Hacker News new | past | comments | ask | show | jobs | submit login

HEADLINE

Remove openssl1.0

DESCRIPTION

stretch made OpenSSL 1.1 the default openssl package. Unfortunately, OpenSSL 1.0 was kept around, since so many things depended on it.

There should now be enough time that a firm stance can be taken toward not allowing OpenSSL 1.0 in Debian Buster.

Once TLS 1.3 is finalized, OpenSSL 1.2 will be released with TLS 1.3 support. Not supporting TLS 1.3 in buster would (in my opinion) make Debian appear less in other people's eyes. That means supporting OpenSSL 1.2, and having three OpenSSL packages (1.0, 1.1, and 1.2) is too much for one distribution.

DISTRIBUTION

buster




OpenSSL doesn't follow semantic versioning. This is not a simple version upgrade. They knowingly broke the API between 1.0 and 1.1 and it can require substantial changes. They also refused to provide a compatibility shim to make it easier for developers to migrate.

This is not a Debian problem. This is an OpenSSL problem where they forced each upstream program author to make changes in order to upgrade. You'll have to wait for each upstream program author to update.


How would you feel about a switch to one of the forks, such as BoringSSL or LibreSSL?


Sorry, I'm not in support of switching from OpenSSL to BoringSSL or LibreSSL as the default.

On a fairly regular basis, I use alot of the weirder things that I don't think BoringSSL or LibreSSL support.

For example, I was working on iOS profile stuff that called on OpenSSL's S/MIME enveloping functionality to make signed/encrypted profiles.


Android Studio relies on OpenSSL 1.




Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: