| ▲ | OpenSSL 4.1.0(github.com) |
| 149 points by petecooper 4 hours ago | 49 comments |
| |
|
| ▲ | hannob 3 hours ago | parent | next [-] |
| I don't see "we fixed some of the the excessive performance regressions that we introduced in 3.0". Unfortunate... Context:
https://cryptography.io/en/latest/statements/state-of-openss... |
| |
| ▲ | dralley 8 minutes ago | parent | next [-] | | It has improved significantly since the early days of 3.0. Not back to 1.1.1 levels of performance, but enough that it's probably not a dealbreaker for most people. Still a shame that it went backwards. | |
| ▲ | chemodax 2 hours ago | parent | prev | next [-] | | AWS-Lc looks very promising replacement for OpenSSL these days. | | |
| ▲ | Bender an hour ago | parent [-] | | I looked into this and was tempted as there is less read locking and better RNG performance but they stripped the SSL_get1_curves() API which I depend on for bot detection plus I would have to recompile nginx and all its modules everywhere so in the end it was not tempting enough for me. Perhaps I am just lazier in my older age. | | |
| ▲ | mrweasel 31 minutes ago | parent | next [-] | | We ran a number of tests, including sending a percentage of real traffic to endpoints running AWS-LC and Wolfssl. Technically yes, OpenSSL 3.X is slow, measurably so, but not enough that we wanted to deal with it. That's for our use case, I can easily imagine there being others, where maybe you have different hardware or way more traffic, where it would be worth while. For basic TLS termination in haproxy, it wasn't really worth it to us. | |
| ▲ | otterley 22 minutes ago | parent | prev [-] | | Nothing wrong with being frugal with your time! |
|
| |
| ▲ | ahartmetz 2 hours ago | parent | prev | next [-] | | >We do not fully understand the motivations that led to the public APIs and internal complexity we’ve described here. We’ve done our best to reverse engineer them by asking “what would motivate someone to do this” and often we’ve found ourselves coming up short. Surely they thought of it but didn't say it out loud... to keep it exploitable, maybe? | | |
| ▲ | woodruffw an hour ago | parent [-] | | No, that's not what's being implied. They're just saying they don't understand why OpenSSL has added so many indirections to otherwise straightforward operations. Source: I am friends with the maintainers who wrote this and was one of the people who reviewed it in draft form. | | |
| ▲ | pseudosaid 44 minutes ago | parent [-] | | yet you too dont have an idea why asinine decisions were championed | | |
| ▲ | woodruffw 41 minutes ago | parent [-] | | I have a pretty good idea. And it has nothing to do with malice or exploitability. | | |
| ▲ | incanus77 10 minutes ago | parent | next [-] | | Gee, I wonder what it could’ve been… | |
| ▲ | noitpmeder 26 minutes ago | parent | prev [-] | | Care to share...??? | | |
| ▲ | palata 22 minutes ago | parent [-] | | Didn't they say it already? They basically think that the OpenSSL API is convoluted. That's my understanding of the comment above, at least. | | |
| ▲ | timschmidt 13 minutes ago | parent [-] | | Unnecessarily complicated APIs are a security code smell precisely because they help hide bugs, leaky abstractions, insecure state, and other exploitable issues. |
|
|
|
|
|
| |
| ▲ | spacesez-ai 2 hours ago | parent | prev [-] | | [flagged] |
|
|
| ▲ | owenthejumper an hour ago | parent | prev | next [-] |
| I think it's too little too late, people have started moving on https://www.haproxy.com/blog/state-of-ssl-stacks |
| |
| ▲ | ashkankiani an hour ago | parent [-] | | tangential, but I've always wondered what the point of these random pictures of a lock, gears, or unrelated little voxel art are for? Pre-LLMs, they were often hit or miss in terms of how much they added depending on if they were a random stock image or something someone drew. But now, with LLMs, they're more available to customize, and it seems like people aren't actually thinking anymore about why they should be there. I think I'm implicitly biasing against the rest of the content in articles which have them as a result, since it's probably a sign of some level of lack of care/thought. | | |
|
|
| ▲ | haunter 4 hours ago | parent | prev | next [-] |
| > Dropped Windows-on-Itanium (VC-WIN64I) and Windows CE (VC-CE) targets
from Configurations. What a throwback. afaik Windows Server 2008 R2 had Itanium updates until 2020 and paid support until this year. Pretty good run to
say at least |
| |
| ▲ | 0c3ca83 2 hours ago | parent | next [-] | | Glad they kept big endian x86_64, at least. https://github.com/openssl/openssl/blob/c69b5af10a754051274e... | | | |
