Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

OpenSSL 3.0

wiki.openssl.org

Post reply on HN
Print view View original

41–50 of 106 posts

Re: OpenSSL 3.0

#41

Post by zvr »

yc12340 wrote: post #33
CrLf wrote: post #28

Earlier quoted context omitted.

IANAL, but “GPLv2 or later” allows you (the recipient of the license) to choose either GPLv2 or GPLv3 (i.e. the one that’s more convenient to you) but does not allow you to prevent others (the recipients of your modified version) from having the same choice. This goes both ways, “GPLv2 or later” cannot be changed to either GPLv2 or GPLv3 only without permission from everybody that has ever contributed to the codebase…

> “GPLv2 or later” cannot be changed to either GPLv2 or GPLv3 only without permission... What? Of course it can be changed to either. It literally says so in the license name.

No, it does not say such thing. “GPLv2 or later” says you are allowed to use it under GPLv2 or GPLv3 (for now). It does not allow to change it to GPL-2.0-only (to use the correct SPDX identifier).

Re: OpenSSL 3.0

#42

Post by yc12340 »

zvr wrote: post #41
yc12340 wrote: post #33

Earlier quoted context omitted.

> “GPLv2 or later” cannot be changed to either GPLv2 or GPLv3 only without permission... What? Of course it can be changed to either. It literally says so in the license name.

No, it does not say such thing. “GPLv2 or later” says you are allowed to use it under GPLv2 or GPLv3 (for now). It does not allow to change it to GPL-2.0-only (to use the correct SPDX identifier).

> “GPLv2 or later” says you are allowed to use it under GPLv2 or GPLv3

I am afraid, that you are wrong. GPL does not govern usage of software at all. You don't need to agree to GPL in order to use GPL licensed software. This is literally said in text of GPL itself.

The preamble ("this program is free software...") is not part of GPL itself — it is just short informative text. And you are misremembering, what preamble says. Citing from GNU website:

> This program is free software: you can redistribute it and/or modify it under the terms of the GNU General Public License as published by the Free Software Foundation, either version 3 of the License, or (at your option) any later version.

I believe, that we should erase all SPDX-whatever nonsense from Linux source code, and replace it back with proper preamble — least other users of GPL software start to misremember as well.

Re: OpenSSL 3.0

#43

Post by skissane »

zvr wrote: post #41
yc12340 wrote: post #33

Earlier quoted context omitted.

> “GPLv2 or later” cannot be changed to either GPLv2 or GPLv3 only without permission... What? Of course it can be changed to either. It literally says so in the license name.

No, it does not say such thing. “GPLv2 or later” says you are allowed to use it under GPLv2 or GPLv3 (for now). It does not allow to change it to GPL-2.0-only (to use the correct SPDX identifier).

If I take a GPLv2-or-later work, change the license notice to say GPLv2-only (or GPLv3-only, or GPLv3-or-later), and distribute it with that modified notice, have I violated the copyright licenses or copyright law? IANAL but I believe the answer is "No".

Now, if all I've done is change the license notice, my change is legally ineffective – anyone who receives it from me can change it back to the original GPLv2-or-later, and I have no legal recourse against them. However, if at the same time as changing the license, I also make (non-trivial) modifications to the code, then recipients cannot legally change the license back to the original GPLv2-or-later without either reverting my code changes or seeking my permission. (This is because I own copyright in my code changes as a derived work.)

Re: OpenSSL 3.0

#44

Post by als0 »

blitmap wrote: post #40

I don't have much familiarity with OpenSSL and crypto scares me away from reading the sources. I wish someone could give a full run-down of everything that is in OpenSSL, an overview. You hear all the time about it being bloated and supporting too many things. I wish I better understood that. It's why people turn to wolfssl and mbedtls, right? Smaller projects that aim for minimalism and robustness probably suffer fr…

> It's why people turn to wolfssl and mbedtls, right?

I tried to use a single algorithm from OpenSSL for an embedded project and seems like it needs hacking for all the dependencies to be met. I gave up. With mbedTLS it was done within a minute (simpler to build and read IMO).

There aren't many differences between mbedTLS and WolfSSL. Both are small libraries designed for embedded use. The latter supports TLS 1.3.

Today OpenSSL probably has the best support for hardware acceleration and secure elements.

Re: OpenSSL 3.0

#45

Post by oefrha »

blitmap wrote: post #40

I don't have much familiarity with OpenSSL and crypto scares me away from reading the sources. I wish someone could give a full run-down of everything that is in OpenSSL, an overview. You hear all the time about it being bloated and supporting too many things. I wish I better understood that. It's why people turn to wolfssl and mbedtls, right? Smaller projects that aim for minimalism and robustness probably suffer fr…

The documentation already has an overview: https://www.openssl.org/docs/manmaster/man7/

Re: OpenSSL 3.0

#47

Post by aorth »

> 1.7 Versioning Scheme

> The OpenSSL versioning scheme has changed with the 3.0 release. The new versioning scheme has this format:

> MAJOR.MINOR.PATCH

Yay. OpenSSL finally switches to semantic versioning. \o/

Re: OpenSSL 3.0

#48

Post by Sammi »

andinus wrote: post #34
dtech wrote: post #30

Earlier quoted context omitted.

Why do they hate APL?

If you mean Apache License then, The original Apache license was similar to the Berkeley license, but source code published under version 2 of the Apache license is subject to additional restrictions and cannot be included into OpenBSD. In particular, if you use code under the Apache 2 license, some of your rights will terminate if you claim in court that the code violates a patent. A license can only be considered f…

Thanks for this excellent explanation.

Re: OpenSSL 3.0

#49

Post by Conan_Kudo »

jabl wrote: post #23
throwaway2048 wrote: post #18

Earlier quoted context omitted.

libressl does not have a different license

My understanding is that new libressl code is under the openbsd license, though the original terms still apply as long as they have code under those terms left.

There is no reasonable way that the old license will ever go away unless they do a relicensing effort like OpenSSL did. They won't, so it won't.

Re: OpenSSL 3.0

#50

Post by Conan_Kudo »

CrLf wrote: post #28
tpolzer wrote: post #24

Earlier quoted context omitted.

Doesn't "GPLv2 or later" specifically allow you to fork into "GPLv2 only"? How can a license be incompatible with only the latter then?

IANAL, but “GPLv2 or later” allows you (the recipient of the license) to choose either GPLv2 or GPLv3 (i.e. the one that’s more convenient to you) but does not allow you to prevent others (the recipients of your modified version) from having the same choice. This goes both ways, “GPLv2 or later” cannot be changed to either GPLv2 or GPLv3 only without permission from everybody that has ever contributed to the codebase…

The FSF does not do GPLv3-only, they do "GPLv3 or later" for their projects (or "LGPLv3 or later" if applicable).
Post reply on HN