4 ms·

OpenSSL Announces Final Release of OpenSSL 3.2.0

73 points by hlandau 3y ago

clementmas 3y ago
So what's new? I don't understand the article. OpenSSL is the kind of technology I use on my web server without knowing how it actually works
- jmclnx 3y ago
  Plus the title makes no sense to me, "Final Release" ? After people just finished struggling to get to v3 of SSL, if that is true, I would say people should move to LibreSSL.
  - ehPReth 3y ago
    “OpenSSL 3.2.0 is the first General Availability release of the OpenSSL 3.2 release line” it exited beta.
    - system2 3y ago
      Final = coming at the end of a series. (no more after this). That's confusing.
      - paulddraper 3y ago
        It's the last release of 3.2.0, i.e. no alphas
  - megous 3y ago
    That's what the body of the text of the article is for.
- vore 3y ago
  The article has a list of what's new at the very start. I'm not sure what else you're not understanding.
  - clementmas 3y ago
    What does it mean in less technical terms?
ape4 3y ago
That's a lot of sizeable new features in something that's supposed to be bulletproof
- chrisherbt 3y ago
  True and concerning. LibreSSL has been leading the pack in terms of security, but I wouldn't even call it bulletproof. These are very complicated codebases. I'd love to see OpenSSL adopt an approach of "useful features, tested well, and nothing else" but that's basically why LibreSSL was born after heartbleed. So I won't hold my breath.
- halJordan 3y ago
  Ok whats you're problem that you want to see addressed?
  - jjjjmoney 3y ago
    Personally, I’d like to see a slower addition of features in something as critical as OpenSSL. LibreSSL (part of the OpenBSD project) has been aggressively pruning and hardening the codebase and is not immune to bugs. Security in crypto libraries is very hard.
  - formerly_proven 3y ago
    OpenSSL is the kitchen sink for relatively well validated, fast crypto primitives, yet every project that uses one of those has to include the other couple megs of libcrypto (most of that is in ASN1 and X509 implementations, which are libcrypto and not libssl). Certainly seems to me like there's room for a librealcrypto (ought to fit in well under a meg) and a libitutils (all that X509 stuff). OpenSSL is historically also the kitchen sink for TLS features and extensions, with rather mixed results.
- rurban 3y ago
  bulletproof? Ha. Have you ever looked at their UI and API? bulletproof is not the word which comes to mind
heinrich5991 3y ago
> Client-side QUIC support Is that enough to get rid of the QuicTLS fork? https://github.com/quictls/openssl https://github.com/quictls/openssl.
formerly_proven 3y ago
Big one > Support for using the Windows system certificate store as a source of trusted root certificates. This is not yet enabled by default and must be activated using an environment variable. This is likely to become enabled by default in a future feature release. OpenSSL is used for TLS in tons of software ported from Linux to Windows.

73 points by hlandau 3y ago

So what's new? I don't understand the article. OpenSSL is the kind of technology I use on my web server without knowing how it actually works

jmclnx 3y ago
Plus the title makes no sense to me, "Final Release" ? After people just finished struggling to get to v3 of SSL, if that is true, I would say people should move to LibreSSL.
- ehPReth 3y ago
  “OpenSSL 3.2.0 is the first General Availability release of the OpenSSL 3.2 release line” it exited beta.
  - system2 3y ago
    Final = coming at the end of a series. (no more after this). That's confusing.
    - paulddraper 3y ago
      It's the last release of 3.2.0, i.e. no alphas
- megous 3y ago
  That's what the body of the text of the article is for.
vore 3y ago
The article has a list of what's new at the very start. I'm not sure what else you're not understanding.
- clementmas 3y ago
  What does it mean in less technical terms?

ape4 3y ago

That's a lot of sizeable new features in something that's supposed to be bulletproof

chrisherbt 3y ago
True and concerning. LibreSSL has been leading the pack in terms of security, but I wouldn't even call it bulletproof. These are very complicated codebases. I'd love to see OpenSSL adopt an approach of "useful features, tested well, and nothing else" but that's basically why LibreSSL was born after heartbleed. So I won't hold my breath.
halJordan 3y ago
Ok whats you're problem that you want to see addressed?
- jjjjmoney 3y ago
  Personally, I’d like to see a slower addition of features in something as critical as OpenSSL. LibreSSL (part of the OpenBSD project) has been aggressively pruning and hardening the codebase and is not immune to bugs. Security in crypto libraries is very hard.
- formerly_proven 3y ago
  OpenSSL is the kitchen sink for relatively well validated, fast crypto primitives, yet every project that uses one of those has to include the other couple megs of libcrypto (most of that is in ASN1 and X509 implementations, which are libcrypto and not libssl). Certainly seems to me like there's room for a librealcrypto (ought to fit in well under a meg) and a libitutils (all that X509 stuff). OpenSSL is historically also the kitchen sink for TLS features and extensions, with rather mixed results.
rurban 3y ago
bulletproof? Ha. Have you ever looked at their UI and API? bulletproof is not the word which comes to mind

heinrich5991 3y ago

> Client-side QUIC support Is that enough to get rid of the QuicTLS fork? https://github.com/quictls/openssl https://github.com/quictls/openssl.

formerly_proven 3y ago

Big one > Support for using the Windows system certificate store as a source of trusted root certificates. This is not yet enabled by default and must be activated using an environment variable. This is likely to become enabled by default in a future feature release. OpenSSL is used for TLS in tons of software ported from Linux to Windows.