OpenSSL 3.0 Release Candidate Arrives With Big Changes

[S.Pam]

I'm worried we'll end up with compatibility issues again, just like with the previous version bumps. Ultimately I prefer staying with gnutls where supported.

[Anvil]

Very nice with the license change!
Previously it had some weird own vanity license, and dual-licensed, very confusing. Now it is just the well-known, widely-accepted, well-received, Apache License 2.0.

But how can we know that OpenSSL is really safe and secure?
I think that for something like this we would need Rust.

Rust is bout as retarded as Donal Trump

[Anvil]

Very nice with the license change!
Previously it had some weird own vanity license, and dual-licensed, very confusing. Now it is just the well-known, widely-accepted, well-received, Apache License 2.0.

But how can we know that OpenSSL is really safe and secure?
I think that for something like this we would need Rust.

Rust isnt as secure as you think it is

[uid313]

Rust isnt as secure as you think it is

Google seems to think so, they're hiring the guy who work to integrate Rust into the Linux kernel to work on that because they believe it will improve the security of Linux, Chrome OS and Android.

Microsoft seems to think so, they're employing Rust in the Windows kernel.

[summand]

In general, it is easier to write safe code in Rust then in C. You need to know less because it simply doesn't allow you to do everything.

The rust documentation describes the issues:

https://doc.rust-lang.org/nomicon/meet-safe-and-unsafe.html

It is certainly possible to write safe code in C++ too. I did it for years and I am pretty confident that most of my programs were safe and sound, some of them running for years in server environments without issues. A little tool that was installed on all domain controllers of a huge company survived a couple of audits without any real findings.

But when you develop in C and C++ you certainly have to know more and have to be more careful. And you still make mistakes sometimes. Those languages allow all kinds of crazy things and there are features in the language, that allow you to write really obfuscated code.

Rust does it better and simply forces the developer to do things a certain way. And while this may sound bad, it actually is a good thing. It doesn't allow you to shoot you in foot. So, Rust is IMHO safer than C or C++.

[KesZerda]

So... still no QUIC

QUIC is a different layer outside of OpenSSL's concern. OpenSSL is about TLS, not about HTTP or TCP or UDP. Other libraries will probably implement QUIC using OpenSSL to provide their TLS stack, but it's not their job to worry about it.

[PSSGCSim]

QUIC is a different layer outside of OpenSSL's concern. OpenSSL is about TLS, not about HTTP or TCP or UDP. Other libraries will probably implement QUIC using OpenSSL to provide their TLS stack, but it's not their job to worry about it.

Yes, but it requires changes in OpenSSL for it to work. I do not know the details though. There is a PR ready for it but it's being stalled for some reason. Some projects even switched to Google's version of OpenSSL the BoringSSL. (eg. nginx)

[KesZerda]

Yes, but it requires changes in OpenSSL for it to work. I do not know the details though. There is a PR ready for it but it's being stalled for some reason. Some projects even switched to Google's version of OpenSSL the BoringSSL. (eg. nginx)

Ahh, okay, reading through all the documentation, it looks like QUIC uses an odd variant of TLS 1.3 that really should have been called TLS 1.4, to get working that OpenSSL 3 wasn't ready to support, given Google, and other implementors', histories of changing specs at the last minute. I imagine that support will be dropped in soon now that we have a final version of HTTP 3, with an actual specification document, and not Google's rough approximations.