5 ms·

OpenSSH is a SSH client and server provided by the Open BSD Foundation. OpenSSL is an encryption API maintained by an entirely different group of people. EDIT

by lholden 13y ago

OpenSSH is a SSH client and server provided by the Open BSD Foundation. OpenSSL is an encryption API maintained by an entirely different group of people. EDIT: Modified my reply. OpenSSH at some point moved it's "restrictively licenced software" (RSA, DES, etc) out of it's codebase and now depends on OpenSSL according to it's license. http://www.openbsd.org/cgi-bin/cvsweb/src/usr.bin/ssh/LICENCE?rev=HEAD http://www.openbsd.org/cgi-bin/cvsweb/src/usr.bin/ssh/LICENC...

willvarfar 13y ago
Quite right, my typo, and if I could still 'edit' my post I'd correct it. I meant OpenSSH: It could be that they plan to tell FreeBSD - and therefore expose what they've found, now they've suddenly started auditing OpenSSH consumers - only when they have a fix? It could be best fixed in OpenSSH itself, and only affecting those using the compiler options or SSH configuration that FreeBSD ships with.
- lholden 13y ago
  No worries. My reply turned out ot be not entirely correct either so :D
Xylakant 13y ago
Actually somebody posted the contrary yesterday and I thought the same as you. We're both wrong - I went off and checked the openssl license and it lists a couple of things that are included from OpenSSL and a short grep in the code turns up a lot of references to OpenSSL.
- lholden 13y ago
  Crazy... Modified my post. Thanks :)
peterwwillis 13y ago
RSA, DES, etc are not "restrictively licensed software", they are algorithms in the public domain. Anybody can write their own implementation of it and license that work how they see fit - including OpenSSH. I'm pretty sure they're just lazy and would rather use someone else's code.
- lholden 13y ago
  RSA was patent encumbered at the time the clause was made to the OpenSSH license. This very likely qualified RSA as "restrictively licensed". RSA was released from its patent in 2000 (just weeks before it expired). DSA I believe is still patent encumbered.
  - peterwwillis 13y ago
    Right. They've had 14 years to re-add code like RSA and Diffie-Hellman to their project if they wanted to. Lazy programmers. NIST made the DSA patent available worldwide royalty-free. In fact, DSA was unencumbered by patents before RSA, which is why SSH version 2 incorporated it.
    - lholden 13y ago
      Granted. Code reduction on the other hand is generally a good thing. :P I want to say that I would have done the same thing. At the same time though... doing so with a security application assumes that the team supporting the software you depend on is competent enough to properly audit and test their code. I have a feeling that OpenSSL will be leaving a bad taste in peoples mouths for a while. :/

by lholden 13y ago

willvarfar 13y ago

Quite right, my typo, and if I could still 'edit' my post I'd correct it. I meant OpenSSH: It could be that they plan to tell FreeBSD - and therefore expose what they've found, now they've suddenly started auditing OpenSSH consumers - only when they have a fix? It could be best fixed in OpenSSH itself, and only affecting those using the compiler options or SSH configuration that FreeBSD ships with.

lholden 13y ago
No worries. My reply turned out ot be not entirely correct either so :D

Xylakant 13y ago

Actually somebody posted the contrary yesterday and I thought the same as you. We're both wrong - I went off and checked the openssl license and it lists a couple of things that are included from OpenSSL and a short grep in the code turns up a lot of references to OpenSSL.

lholden 13y ago
Crazy... Modified my post. Thanks :)

peterwwillis 13y ago

RSA, DES, etc are not "restrictively licensed software", they are algorithms in the public domain. Anybody can write their own implementation of it and license that work how they see fit - including OpenSSH. I'm pretty sure they're just lazy and would rather use someone else's code.

lholden 13y ago
RSA was patent encumbered at the time the clause was made to the OpenSSH license. This very likely qualified RSA as "restrictively licensed". RSA was released from its patent in 2000 (just weeks before it expired). DSA I believe is still patent encumbered.
- peterwwillis 13y ago
  Right. They've had 14 years to re-add code like RSA and Diffie-Hellman to their project if they wanted to. Lazy programmers. NIST made the DSA patent available worldwide royalty-free. In fact, DSA was unencumbered by patents before RSA, which is why SSH version 2 incorporated it.
  - lholden 13y ago
    Granted. Code reduction on the other hand is generally a good thing. :P I want to say that I would have done the same thing. At the same time though... doing so with a security application assumes that the team supporting the software you depend on is competent enough to properly audit and test their code. I have a feeling that OpenSSL will be leaving a bad taste in peoples mouths for a while. :/