Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

OpenSSL 3.0

wiki.openssl.org

Post reply on HN
Print view View original

61–70 of 106 posts

Re: OpenSSL 3.0

#61

Post by smichel17 »

CrLf wrote: post #55
skissane wrote: post #43

Earlier quoted context omitted.

If I take a GPLv2-or-later work, change the license notice to say GPLv2-only (or GPLv3-only, or GPLv3-or-later), and distribute it with that modified notice, have I violated the copyright licenses or copyright law? IANAL but I believe the answer is "No". Now, if all I've done is change the license notice, my change is legally ineffective – anyone who receives it from me can change it back to the original GPLv2-or-lat…

> IANAL but I believe the answer is "No". The answer is "Yes". Think about it this way: the license is "GPLv2 or later", not "GPLv2" or "GPLv3". If you change the license notice, you are changing the terms in which people will receive the code from you. The GPL (both of them) clearly says you cannot do this. You have to distribute modified works under the exact same terms you received the original work, or you lose t…

IANAL. I'm more familiar with GPLv3-or-later because it's how I license Red Moon, but I assume v2-or-later uses the same phrasing, which I got from the FSF website iirc:

> Red Moon is licensed under the GNU General Public License version 3 or (at your option) any later version by the contributors.

As this reads to me, I am offering you a choice of licenses. You may use Red Moon under the GPLv3, or you may choose a later version of the GPL. Or, you could choose both, if you wish to distribute your derivative as GPLv3-or-later.

Put differently, a GPLv2-or-later currently means a dual-license, under both v2 and v3 (and an automatic relicensing to triple license if v4 is released, etc).

Re: OpenSSL 3.0

#62

Post by mrweasel »

blitmap wrote: post #40

I don't have much familiarity with OpenSSL and crypto scares me away from reading the sources. I wish someone could give a full run-down of everything that is in OpenSSL, an overview. You hear all the time about it being bloated and supporting too many things. I wish I better understood that. It's why people turn to wolfssl and mbedtls, right? Smaller projects that aim for minimalism and robustness probably suffer fr…

There is a fascinating and funny talk by Bob Beck from OpenBSD on the first 30 days after forking OpenSSL. One of the things he addresses is the scary code and how is prevents community involvement. He also talks a great deal about all that stuff that's not really relevant anymore and how much they removed from the LibreSSL source code.

Apparently the crypto modules are pretty well made according to the OpenBSD developers.

LibreSSL: The first 30 days, and what the Future Holds: https://www.youtube.com/watch?v=oM6S7FEUfkU

Re: OpenSSL 3.0

#63

Post by aasasd »

andinus wrote: post #34
dtech wrote: post #30

Earlier quoted context omitted.

Why do they hate APL?

If you mean Apache License then, The original Apache license was similar to the Berkeley license, but source code published under version 2 of the Apache license is subject to additional restrictions and cannot be included into OpenBSD. In particular, if you use code under the Apache 2 license, some of your rights will terminate if you claim in court that the code violates a patent. A license can only be considered f…

Dumb question here, isn't a license already a contract in the first place?

Re: OpenSSL 3.0

#64

Post by CrLf »

skissane wrote: post #59
CrLf wrote: post #55

Earlier quoted context omitted.

> IANAL but I believe the answer is "No". The answer is "Yes". Think about it this way: the license is "GPLv2 or later", not "GPLv2" or "GPLv3". If you change the license notice, you are changing the terms in which people will receive the code from you. The GPL (both of them) clearly says you cannot do this. You have to distribute modified works under the exact same terms you received the original work, or you lose t…

The standard wording for a GPLv2-or-later license (as recommended by the appendix of GPLv2 itself) is: > This program is free software; you can redistribute it and/or modify it under the terms of the GNU General Public License as published by the Free Software Foundation; either version 2 of the License, or (at your option) any later version. Per that notice, I have an option of distributing it under the terms of GPL…

The license is allowing you to perform specific actions. You can modify the work or redistribute it under the terms of "GPLv2 or later" without losing any of the rights the original copyright holder(s) passed on to you.

For a "modify and/or redistribute" example, under this "GPLv2 or later" licensing you can modify the software and use it in a SaaS without having to distribute it (which the GPLv3 would force you to), because you can choose to follow the terms of the GPLv2.

Likewise, you can use it and demand/assume implicit patent grants from the copyright holder, which the GPLv2 says nothing about, but the GPLv3 does.

Changing the license of the work is not modifying the work. That is the key difference. You must pass the same set of rights which you have received, like I said in other places. You can modify the work, but you cannot relicense the work. Only an original copyright holder can do this (for its part of the code).

When someone licenses software under the GPL (any of the versions), he/she isn't giving recipients any rights over licensing, he/she is only defining how the software can be modified and distributed.

Edit: To be clearer, a specific GPL version says you must pass that specific version's rights when you distribute. This makes it look like when you choose a version, you only need to pass that version's terms along. However, general copyright law (in most places) says you need to be explicit, so, if the GPLvX doesn't say you only need to pass those rights, then you need to pass those rights and any other (perhaps optional) rights.

Re: OpenSSL 3.0

#65

Post by jabl »

Conan_Kudo wrote: post #49
jabl wrote: post #23

Earlier quoted context omitted.

My understanding is that new libressl code is under the openbsd license, though the original terms still apply as long as they have code under those terms left.

There is no reasonable way that the old license will ever go away unless they do a relicensing effort like OpenSSL did. They won't, so it won't.

You're most likely correct.

I was just pointing out that libressl is not under a different license from openssl < 3.0 as a whole, nor is it under the openbsd license as a whole. Rather parts of it are under the old openssl + ssleay dual license, and other parts are under the openbsd license. And over time, the fraction under the openbsd license is bound to increase, although as you say, they will probably never reach the point where all the old code has been replaced.

Re: OpenSSL 3.0

#66

Post by wbl »

bjoli wrote: post #15
JoshTriplett wrote: post #2

One of the major improvements here: this finalizes the license change to Apache 2.0, which makes OpenSSL finally GPL-compatible. That removes one of the major reasons people had to avoid it. (Specifically, OpenSSL is now compatible with anything licensed "GPLv3", "GPLv3 or later", or "GPLv2 or later". It's not compatible with "GPLv2 only", but that's a relatively small amount of software.) Other major improvements: T…

A bit of a digression: the Apache license includes better patent language, which got me thinking of the patents on ocb mode. Shouldn't they expire sometime early in this decade? Like next year or something?

Rogaway has licensed them to any TLS implementation for free.

Re: OpenSSL 3.0

#67

Post by gray_-_wolf »

JoshTriplett wrote: post #2

One of the major improvements here: this finalizes the license change to Apache 2.0, which makes OpenSSL finally GPL-compatible. That removes one of the major reasons people had to avoid it. (Specifically, OpenSSL is now compatible with anything licensed "GPLv3", "GPLv3 or later", or "GPLv2 or later". It's not compatible with "GPLv2 only", but that's a relatively small amount of software.) Other major improvements: T…

> Specifically, OpenSSL is now compatible with anything licensed "GPLv3", "GPLv3 or later", or "GPLv2 or later". It's not compatible with "GPLv2 only", but that's a relatively small amount of software.

Does this mean I cannot use openssl in my gpl-2.0-only program? How does that work? Doesn't gpl-2.0-later imply that I can also take the code and use it in gpl-2.0-only?

Is there some tldr on this topic somewhere? I'm not good with these legal things to ELI5 would be nice :/

Re: OpenSSL 3.0

#68

Post by fanf2 »

ensiferum wrote: post #39
kakwa_ wrote: post #38

Earlier quoted context omitted.

I've mixed opinions over the recent breakages I've witnessed in OpenSSL. On one hand, I absolutely hate a library which breaks its API (I think lack of stability in interfaces is one of the bigger bane of the software industry and causes numerous issues down the line). But in the specific case with OpenSSL, the breakages are legitimate imho. Most of the breakages I have seen are to clean-up interfaces and have a clea…

I'm not even talking about clear cut API breakage. I'm talking about that if I do #include and build against the 1.2.x system installed OpenSSL I will get thousands of errors from headers internal to OpenSSL.

There's no such thing as OpenSSL 1.2

2018-09-11: 1.1.1-> 1.1.2

https://github.com/openssl/openssl/commit/a4a90a8a3bdcb9336b...

2018-09-27: 1.1.2 -> 3.0.0

https://github.com/openssl/openssl/commit/3a63dbef15b62b121c...

There weren't any releases numbered 1.1.2

Re: OpenSSL 3.0

#69

Post by jabl »

gray_-_wolf wrote: post #67
JoshTriplett wrote: post #2

One of the major improvements here: this finalizes the license change to Apache 2.0, which makes OpenSSL finally GPL-compatible. That removes one of the major reasons people had to avoid it. (Specifically, OpenSSL is now compatible with anything licensed "GPLv3", "GPLv3 or later", or "GPLv2 or later". It's not compatible with "GPLv2 only", but that's a relatively small amount of software.) Other major improvements: T…

> Specifically, OpenSSL is now compatible with anything licensed "GPLv3", "GPLv3 or later", or "GPLv2 or later". It's not compatible with "GPLv2 only", but that's a relatively small amount of software. Does this mean I cannot use openssl in my gpl-2.0-only program? How does that work? Doesn't gpl-2.0-later imply that I can also take the code and use it in gpl-2.0-only? Is there some tldr on this topic somewhere? I'm…

> Does this mean I cannot use openssl in my gpl-2.0-only program?

Correct.

> How does that work?

The GPL 2.0 and Apache-2.0 licenses contain terms which are incompatible with each other.

> Doesn't gpl-2.0-later imply that I can also take the code and use it in gpl-2.0-only?

Yes, in that case you can choose whether you use the code subject to the gpl 2.0, 3.0 or any later version. If you combine that code with some gpl-2.0-only code then you're choosing to use the first code under 2.0, and the combined work is then gpl-2.0-only.

> Is there some tldr on this topic somewhere? I'm not good with these legal things to ELI5 would be nice :/

The GNU project maintains a list of licenses and some comments about them, and conveniently categorizes them according to their GPL compatibility.

https://www.gnu.org/licenses/license-list.html

See also the chart at http://gplv3.fsf.org/dd3-faq for compatibility between the different GPL versions and variants.

Post reply on HN