Misplaced Pages

LibreSSL

Article snapshot taken from Wikipedia with creative commons attribution-sharealike license. Give it a read and then ask your questions in the chat. We can research this topic together.

This is an accepted version of this page

#70929

71-593: LibreSSL is an open-source implementation of the Transport Layer Security (TLS) protocol. The implementation is named after Secure Sockets Layer (SSL), the deprecated predecessor of TLS, for which support was removed in release 2.3.0. The OpenBSD project forked LibreSSL from OpenSSL 1.0.1g in April 2014 as a response to the Heartbleed security vulnerability , with the goals of modernizing

142-713: A "stable commitment" of external funding. On 17 May 2014, Bob Beck presented "LibreSSL: The First 30 Days, and What The Future Holds" during the 2014 BSDCan conference, in which he described the progress made in the first month. On 5 June 2014, several OpenSSL bugs became public. While several projects were notified in advance, LibreSSL was not; Theo de Raadt accused the OpenSSL developers of intentionally withholding this information from OpenBSD and LibreSSL. On 20 June 2014, Google created another fork of OpenSSL called BoringSSL , and promised to exchange fixes with LibreSSL. Google has already relicensed some of its contributions under

213-406: A Pathways to Enable Open-Source Ecosystems (POSE) program to support open source innovation. The adoption of open-source software by industry is increasing over time. OSS is popular in several industries such as telecommunications , aerospace , healthcare , and media & entertainment due to the benefits it provides. Adoption of OSS is more likely in larger organizations and is dependent on

284-420: A bank account management application, a sanity check will fail if a withdrawal requests more money than the total account balance rather than allowing the account to go negative (which wouldn't be sane). Another sanity test might be that deposits or purchases correspond to patterns established by historical data—for example, large purchase transactions or ATM withdrawals in foreign locations never before visited by

355-544: A bug needs to be fixed in their project. This is established by communicating with the OSS community through avenues such as bug reporting and tracking or mailing lists and project pages. Next, OSS developers select or are assigned to a task and identify a solution. Because there are often many different possible routes for solutions in OSS, the best solution must be chosen with careful consideration and sometimes even peer feedback . The developer then begins to develop and commit

426-517: A copy of the license is provided to recipients with the code. One important legal precedent for open-source software was created in 2008, when the Jacobson v Katzer case enforced terms of the Artistic license , including attribution and identification of modifications. The ruling of this case cemented enforcement under copyright law when the conditions of the license were not followed. Because of

497-451: A message asking for review at WT:CP .   With this script , go to the history with auto-selected revisions . Note to the requestor : Make sure the page has already been reverted to a non-infringing revision or that infringing text has been removed or replaced before submitting this request. This template is reserved for obvious cases only, for other cases refer to Misplaced Pages:Copyright problems . Open-source software ( OSS )

568-454: A new bug. Early releases : The first version of the software should be released as early as possible so as to increase one's chances of finding co-developers early. Frequent integration: Code changes should be integrated (merged into a shared code base) as often as possible so as to avoid the overhead of fixing a large number of bugs at the end of the project life cycle. Some open-source projects have nightly builds where integration

639-728: A number of compiler options and flags designed for safety have been enabled by default to help in spotting potential issues so they can be fixed earlier (-Wall, -Werror, -Wextra, -Wuninitialized). There have also been code readability updates which help future contributors in verifying program correctness ( KNF , white-space, line-wrapping, etc.). Modification or removal of unneeded method wrappers and macros also help with code readability and auditing (Error and I/O abstraction library references). Changes were made to ensure that LibreSSL will be year 2038 compatible along with maintaining portability for other similar platforms. In addition, explicit_bzero and bn_clear calls were added to prevent

710-518: A programme work before proceeding with further testing whereas a sanity test refers to whether specific functionality such as a particular bug fix works as expected without testing the wider functionality of the software. In other words, a sanity test determines whether the intended result of a code change works correctly while a smoke test ensures that nothing else important was broken in the process. Sanity testing and smoke testing avoid wasting time and effort by quickly determining whether an application

781-508: A public good as it is available to everyone and does not decrease in value for others when downloaded by one person. Open source software is unique in that it becomes more valuable as it is used and contributed to, instead of diminishing the resource. This is explained by concepts such as investment in reputation and network effects . The economic model of open-source software can be explained as developers contribute work to projects, creating public benefits. Developers choose projects based on

