the code any VC startup is cranking out today.
    - anamexis 3y ago
      If I'm being pragmatic about my work, I'm going to demand to be paid.
      - SoftTalker 3y ago
        I said nothing about not being paid.
    - orf 3y ago
      > If people are using it, it matters Can they purchase food with a printed out list of all the companies that use OpenSSL?
- awill 3y ago
  charging also makes most people migrate off. It encourages good behaviour. And customers that can't migrate off (for good or bad reasons) pay. Seems like a good model to me. If they made it free, it wouldn't encourage good behaviour.
- ilyt 3y ago
  So they can sell the fix to more than one org, and support money flows, duh.

Wowfunhappy 3y ago

Why do these fixes not end up becoming available to the public? I guess the organizations which pay for it aren't incentivized to redistribute it? (I assume they legally could under an OSS license.) But then it only takes one...

planede 3y ago
> I assume they legally could under an OSS license. I don't think that assumption holds. New patches might not get a permissive license.
dspillett 3y ago
> Why do these fixes not end up becoming available to the public? Presumably the patches are not open source, and given to the supported users under a licence that restricts their distribution. The licenses the main code is available under say nothing to stop this – even if the project was covered by some GPL variant they would still be able to do this (assuming all contributors have signed over relicensing rights or similar). > But then it only takes one... That one might be taking quite a risk though. They'd be in breach of whatever agreement the updates were handed to them under, so might stop getting future updates so had better not do this (well, get caught doing it!) while they still depend on timely security updates themselves. Even if they no longer need future updates, there will be potential for a costly legal argument.
- Wowfunhappy 3y ago
  Ah, I see, OpenSSL is licensed under "an Apache-style license"[1], so they can distribute patches under non-OSS licenses if they so desire. I thought it was a GPL-style viral license for some reason. 1: https://www.openssl.org/ https://www.openssl.org/
  - yrro 3y ago
    That applies to OpenSSL 3.0. 1.1.1 and other versions are more MIT-like, but with advertising clauses that make them incompatible with the GPL: https://www.openssl.org/source/license-openssl-ssleay.txt https://www.openssl.org/source/license-openssl-ssleay.txt https://news.ycombinator.com/item?id=13945492 https://news.ycombinator.com/item?id=13945492
  - semiquaver 3y ago
    Even if OpenSSL were licensed under the GPL, nothing prevents the organization from releasing patches or separate distributions under a restrictive commercial license. They are the copyright holder. Viral open source licenses constrain _licensees_ to release derivative works under the same terms, but they can’t somehow destroy inherent ownership rights due to the copyright holder.
    - Wowfunhappy 3y ago
      Yes, but only if no one outside the organization has ever contributed code, or if everyone who did signed a CLA.
      - semiquaver 3y ago
        I was going to add that OpenSSL does in fact have a strong CLA enforcement policy, as should anyone attempting to earn money from open source software. Of course you’re right, if the actual copyright ownership is in dispute then ownership rights associated with that ownership are difficult to invoke.
dumpsterdiver 3y ago
In short, it's because that work would not otherwise be done unless there are companies that demand it. Who wants to work on software that has been deemed "end of life"? There will be no further traction with that software, only the people who aren't willing or able to update their legacy code will benefit from that work. This type of work is the epitome of "pay me" kind of work. Edit: I have an strong assumption that these EOL patches will not be open source. I didn't mention that in my comment, and I should have at the very beginning.
- SoftTalker 3y ago
  > Who wants to work on software that has been deemed "end of life"? People who are pragmatic about their work and don't let their ego tell them that they should only be working on bleeding-edge software that "matters." If people are using it, it matters. More people are using and depending on OpenSSL than 90% of the code any VC startup is cranking out today.
  - anamexis 3y ago
    If I'm being pragmatic about my work, I'm going to demand to be paid.
    - SoftTalker 3y ago
      I said nothing about not being paid.
  - orf 3y ago
    > If people are using it, it matters Can they purchase food with a printed out list of all the companies that use OpenSSL?
awill 3y ago
charging also makes most people migrate off. It encourages good behaviour. And customers that can't migrate off (for good or bad reasons) pay. Seems like a good model to me. If they made it free, it wouldn't encourage good behaviour.
ilyt 3y ago
So they can sell the fix to more than one org, and support money flows, duh.