Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

OpenSSL 3.0

wiki.openssl.org

Post reply on HN
Print view View original

11–20 of 106 posts

Re: OpenSSL 3.0

#11

Post by JoshTriplett »

moonchild wrote: post #10

> OpenSSL versions with the same major number are API and ABI compatible Finally! > A proper HTTP(S) client in libcrypto supporting GET and POST, redirection, plain and ASN.1-encoded contents, proxies, and timeouts Is this really necessary? If you want a 'real' http client, you're probably using libcurl anyway (which is permissively licensed, more stable, and supports http/3).

> Is this really necessary? If you want a 'real' http client, you're probably using libcurl anyway (which is permissively licensed, more stable, and supports http/3).

I'd guess it's there to support cryptographic protocols that require downloading/checking keys via HTTPS. Right before that line is "Implementation of the Certificate Management Protocol (CMP, RFC 4210) also covering CRMF (RFC 4211) and HTTP transfer (RFC 6712)".

And yes, use curl.

Re: OpenSSL 3.0

#13

Post by wallacoloo »

JoshTriplett wrote: post #2

One of the major improvements here: this finalizes the license change to Apache 2.0, which makes OpenSSL finally GPL-compatible. That removes one of the major reasons people had to avoid it. (Specifically, OpenSSL is now compatible with anything licensed "GPLv3", "GPLv3 or later", or "GPLv2 or later". It's not compatible with "GPLv2 only", but that's a relatively small amount of software.) Other major improvements: T…

> Other major improvements: TLS1.3 support

OpenSSL 1.1.1 already supports TLS 1.3

Re: OpenSSL 3.0

#14

Post by NiekvdMaas »

JoshTriplett wrote: post #2

One of the major improvements here: this finalizes the license change to Apache 2.0, which makes OpenSSL finally GPL-compatible. That removes one of the major reasons people had to avoid it. (Specifically, OpenSSL is now compatible with anything licensed "GPLv3", "GPLv3 or later", or "GPLv2 or later". It's not compatible with "GPLv2 only", but that's a relatively small amount of software.) Other major improvements: T…

What does the license change mean for LibreSSL (OpenSSL fork) and GnuTLS which have "a better license" as their main selling point?

Re: OpenSSL 3.0

#15

Post by bjoli »

JoshTriplett wrote: post #2

One of the major improvements here: this finalizes the license change to Apache 2.0, which makes OpenSSL finally GPL-compatible. That removes one of the major reasons people had to avoid it. (Specifically, OpenSSL is now compatible with anything licensed "GPLv3", "GPLv3 or later", or "GPLv2 or later". It's not compatible with "GPLv2 only", but that's a relatively small amount of software.) Other major improvements: T…

A bit of a digression: the Apache license includes better patent language, which got me thinking of the patents on ocb mode. Shouldn't they expire sometime early in this decade? Like next year or something?

Re: OpenSSL 3.0

#16

Post by ta17711771 »

JoshTriplett wrote: post #2

One of the major improvements here: this finalizes the license change to Apache 2.0, which makes OpenSSL finally GPL-compatible. That removes one of the major reasons people had to avoid it. (Specifically, OpenSSL is now compatible with anything licensed "GPLv3", "GPLv3 or later", or "GPLv2 or later". It's not compatible with "GPLv2 only", but that's a relatively small amount of software.) Other major improvements: T…

...wasn't the major reason to avoid it the shitton of vulns it has had compared to libreSSL!?

Re: OpenSSL 3.0

#17

Post by terrywang »

JoshTriplett wrote: post #2

One of the major improvements here: this finalizes the license change to Apache 2.0, which makes OpenSSL finally GPL-compatible. That removes one of the major reasons people had to avoid it. (Specifically, OpenSSL is now compatible with anything licensed "GPLv3", "GPLv3 or later", or "GPLv2 or later". It's not compatible with "GPLv2 only", but that's a relatively small amount of software.) Other major improvements: T…

- Linux Kernel TLS support

Is this referring to kernel TLS offload (using linux kernel's TLS connection ooffload infrastrucuture)?

Re: OpenSSL 3.0

#18

Post by throwaway2048 »

NiekvdMaas wrote: post #14
JoshTriplett wrote: post #2

One of the major improvements here: this finalizes the license change to Apache 2.0, which makes OpenSSL finally GPL-compatible. That removes one of the major reasons people had to avoid it. (Specifically, OpenSSL is now compatible with anything licensed "GPLv3", "GPLv3 or later", or "GPLv2 or later". It's not compatible with "GPLv2 only", but that's a relatively small amount of software.) Other major improvements: T…

What does the license change mean for LibreSSL (OpenSSL fork) and GnuTLS which have "a better license" as their main selling point?

libressl does not have a different license

Re: OpenSSL 3.0

#19

Post by hyperman1 »

Reading chapter 3, upgrading from 1.1.1, it seems strange for a security library to promote ignoring and even suppresing warnings. The best option, upgrading, is mentioned last.

I would prefer my security libraries to scream bloody murder if I am using them in a deprecated way.

Re: OpenSSL 3.0

#20

Post by toyg »

ta17711771 wrote: post #16
JoshTriplett wrote: post #2

One of the major improvements here: this finalizes the license change to Apache 2.0, which makes OpenSSL finally GPL-compatible. That removes one of the major reasons people had to avoid it. (Specifically, OpenSSL is now compatible with anything licensed "GPLv3", "GPLv3 or later", or "GPLv2 or later". It's not compatible with "GPLv2 only", but that's a relatively small amount of software.) Other major improvements: T…

...wasn't the major reason to avoid it the shitton of vulns it has had compared to libreSSL!?

The “shitton of vulnerabilities” is a recent phenomenon, it’s not what prevented people from using OpenSSL.
Post reply on HN