Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

OpenSSL 3.0

wiki.openssl.org

Post reply on HN
Print view View original

51–60 of 106 posts

Re: OpenSSL 3.0

#51

Post by Conan_Kudo »

yc12340 wrote: post #42
zvr wrote: post #41

Earlier quoted context omitted.

No, it does not say such thing. “GPLv2 or later” says you are allowed to use it under GPLv2 or GPLv3 (for now). It does not allow to change it to GPL-2.0-only (to use the correct SPDX identifier).

> “GPLv2 or later” says you are allowed to use it under GPLv2 or GPLv3 I am afraid, that you are wrong. GPL does not govern usage of software at all. You don't need to agree to GPL in order to use GPL licensed software. This is literally said in text of GPL itself. The preamble ("this program is free software...") is not part of GPL itself — it is just short informative text. And you are misremembering, what preamble…

the SPDX short identifiers are a great way for people to misunderstand how the license works. The preamble that the FSF suggests makes it clear what it does, why it works that way, and how you can leverage it.

Re: OpenSSL 3.0

#52

Post by aisio »

terrywang wrote: post #17
JoshTriplett wrote: post #2

One of the major improvements here: this finalizes the license change to Apache 2.0, which makes OpenSSL finally GPL-compatible. That removes one of the major reasons people had to avoid it. (Specifically, OpenSSL is now compatible with anything licensed "GPLv3", "GPLv3 or later", or "GPLv2 or later". It's not compatible with "GPLv2 only", but that's a relatively small amount of software.) Other major improvements: T…

- Linux Kernel TLS support Is this referring to kernel TLS offload (using linux kernel's TLS connection ooffload infrastrucuture)?

Yes it supports Kernel TLS offload support. Both in SW mode (where the kernel does the TLS operations) and HW mode https://www.kernel.org/doc/html/latest/networking/tls-offloa...

Re: OpenSSL 3.0

#53

Post by chrisweekly »

JoshTriplett wrote: post #2

One of the major improvements here: this finalizes the license change to Apache 2.0, which makes OpenSSL finally GPL-compatible. That removes one of the major reasons people had to avoid it. (Specifically, OpenSSL is now compatible with anything licensed "GPLv3", "GPLv3 or later", or "GPLv2 or later". It's not compatible with "GPLv2 only", but that's a relatively small amount of software.) Other major improvements: T…

Thanks Josh, that's a helpful summary!

Re: OpenSSL 3.0

#54

Post by yrro »

yc12340 wrote: post #42
zvr wrote: post #41

Earlier quoted context omitted.

No, it does not say such thing. “GPLv2 or later” says you are allowed to use it under GPLv2 or GPLv3 (for now). It does not allow to change it to GPL-2.0-only (to use the correct SPDX identifier).

> “GPLv2 or later” says you are allowed to use it under GPLv2 or GPLv3 I am afraid, that you are wrong. GPL does not govern usage of software at all. You don't need to agree to GPL in order to use GPL licensed software. This is literally said in text of GPL itself. The preamble ("this program is free software...") is not part of GPL itself — it is just short informative text. And you are misremembering, what preamble…

> You don't need to agree to GPL in order to use GPL licensed software.

I've wondered for some time how a user is granted permission to use GPL-licensed software; permission is not explicitly granted by the GPL, but it is required so that the user can copy the software to their computer, and into memory for it to be executed, is it not?

(I am aware that the answer will vary by jurisdiction)

Re: OpenSSL 3.0

#55

Post by CrLf »

skissane wrote: post #43
zvr wrote: post #41

Earlier quoted context omitted.

No, it does not say such thing. “GPLv2 or later” says you are allowed to use it under GPLv2 or GPLv3 (for now). It does not allow to change it to GPL-2.0-only (to use the correct SPDX identifier).

If I take a GPLv2-or-later work, change the license notice to say GPLv2-only (or GPLv3-only, or GPLv3-or-later), and distribute it with that modified notice, have I violated the copyright licenses or copyright law? IANAL but I believe the answer is "No". Now, if all I've done is change the license notice, my change is legally ineffective – anyone who receives it from me can change it back to the original GPLv2-or-lat…

> IANAL but I believe the answer is "No".

The answer is "Yes".