SECTION 10

#1732791425071

852-580: A safer set of elliptic curves (brainpool curves from RFC 5639, up to 512 bits in strength). The initial release of LibreSSL added a number of features: the ChaCha and Poly1305 algorithm, the Brainpool and ANSSI elliptic curves, and the AES-GCM and ChaCha20-Poly1305 AEAD modes. Later versions added the following: The initial release of LibreSSL disabled a number of features by default. Some of

923-401: A sanity test is to rule out certain classes of obviously false results, not to catch every possible error. A rule-of-thumb or back-of-the-envelope calculation may be checked to perform the test. The advantage of performing an initial sanity test is that of speedily evaluating basic function. In arithmetic, for example, when multiplying by 9, using the divisibility rule for 9 to verify that

994-447: A similar way user scripts and custom style sheets allow for web sites, and eventually publish the modification as a fork for users with similar preferences, and directly submit possible improvements as pull requests . The Open Source Initiative 's (OSI) definition is recognized by several governments internationally as the standard or de facto definition. OSI uses The Open Source Definition to determine whether it considers

1065-615: A software license open source. The definition was based on the Debian Free Software Guidelines , written and adapted primarily by Perens . Perens did not base his writing on the "four freedoms" from the Free Software Foundation (FSF), which were only widely available later. Under Perens' definition, open source is a broad software license that makes source code available to the general public with relaxed or non-existent restrictions on

1136-422: A victory for OSS supporters. In open-source communities, instead of owning the software produced, the producer owns the development of the evolving software. In this way, the future of the software is open, making ownership or intellectual property difficult within OSS. Licensing and branding can prevent others from stealing it, preserving its status as a public good . Open source software can be considered

1207-443: Is computer software that is released under a license in which the copyright holder grants users the rights to use, study, change, and distribute the software and its source code to anyone and for any purpose. Open-source software may be developed in a collaborative, public manner. Open-source software is a prominent example of open collaboration , meaning any capable user is able to participate online in development, making

1278-404: Is a good or service, what can be considered a modification, governance through contract vs license, ownership and right of use. While there have been developments on these issues, they often lead to even more questions. The existence of these uncertainties in regulation has a negative impact on industries involved in technologies as a whole. Within the legal history of software as a whole, there

1349-556: Is absolutely another terrific way that individuals and organizations choose to contribute to open source projects. Groups like Open Collective provide a means for individuals to contribute monthly to supporting their favorite projects. Organizations like the Sovereign Tech Fund is able to contribute to millions to supporting the tools the German Government uses. The National Science Foundation established

1420-432: Is actually often itself the result of a sanity check. For example, if the function attempted to open, write to, and close a file, a sanity check may be used to ensure that it did not fail on any of these actions—which is a sanity check often ignored by programmers. These kinds of sanity checks may be used during development for debugging purposes and also to aid in troubleshooting software runtime errors . For example, in

1491-544: Is done automatically . Several versions: There should be at least two versions of the software. There should be a buggier version with more features and a more stable version with fewer features. The buggy version (also called the development version) is for users who want the immediate use of the latest features and are willing to accept the risk of using code that is not yet thoroughly tested. The users can then act as co-developers, reporting bugs and providing bug fixes. High modularization: The general structure of

SECTION 20

#1732791425071

1562-404: Is innovative since open-source programs are the product of collaboration among a large number of different programmers. The mix of divergent perspectives, corporate objectives, and personal goals speeds up innovation. Moreover, free software can be developed in accordance with purely technical requirements. It does not require thinking about commercial pressure that often degrades the quality of

1633-560: Is legal variety in this definition. Some jurisdictions attempt to expand or reduce this conceptualization for their own purposes. For example, The European Court of Justice defines a computer program as not including the functionality of a program, the programing language , or the format of data files. By limiting protections of the different aspects of software, the law favors an open-source approach to software use. The US especially has an open approach to software, with most open-source licenses originating there. However, this has increased

