3 ms·

It seems quite understandable that there'd be breaking changes between version 0.9 and 1.0, I don't see how you can extrapolate that to "OpenSSL doesn’t offer A

by codeka 14y ago

It seems quite understandable that there'd be breaking changes between version 0.9 and 1.0, I don't see how you can extrapolate that to "OpenSSL doesn’t offer API compatibility between versions." I also don't see how the advice to include your own version is any better than shipping two versions.

gilgoomesh 14y ago
I think Rentzsch is being somewhere between helpful and sarcastic. Apple could provide newer libssl dylibs and programmers should link against specific versions. You could argue the only mistake in this instance is the existence of the generic libssl.dylib symlink which will need to point to 0.9.8 in perpetuity. Exactly why Apple have given up on OpenSSL is anyone's guess (since Apple aren't saying -- hence Rentzsch's post). You could insert a conspiracy theory but my guess is that they can't be bothered curating and patching another OpenSSL library version since they themselves only ever use libcrypto. Apple could -- and do -- security patch libssl.0.9.8.dylib. So while you will never go from 0.9.8 to 1.0.1 automatically, you could automatically go from 0.9.8r to 0.9.8s automatically.
- mcbridematt 14y ago
  I believe it may of had to do with compliance with some US Government standard? Their own stack complies but they are unwilling and/or unable to do the same for OpenSSL. I recall there being a presentation from last years WWDC about this change...
klodolph 14y ago
Have you ever used OpenSSL? It is a total mess. For a popular project, its code is unreadable. I don't know how they maintain it.
- mccoyst 14y ago
  Upvoted. They maintain it by introducing an endless stream of bugs and vulnerabilities.
- taybin 14y ago
  I absolutely agree. I had to dig pretty deep into it to see what broke between versions. It is crazy town in there.
- dthunt 14y ago
  Heartily agree. But this thread is very wrong about loader basics.
mikeash 14y ago
Extrapolate? If there were breaking changes between 0.9 and 1.0, that is failing to offer API compatibility between versions. It doesn't matter whether it's understandable or not, they need X, the project provided not-X, and so it's not what they need. Apple shipped OpenSSL, then subsequently had problems with binary compatibility due to breaking changes, so now they're choosing a different approach.

by codeka 14y ago

gilgoomesh 14y ago

I think Rentzsch is being somewhere between helpful and sarcastic. Apple could provide newer libssl dylibs and programmers should link against specific versions. You could argue the only mistake in this instance is the existence of the generic libssl.dylib symlink which will need to point to 0.9.8 in perpetuity. Exactly why Apple have given up on OpenSSL is anyone's guess (since Apple aren't saying -- hence Rentzsch's post). You could insert a conspiracy theory but my guess is that they can't be bothered curating and patching another OpenSSL library version since they themselves only ever use libcrypto. Apple could -- and do -- security patch libssl.0.9.8.dylib. So while you will never go from 0.9.8 to 1.0.1 automatically, you could automatically go from 0.9.8r to 0.9.8s automatically.

mcbridematt 14y ago
I believe it may of had to do with compliance with some US Government standard? Their own stack complies but they are unwilling and/or unable to do the same for OpenSSL. I recall there being a presentation from last years WWDC about this change...

klodolph 14y ago

Have you ever used OpenSSL? It is a total mess. For a popular project, its code is unreadable. I don't know how they maintain it.

mccoyst 14y ago
Upvoted. They maintain it by introducing an endless stream of bugs and vulnerabilities.
taybin 14y ago
I absolutely agree. I had to dig pretty deep into it to see what broke between versions. It is crazy town in there.
dthunt 14y ago
Heartily agree. But this thread is very wrong about loader basics.

mikeash 14y ago

Extrapolate? If there were breaking changes between 0.9 and 1.0, that is failing to offer API compatibility between versions. It doesn't matter whether it's understandable or not, they need X, the project provided not-X, and so it's not what they need. Apple shipped OpenSSL, then subsequently had problems with binary compatibility due to breaking changes, so now they're choosing a different approach.