| ▲ | nirui 3 hours ago | parent | prev | next [-] | | I kinda wonder what if Microsoft (or any major software company) would give their engineers a few decades of time just to refactor their existing systems, opposite of piling on new features. Will it result a much cleaner code, better architect, and stable product? The last Windows I daily use was Windows 7 Home (same era with Windows Server 2008). The newer ones don't really improved much featurely from my (user) point of view, and from what I've heard, it's getting more sloppyer every newer version. | | |
| ▲ | zbentley 2 hours ago | parent | next [-] | | > what if Microsoft would give their engineers a few decades of time just to refactor their existing systems They wouldn't, even if they didn't care about shipping new features. The technical complexity inside Windows/Office/old core MS offerings arises only in small part from ordinary tech debt--that is, things fixable without changing observable behavior. The lion's share of that complexity is because of Microsoft's priority to avoid breaking compatibility (backwards, or with hardware/software combos that work) at all costs. That means that a refactor-only decade would achieve little unless that compatibility priority were changed. | |
| ▲ | masfuerte 43 minutes ago | parent | prev | next [-] | | The Windows user-mode innards have been significantly refactored. Many of the core system DLLs that apps link to are just redirects to the actual implementation now. Much of the jank seems to be in the UI. | |
| ▲ | CodesInChaos an hour ago | parent | prev | next [-] | | It's just as likely it would end up as an overengineered mess. And that's without considering backwards compatibility constraints, which are one of the biggest maintenance burdens. | |
| ▲ | egorfine 2 hours ago | parent | prev [-] | | This will NOT please the shareholders. And that's all that matters. |
| |
| ▲ | mrweasel 3 hours ago | parent | prev [-] | | Make you wonder what they've been testing this on. Even NetBSD doesn't have a recent release for Itanium. Crazy that you can run NetBSD 11.0 on HPPA, but not Itanium, given that HPPA is in some sense the pre-cursor to Itanium. | | |
| ▲ | mixdup 2 hours ago | parent | next [-] | | Age is probably less relevant than current installed base/active users | |
| ▲ | an hour ago | parent | prev | next [-] | | [deleted] | |
| ▲ | mondainx 3 hours ago | parent | prev | next [-] | | More than likely in "government"; they are always behind and keeping legacy stuff around. I found Windows 1.0 floppies in a drawer, back-in-the-day. | |
| ▲ | p_l 3 hours ago | parent | prev [-] | | Honestly more HPPA gear to test against than Itanium |
|
|
|
| ▲ | mlhpdx an hour ago | parent | prev | next [-] |
| > Support for DTLS 1.3 (RFC 9147).
Refer to the ossl-guide-dtlsv13(7) manual page for details. DTLS 1.3 is a huge improvement over 1.2 for efficiency and simplicity. I can’t speak to the OpenSSL implementation but it’s great that support is finally released. |
|
| ▲ | adzm an hour ago | parent | prev | next [-] |
| I think this is the only software project I use that still requires me to have perl |
|
| ▲ | markasoftware an hour ago | parent | prev | next [-] |
| Interesting they're adding new support for DTLS 1.3 when afaict most new applications are defaulting to QUIC datagram mode. I have something built around DTLS 1.3 and am using wolfssl for that reason, will have to check this out. |
| |
| ▲ | mlhpdx an hour ago | parent [-] | | QUIC for embedded? I haven’t seen that, but there is a lot of DTLS. Particularly with 1.3, it makes QUIC look like a behemoth in code. |
|
|
| ▲ | aftbit an hour ago | parent | prev | next [-] |
| Wait, OpenSSL didn't support GREASE until now? The RFC standard landed 6 years ago... I've been linking a lot of stuff against boringssl during that time, I suppose... |
|
| ▲ | ksec an hour ago | parent | prev | next [-] |
| I wonder what is the current marketshare of Libressl and OpenSSL ? |
|
| ▲ | snvzz 3 hours ago | parent | prev | next [-] |
| Mandatory reminder libressl[0] exists. 0. https://www.libressl.org/ |
| |
|
| ▲ | Razengan 4 hours ago | parent | prev | next [-] |
| > Dropped Windows-on-Itanium A sad day. End of an era *salute* |
| |
| ▲ | madduci an hour ago | parent | next [-] | | Microsoft pulled the plug earlier | |
| ▲ | ZYbCRq22HbJ2y7 3 hours ago | parent | prev [-] | | seems like a versioning-induced death i think a project like this would slough old architecture like mad and let major versions tick, but they forge on... | | |
|
|
| ▲ | scsoi 3 minutes ago | parent | prev | next [-] |
| [flagged] |
|
| ▲ | amelius 3 hours ago | parent | prev [-] |
| Was it verified by AI? (Not a strange question given the recent PHP vulns found by AI.) |