1704-428: Is often prior to a more exhaustive round of testing. A sanity test can refer to various orders of magnitude and other simple rule-of-thumb devices applied to cross-check mathematical calculations . For example: In software development, a sanity test (a form of software testing which offers "quick, broad, and shallow testing" ) evaluates the result of a subset of application functionality to determine whether it

1775-483: Is often used as a sanity test for a development environment similarly. Rather than a complicated script running a set of unit tests, if this simple programme fails to compile or execute, it proves that the supporting environment likely has a configuration problem that will prevent any code from compiling or executing. But if "Hello world" executes, then any problems experienced with other programmes likely can be attributed to errors in that application's code rather than

1846-428: Is possible and reasonable to proceed with further testing of the entire application. Sanity tests may sometimes be used interchangeably with smoke tests insofar as both terms denote tests which determine whether it is possible and reasonable to continue testing further. On the other hand, a distinction is sometimes made that a smoke test is a non-exhaustive test that ascertains whether the most crucial functions of

1917-492: Is the default provider of TLS for: LibreSSL is the default provider of TLS for these now-discontinued systems: LibreSSL is a selectable provider of TLS for: Changes include replacement of custom memory calls to ones in a standard library (for example, strlcpy , calloc , asprintf , reallocarray , etc.). This process may help later on to catch buffer overflow errors with more advanced memory analysis tools or by observing program crashes (via ASLR , use of

1988-468: Is theoretically challenging in economic models, it is explainable as a sustainable social activity that requires resources. These resources include time, money, technology and contributions. Many developers have used technology funded by organizations such as universities and governments, though these same organizations benefit from the work done by OSS. As OSS grows, hybrid systems containing OSS and proprietary systems are becoming more common. Throughout

2059-439: Is to denote checks which are performed within programme code, usually on arguments to functions or returns therefrom, to see if the answers can be assumed to be correct. The more complicated the routine, the more important that its response be checked. The trivial case is checking to see whether the return value of a function indicated success or failure, and to therefore cease further processing upon failure. This return value

2130-427: Is too flawed to merit more rigorous QA testing , but needs more developer debugging . Groups of sanity tests are often bundled together for automated unit testing of functions, libraries, or applications prior to merging development code into a testing or trunk version control branch , for automated building , or for continuous integration and continuous deployment . Another common usage of sanity test

2201-761: The ISC license , as it was requested by the LibreSSL developers. On 21 June 2014, Theo de Raadt welcomed BoringSSL and outlined the plans for LibreSSL-portable. Starting on 8 July, code porting for macOS and Solaris began, while the initial porting to Linux began on 20 June. As of 2021, OpenBSD uses LibreSSL as the primary TLS library. Alpine Linux supported LibreSSL as its primary TLS library for three years, until release 3.9.0 in January 2019. Gentoo supported LibreSSL until February 2021. Python 3.10 dropped LibreSSL after being supported since Python 3.4.3 (2015). LibreSSL

LibreSSL - Misplaced Pages Continue

2272-523: The NX bit , stack canaries , etc.). Fixes for potential double free scenarios have also been cited in the VCS commit logs (including explicit assignments of null pointer values). There have been extra sanity checks also cited in the commit logs related to ensuring length arguments, unsigned-to-signed variable assignments, pointer values, and method returns. In order to maintain good programming practice,

2343-581: The codebase , improving security , and applying development best practices . After the Heartbleed security vulnerability was discovered in OpenSSL , the OpenBSD team audited the codebase and decided it was necessary to fork OpenSSL to remove dangerous code. The libressl.org domain was registered on 11 April 2014; the project announced the name on 22 April 2014. In the first week of development, more than 90,000 lines of C code were removed. Unused code

2414-889: The distributed version control system (DVCS) are examples of tools, often open source, that help manage the source code files and the changes to those files for a software project in order to foster collaboration. CVCS are centralized with a central repository while DVCS are decentralized and have a local repository for every user. concurrent versions system (CVS) and later Subversion (SVN) and Git are examples of CVCS. The repositories are hosted and published on source-code-hosting facilities such as GitHub . Open-source projects use utilities such as issue trackers to organize open-source software development. Commonly used bug trackers include Bugzilla and Redmine . Tools such as mailing lists and IRC provide means of coordination and discussion of bugs among developers. Project web pages, wiki pages, roadmap lists and newsgroups allow for

