9 ms·

The annoying thing about GnuTLS is that it normally might not be very widely used, except that the Debian project initiated a huge push to make software linkabl

by agwa 13y ago

The annoying thing about GnuTLS is that it normally might not be very widely used, except that the Debian project initiated a huge push to make software linkable with GnuTLS instead of OpenSSL, because of issues with the OpenSSL license[1]. So if you're a Debian or Ubuntu user, you're probably relying on GnuTLS a lot more than users of any other distribution, or people who compile the upstream sources themselves. (Not that OpenSSL is a panacea, but at least it gets more attention than GnuTLS). [1] The OpenSSL license is incompatible with the GPL, making it technically illegal to distribute binaries of GPL programs linked with OpenSSL (so Debian refuses to do so), unless the GPL program has an OpenSSL license exception.

Xylakant 13y ago
The problems of linking GPL-code with OpenSSL was one of the reasons why ruby is dual-licenced today afaik.
- Argorak 13y ago
  Among others. Ruby was GPL/Ruby-licensed and is now licensed BSD/Ruby, which makes shipping OpenSSL easier.
nly 13y ago
Some critical (to me) dependency chains on my system (Arch, KDE) seems to be Networkmanager → libsoup → glib-networking → GnuTLS Eclipse → WebkitGTK → libsoup ... VLC → FFmpeg → GnuTLS kdelibs (core KDE libs) → upower → libimobiledevice → GnuTLS I have a feeling there are greater dependencies within GNOME distros and, as you said, Debian. Networkmanager is an especially annoying one because it uses NSS directly and gnuTLS indirectly.
- dfc 13y ago
  If any Debian user is curious they can use the following commands to see gnutls dependents: $ apt-cache rdepends libgnutls27 libgnutls26 libcurl3-gnutls $ apt-cache --installed rdepends libgnutls27 libgnutls26 libcurl3-gnutls The latter invocation only displays packages which are installed locally, the former prints all packages apt is aware of.
alexforster 13y ago
I don't understand why NSS[1] isn't more highly regarded. It's the crypto library that both Chrome and Firefox use, and it has a comparatively good security record[2]. [1] https://developer.mozilla.org/en-US/docs/NSS https://developer.mozilla.org/en-US/docs/NSS [2] http://cve.mitre.org/cgi-bin/cvekey.cgi?keyword=nss http://cve.mitre.org/cgi-bin/cvekey.cgi?keyword=nss
- nly 13y ago
  It's regarded enough to be used by Java, Flash, Networkmanager, and Libreoffice... API is very low level though when all you want is a secure socket.
  - timclassic 13y ago
    Exactly.
- hyc_symas 13y ago
  NSS was designed for use in single-user browsers and the API is completely unsuitable for more general, multi-user system-wide deployment. https://wiki.mozilla.org/NSS_Library_Init https://wiki.mozilla.org/NSS_Library_Init RedHat has misguidedly chosen to base all of its security infrastructure on NSS, even though NSS was never designed for such a use. It is completely inappropriate for servers, multi-user workstations, etc.
  - blahbl4hblahtoo 13y ago
    Having a system wide certificate store is a good idea, though...
- cpeterso 13y ago
  Chrome is dropping NSS for OpenSSL: https://docs.google.com/document/d/1ML11ZyyMpnAr6clIAwWrXD53pQgNR-DppMYwt9XvE6s/edit?pli=1 https://docs.google.com/document/d/1ML11ZyyMpnAr6clIAwWrXD53...
belorn 13y ago
While some usage comparison between GnuTLS and OpenSSL is good, it is important to remember that each project support different features. For example, OpenSSL do not support OpenPGP.
benihana 13y ago
The irony of what's happening here, that dogmatism about a belief is causing an inferior solution to be used, is infuriating and one of the reasons people have such a problem with dogmatic personalities like rms. It's technically illegal to use a better solution because of something as relatively unimportant as a license. Think of it like a Maslov's hierarchy - having strong security is way more important to most people than having a proper copyleft license. But instead of being pragmatic, we're stuck with a ridiculously dogmatic solution that ends up harming way more than the ill it was trying to cure. It reminds me a lot of environmentalists going crazy to ban nuclear power in the 70s before we had as clear a grasp on the impact of dumping carbon dioxide into the air.
- chimeracoder 13y ago
  > The irony of what's happening here, that dogmatism about a belief is causing an inferior solution to be used, is infuriating and one of the reasons people have such a problem with dogmatic personalities like rms. It's technically illegal to use a better solution because of something as relatively unimportant as a license. Why do you jump to blame the GPL and rms, when one could just as easily fault the OpenSSL authors for using the 4-clause BSD instead of the far more common 3-clause? > It's technically illegal to use a better solution because of something as relatively unimportant as a license. No, it is technically illegal to distribute compiled binaries that use OpenSSL, because the OpenSSL authors wanted to retain the advertising privileges. But it is not illegal to use the software as long as it is distributed in source and compiled by the end user. I would not call licensing unimportant. As long as software is copyrightable, licensing terms are highly important.
  - pierrebai 13y ago
    The reason the GPL is annoying is that free license with an advertizing clause have existed for a very long time and are actually widely used. A quick look at the about box of various software will usually show you a long list of mandatory acknowledgements for various open source licenses. The problem is that the GPL willingly refuses to permit advertizing clauses. Is there a congent argument about why an advertizing clause is a limitation of freedom? The GPL is more often than other free licenses putting restirctions on usage of diversely licensed software. It is an impediment. And, as we see, it has real-world consequences. There is more risk for freedom using bad software security than wielding to innocuous clauses.
dbbolton 13y ago
Actually, I don't think that's generally true if you're talking about the libs. A cursory glance at the output of `apt-cache rdepends libgnutls26` suggests that wget is the only relatively "popular" package depending on it. However, some other distros such as Arch do not have wget depending on it, so you do have a point about Debian.

by agwa 13y ago

Xylakant 13y ago

The problems of linking GPL-code with OpenSSL was one of the reasons why ruby is dual-licenced today afaik.

Argorak 13y ago
Among others. Ruby was GPL/Ruby-licensed and is now licensed BSD/Ruby, which makes shipping OpenSSL easier.

nly 13y ago

Some critical (to me) dependency chains on my system (Arch, KDE) seems to be Networkmanager → libsoup → glib-networking → GnuTLS Eclipse → WebkitGTK → libsoup ... VLC → FFmpeg → GnuTLS kdelibs (core KDE libs) → upower → libimobiledevice → GnuTLS I have a feeling there are greater dependencies within GNOME distros and, as you said, Debian. Networkmanager is an especially annoying one because it uses NSS directly and gnuTLS indirectly.

dfc 13y ago
If any Debian user is curious they can use the following commands to see gnutls dependents: $ apt-cache rdepends libgnutls27 libgnutls26 libcurl3-gnutls $ apt-cache --installed rdepends libgnutls27 libgnutls26 libcurl3-gnutls The latter invocation only displays packages which are installed locally, the former prints all packages apt is aware of.

alexforster 13y ago

I don't understand why NSS[1] isn't more highly regarded. It's the crypto library that both Chrome and Firefox use, and it has a comparatively good security record[2]. [1] https://developer.mozilla.org/en-US/docs/NSS https://developer.mozilla.org/en-US/docs/NSS [2] http://cve.mitre.org/cgi-bin/cvekey.cgi?keyword=nss http://cve.mitre.org/cgi-bin/cvekey.cgi?keyword=nss

nly 13y ago
It's regarded enough to be used by Java, Flash, Networkmanager, and Libreoffice... API is very low level though when all you want is a secure socket.
- timclassic 13y ago
  Exactly.
hyc_symas 13y ago
NSS was designed for use in single-user browsers and the API is completely unsuitable for more general, multi-user system-wide deployment. https://wiki.mozilla.org/NSS_Library_Init https://wiki.mozilla.org/NSS_Library_Init RedHat has misguidedly chosen to base all of its security infrastructure on NSS, even though NSS was never designed for such a use. It is completely inappropriate for servers, multi-user workstations, etc.
- blahbl4hblahtoo 13y ago
  Having a system wide certificate store is a good idea, though...
cpeterso 13y ago
Chrome is dropping NSS for OpenSSL: https://docs.google.com/document/d/1ML11ZyyMpnAr6clIAwWrXD53pQgNR-DppMYwt9XvE6s/edit?pli=1 https://docs.google.com/document/d/1ML11ZyyMpnAr6clIAwWrXD53...

belorn 13y ago

While some usage comparison between GnuTLS and OpenSSL is good, it is important to remember that each project support different features. For example, OpenSSL do not support OpenPGP.

benihana 13y ago

The irony of what's happening here, that dogmatism about a belief is causing an inferior solution to be used, is infuriating and one of the reasons people have such a problem with dogmatic personalities like rms. It's technically illegal to use a better solution because of something as relatively unimportant as a license. Think of it like a Maslov's hierarchy - having strong security is way more important to most people than having a proper copyleft license. But instead of being pragmatic, we're stuck with a ridiculously dogmatic solution that ends up harming way more than the ill it was trying to cure. It reminds me a lot of environmentalists going crazy to ban nuclear power in the 70s before we had as clear a grasp on the impact of dumping carbon dioxide into the air.

chimeracoder 13y ago
> The irony of what's happening here, that dogmatism about a belief is causing an inferior solution to be used, is infuriating and one of the reasons people have such a problem with dogmatic personalities like rms. It's technically illegal to use a better solution because of something as relatively unimportant as a license. Why do you jump to blame the GPL and rms, when one could just as easily fault the OpenSSL authors for using the 4-clause BSD instead of the far more common 3-clause? > It's technically illegal to use a better solution because of something as relatively unimportant as a license. No, it is technically illegal to distribute compiled binaries that use OpenSSL, because the OpenSSL authors wanted to retain the advertising privileges. But it is not illegal to use the software as long as it is distributed in source and compiled by the end user. I would not call licensing unimportant. As long as software is copyrightable, licensing terms are highly important.
- pierrebai 13y ago
  The reason the GPL is annoying is that free license with an advertizing clause have existed for a very long time and are actually widely used. A quick look at the about box of various software will usually show you a long list of mandatory acknowledgements for various open source licenses. The problem is that the GPL willingly refuses to permit advertizing clauses. Is there a congent argument about why an advertizing clause is a limitation of freedom? The GPL is more often than other free licenses putting restirctions on usage of diversely licensed software. It is an impediment. And, as we see, it has real-world consequences. There is more risk for freedom using bad software security than wielding to innocuous clauses.

dbbolton 13y ago

Actually, I don't think that's generally true if you're talking about the libs. A cursory glance at the output of `apt-cache rdepends libgnutls26` suggests that wget is the only relatively "popular" package depending on it. However, some other distros such as Arch do not have wget depending on it, so you do have a point about Debian.