Think about it this way: the license is "GPLv2 or later", not "GPLv2" or "GPLv3". If you change the license notice, you are changing the terms in which people will receive the code from you. The GPL (both of them) clearly says you cannot do this. You have to distribute modified works under the exact same terms you received the original work, or you lose the right to use the software (both original and modified) yourself if you violate its licensing terms.

Re: OpenSSL 3.0

#56

Post by CrLf »

yc12340 wrote: post #42
zvr wrote: post #41

Earlier quoted context omitted.

No, it does not say such thing. “GPLv2 or later” says you are allowed to use it under GPLv2 or GPLv3 (for now). It does not allow to change it to GPL-2.0-only (to use the correct SPDX identifier).

> “GPLv2 or later” says you are allowed to use it under GPLv2 or GPLv3 I am afraid, that you are wrong. GPL does not govern usage of software at all. You don't need to agree to GPL in order to use GPL licensed software. This is literally said in text of GPL itself. The preamble ("this program is free software...") is not part of GPL itself — it is just short informative text. And you are misremembering, what preamble…

The GPL does not explicitly grant permission to use the software, that is true. However, its terms are clear about the conditions in which you lose that right.

Re: OpenSSL 3.0

#57

Post by stock_toaster »

andinus wrote: post #34
dtech wrote: post #30

Earlier quoted context omitted.

Why do they hate APL?

If you mean Apache License then, The original Apache license was similar to the Berkeley license, but source code published under version 2 of the Apache license is subject to additional restrictions and cannot be included into OpenBSD. In particular, if you use code under the Apache 2 license, some of your rights will terminate if you claim in court that the code violates a patent. A license can only be considered f…

Great explanation!

Re: OpenSSL 3.0

#58

Post by stock_toaster »

blitmap wrote: post #40

I don't have much familiarity with OpenSSL and crypto scares me away from reading the sources. I wish someone could give a full run-down of everything that is in OpenSSL, an overview. You hear all the time about it being bloated and supporting too many things. I wish I better understood that. It's why people turn to wolfssl and mbedtls, right? Smaller projects that aim for minimalism and robustness probably suffer fr…

don't forget BearSSL[1]!

[1]: https://bearssl.org

Re: OpenSSL 3.0

#59

Post by skissane »

CrLf wrote: post #55
skissane wrote: post #43

Earlier quoted context omitted.

If I take a GPLv2-or-later work, change the license notice to say GPLv2-only (or GPLv3-only, or GPLv3-or-later), and distribute it with that modified notice, have I violated the copyright licenses or copyright law? IANAL but I believe the answer is "No". Now, if all I've done is change the license notice, my change is legally ineffective – anyone who receives it from me can change it back to the original GPLv2-or-lat…

> IANAL but I believe the answer is "No". The answer is "Yes". Think about it this way: the license is "GPLv2 or later", not "GPLv2" or "GPLv3". If you change the license notice, you are changing the terms in which people will receive the code from you. The GPL (both of them) clearly says you cannot do this. You have to distribute modified works under the exact same terms you received the original work, or you lose t…

The standard wording for a GPLv2-or-later license (as recommended by the appendix of GPLv2 itself) is:

> This program is free software; you can redistribute it and/or modify it under the terms of the GNU General Public License as published by the Free Software Foundation; either version 2 of the License, or (at your option) any later version.

Per that notice, I have an option of distributing it under the terms of GPLv2, or under the terms of the GPLv3, or even a GPLv4 if the FSF were to someday publish one. So, I decide to make use of that option and distribute it under the terms of the GPLv3.

You can't argue that from the text of the GPLv2 or GPLv3 that I don't have the option which the license statement says that I do. The license statement applying the GPLv2 (or GPLv3) text is of greater authority than the text of the GPL itself. You can't use the later to cancel out the option granted by the former.

Re: OpenSSL 3.0

#60

Post by jeltz »

pilif wrote: post #7
Mizza wrote: post #5

I worry that this is going to break so many programs and scripts in the same way that the switch from Linux 2.6 did..

That already happened once with OpenSSL 1.1 which also wasn’t really backwards compatible. It was messy then, it will be messy now, though when you took the 1.1 opportunity to modernize your code to current best-practice as requested by the library rather than just fixing the minimum, you might be pretty ok this time around

This release actually seems less painful than 1.1 which broke a lot of APIs.
Post reply on HN