2485-421: The sum of digits of the result is divisible by 9 is a sanity test—it will not catch every multiplication error, but is a quick and simple method to discover many possible errors. In computer science , a sanity test is a very brief run-through of the functionality of a computer program , system, calculation, or other analysis, to assure that part of the system or methodology works roughly as expected. This

2556-462: The Bazaar , open-source influential contributor Eric S. Raymond suggests a model for developing OSS known as the bazaar model. Raymond likens the development of software by traditional methodologies to building a cathedral, with careful isolated work by individuals or small groups. He suggests that all software should be developed using the bazaar style, with differing agendas and approaches. In

2627-641: The Public Interest . Within Europe some notable organizations are Free Software Foundation Europe , open-source projects EU (OSP) and OpenForum Europe (OFE). One Australian organization is Linux Australia while Asia has Open source Asia and FOSSAsia . Free and open source software for Africa (FOSSFA) and OpenAfrica are African organizations and Central and South Asia has such organizations as FLISOL and GRUP de usuarios de software libre Peru . Outside of these, many more organizations dedicated to

2698-582: The United States has focused on national security in regard to open-source software implementation due to the perceived threat of the increase of open-source software activity in countries like China and Russia, with the Department of Defense considering multiple criteria for using OSS. These criteria include: if it comes from and is maintained by trusted sources, whether it will continue to be maintained, if there are dependencies on sub-components in

2769-473: The advancement of open-source software exist. FOSS products are generally licensed under two types of licenses: permissive licensing and copyleft licensing . Both of these types of licenses are different than proprietary licensing in that they can allow more users access to the software and allow for the creation of derivative works as specified by the terms of the specific license, as each license has its own rules. Permissive licenses allow recipients of

2840-402: The bazaar model should exhibit the following patterns: Users should be treated as co-developers: The users are treated like co-developers and so they should have access to the source code of the software. Furthermore, users are encouraged to submit additions to the software, code fixes for the software, bug reports , documentation, etc. Having more co-developers increases the rate at which

2911-488: The cardholder may be flagged for confirmation. Sanity checks are also performed upon installation of stable, production software code into a new computing environment to ensure that all dependencies are met, such as a compatible operating system and link libraries . When a computing environment has passed all the sanity checks, it's known as a sane environment for the installation programme to proceed with reasonable expectation of success. A "Hello, World!" program

LibreSSL - Misplaced Pages Continue

2982-412: The code for these features was later removed , including Kerberos , US-Export ciphers , TLS compression, DTLS heartbeat , SSL v2 and SSL v3 . Later versions disabled more features: The initial release of LibreSSL has removed a number of features that were deemed insecure, unnecessary or deprecated as part of OpenBSD 5.6. The Dual EC DRBG algorithm, which is suspected of having a back door ,

3053-414: The code. The code is then tested and reviewed by peers. Developers can edit and evolve their code through feedback from continuous integration . Once the leadership and community are satisfied with the whole project, it can be partially released and user instruction can be documented. If the project is ready to be released, it is frozen, with only serious bug fixes or security repairs occurring. Finally,

3124-427: The company's IT usage, operating efficiencies, and the productivity of employees. Industries are likely to use OSS due to back-office functionality, sales support, research and development, software features, quick deployment, portability across platforms and avoidance of commercial license management. Additionally, lower cost for hardware and ownership are also important benefits. Organizations that contribute to

3195-497: The compiler from optimizing them out and prevent attackers from reading previously allocated memory. There were changes to help ensure proper seeding of random number generator -based methods via replacements of insecure seeding practices (taking advantage of features offered by the kernel itself natively). In terms of notable additions made, OpenBSD has added support for newer and more reputable algorithms ( ChaCha stream cipher and Poly1305 message authentication code) along with

3266-477: The development and expansions of free and open-source software movements exist all over the world. These organizations are dedicated to goals such as teaching and spreading technology. As listed by a former vice president of the Open Source Initiative , some American organizations include the Free Software Foundation , Software Freedom Conservancy , the Open Source Initiative and Software in

3337-461: The distribution of project information that focuses on end users. The basic roles OSS participants can fall into multiple categories, beginning with leadership at the center of the project who have control over its execution. Next are the core contributors with a great deal of experience and authority in the project who may guide the other contributors. Non-core contributors have less experience and authority, but regularly contribute and are vital to

3408-601: The focus on patent rights within these licenses, which has seen backlash from the OSS community, who prefer other forms of IP protection. Another issue includes technological protection measures (TPM) and digital rights management (DRM) techniques which were internationally legally recognized and protected in the 1996 World Intellectual Property Organization (WIPO) Treaty . Open source software proponents disliked these technologies as they constrained end-users potentially beyond copyright law. Europe responded to such complaints by putting TPM under legal controls, representing

3479-480: The many benefits provided, a huge issue to be considered is cybersecurity . While accidental vulnerabilities are possible, so are attacks by outside agents. Because of these fears, governmental interest in contributing to the governance of software has become more prominent. However, these are the broad strokes of the issue, with each country having their own specific politicized interactions with open-source software and their goals for its implementation. For example,

3550-560: The mid 2000s, more and more tech companies have begun to use OSS. For example, Dell's move of selling computers with GNU/Linux already installed. Microsoft itself has launched a Linux-based operating system despite previous animosity with the OSS movement. Despite these developments, these companies tend to only use OSS for certain purposes, leading to worries that OSS is being taken advantage of by corporations and not given anything in return. While many governments are interested in implementing and promoting open-source software due to

3621-508: The number of people employed in the IT sector. OSS can be highly reliable when it has thousands of independent programmers testing and fixing bugs of the software. Open source is not dependent on the company or author that originally created it. Even if the company fails, the code continues to exist and be developed by its users. OSS is flexible because modular systems allow programmers to build custom interfaces, or add new abilities to it and it

SECTION 50

#1732791425071

3692-537: The number of possible contributors indefinite. The ability to examine the code facilitates public trust in the software. Open-source software development can bring in diverse perspectives beyond those of a single company. A 2024 estimate of the value of open-source software to firms is $ 8.8 trillion, as firms would need to spend 3.5 times the amount they currently do without the use of open source software. Open-source code can be used for studying and allows capable end users to adapt software to their personal needs in

3763-435: The perceived benefits or costs, such as improved reputation or value of the project. The motivations of developers can come from many different places and reasons, but the important takeaway is that money is not the only or even most important incentivization . Because economic theory mainly focuses on the consumption of scarce resources, the OSS dynamic can be hard to understand. In OSS, producers become consumers by reaping

3834-404: The potential to quicken innovation and create of social value. In France for instance, a policy that incentivized government to favor free open-source software increased to nearly 600,000 OSS contributions per year, generating social value by increasing the quantity and quality of open-source software. This policy also led to an estimated increase of up to 18% of tech startups and a 14% increase in

3905-574: The project is fully released and only changed through minor bug fixes. Open source implementation of a standard can increase adoption of that standard. This creates developer loyalty as developers feel empowered and have a sense of ownership of the end product. Moreover, lower costs of marketing and logistical services are needed for OSS. OSS can be a tool to promote a company's image, including its commercial products. The OSS development approach has helped produce reliable, high quality software quickly and inexpensively. Open source development offers

3976-759: The project's development. New contributors are the least experienced but with mentorship and guidance can become regular contributors. Some possible ways of contributing to open-source software include such roles as programming , user interface design and testing, web design , bug triage , accessibility design and testing, UX design , code testing, and security review and testing. However, there are several ways of contributing to OSS projects even without coding skills. For example, some less technical ways of participating are documentation writing and editing, translation , project management , event organization and coordination, marketing, release management, community management, and public relations and outreach. Funding

4047-431: The rewards of contributing to a project. For example, a developer becomes well regarded by their peers for a successful contribution to an OSS project. The social benefits and interactions of OSS are difficult to account for in economic models as well. Furthermore, the innovation of technology creates constantly changing value discussions and outlooks, making economic model unable to predict social behavior. Although OSS

4118-496: The same license while weak copyleft licenses require the use of the same license only under certain conditions. Examples of this type of license include the GNU family of licenses , and the MPL and EPL licenses. The similarities between these two categories of licensing include that they provide a broad grant of copyright rights, require that recipients preserve copyright notices, and that

4189-500: The similarity of the Artistic license to other open-source software licenses, the ruling created a precedent that applied widely. Examples of free-software license / open-source licenses include Apache licenses , BSD licenses , GNU General Public Licenses , GNU Lesser General Public License , MIT License , Eclipse Public License and Mozilla Public License . Several gray areas exist within software regulation that have great impact on open-source software, such as if software

4260-488: The software "in any manner they see fit, without requiring that they pay the author(s) of the software a royalty or fee for engaging in the listed activities." Despite initially accepting it, Richard Stallman of the FSF now flatly opposes the term "Open Source" being applied to what they refer to as "free software". Although he agrees that the two terms describe "almost the same category of software", Stallman considers equating

4331-401: The software evolves. Linus's law states that given enough eyeballs all bugs are shallow. This means that if many users view the source code, they will eventually find all bugs and suggest how to fix them. Some users have advanced programming skills, and furthermore, each user's machine provides an additional testing environment. This new testing environment offers the ability to find and fix

SECTION 60

#1732791425071

4402-484: The software should be modular allowing for parallel development on independent components. Dynamic decision-making structure: There is a need for a decision-making structure, whether formal or informal, that makes strategic decisions depending on changing user requirements and other factors. Compare with extreme programming . The process of Open source development begins with a requirements elicitation where developers consider if they should add new features or if

4473-456: The software to implement the author's copyright rights without having to use the same license for distribution. Examples of this type of license include the BSD , MIT , and Apache licenses . Copyleft licenses are different in that they require recipients to use the same license for at least some parts of the distribution of their works. Strong copyleft licenses require all derivative works to use

4544-399: The software, component security and integrity, and foreign governmental influence. Sanity check A sanity check or sanity test is a basic test to quickly evaluate whether a claim or the result of a calculation can possibly be true. It is a simple check to see if the produced material is rational (that the material's creator was thinking rationally, applying sanity ). The point of

4615-425: The software. Commercial pressures make traditional software developers pay more attention to customers' requirements than to security requirements, since such features are somewhat invisible to the customer. In open-source software development, tools are used to support the development of the product and the development process itself. Version control systems such as Centralized Version control system (CVCS) and

4686-597: The terms incorrect and misleading. Stallman also opposes the professed pragmatism of the Open Source Initiative , as he fears that the free software ideals of freedom and community are threatened by compromising on the FSF's idealistic standards for software freedom. The FSF considers free software to be a subset of open-source software, and Richard Stallman explained that DRM software, for example, can be developed as open source, despite that it does not give its users freedom (it restricts them), and thus does not qualify as free software. In his 1997 essay The Cathedral and

4757-514: The traditional model of development, which he called the cathedral model, development takes place in a centralized way. Roles are clearly defined. Roles include people dedicated to designing (the architects), people responsible for managing the project, and people responsible for implementation. Traditional software engineering follows the cathedral model. The bazaar model, however, is different. In this model, roles are not clearly defined. Some proposed characteristics of software developed using

4828-437: The use and modification of the code. It is an explicit "feature" of open source that it puts very few restrictions on the use or distribution by any organization or user, in order to enable the rapid evolution of the software. According to Feller et al. (2005), the terms "free software" and "open-source software" should be applied to any "software products distributed under terms that allow users" to use, modify, and redistribute

4899-534: Was cut along with support for the FIPS 140-2 standard that required it. Unused protocols and insecure algorithms have also been removed, including the support for FIPS 140-2 , MD4 / MD5 J-PAKE , and SRP . One of the complaints of OpenSSL was the number of open bugs reported in the bug tracker that had gone unfixed for years. Older bugs are now being fixed in LibreSSL. Open-source software Note to admins : In case of doubt, remove this template and post

4970-404: Was much debate on whether to protect it as intellectual property under patent law , copyright law or establishing a unique regulation. Ultimately, copyright law became the standard with computer programs being considered a form of literary work, with some tweaks of unique regulation. Software is generally considered source code and object code , with both being protectable, though there

5041-455: Was removed, and support for obsolete operating systems ( Classic Mac OS , NetWare , OS/2 , 16-bit Windows ) and some older operating systems ( OpenVMS ) was removed. LibreSSL was initially developed as an intended replacement for OpenSSL in OpenBSD 5.6, and was ported to other platforms once a stripped-down version of the library was stable. As of April 2014, the project was seeking

#70929