<html><head><meta http-equiv="content-type" content="text/html; charset=utf-8"></head><body dir="auto"><div dir="ltr"></div><div dir="ltr"><br></div><div dir="ltr"><blockquote type="cite">On 4. Feb 2023, at 09:05, Ard Biesheuvel <ardb@kernel.org> wrote:<br><br></blockquote></div><blockquote type="cite"><div dir="ltr"><span>On Sat, 4 Feb 2023 at 02:13, Marvin Häuser <mhaeuser@posteo.de> wrote:</span><br><blockquote type="cite"><span></span><br></blockquote><blockquote type="cite"><span>Hi Ard,</span><br></blockquote><blockquote type="cite"><span></span><br></blockquote><blockquote type="cite"><span>While I agree the tone is a bit irritating, I am not sure what kind of context you expect there to be. The library is nearing EOL and usage beyond EOL is unacceptable. It will take significant time to solve the related issues, test them, have them merged, and for them to trickle down the IBV chains.</span><br></blockquote><blockquote type="cite"><span></span><br></blockquote><blockquote type="cite"><span>OpenSSL is quite "big" in general and many consider it to not be a good choice for embedded usage. Do you know of any discussion regarding alternatives? I've heard folks use libsodium or mbedtls outside edk2, but don't have any experience with either. (Not necessarily looking to *start* a discussion, but mostly references / reading material, if you have any.)</span><br></blockquote><blockquote type="cite"><span></span><br></blockquote><span></span><br><span>Again, I don't have the full context here, so with that in mind:</span><br><span></span><br><span>Open source is about the freedom to use the code base in any way you</span><br><span>like.</span></div></blockquote><div><br></div><div>This is a point that can trivially be driven ad absurdum, so I’ll not press further. I think everyone agrees to *an extent* and *nobody* will agree to the full extent.</div><br><blockquote type="cite"><div dir="ltr"><span>Surely, Intel (as a collaborator in Tianocore) is entitled to</span><br><span>express a desire to retain the OpenSSL 1.1 version of CryptoPkg as an</span><br><span>option while we move it to OpenSSL 3? It is not even important how</span><br><span>they actually intend to use it, that is really their business.</span><br><span></span><br><span>Of course, if you *buy* from Intel, you have all reason to be annoyed</span><br><span>if their products are based on outdated crypto software. But that</span><br><span>doesn't mean it is up to the community to take away their ability to</span><br><span>do so.</span><br></div></blockquote><div><br></div><div>Not if they drive the deprecation at a reasonable schedule. Regarding which, just in: <a href="https://edk2.groups.io/g/devel/message/99638">https://edk2.groups.io/g/devel/message/99638</a></div><div>*Thank you*, Jiewen!</div><br><blockquote type="cite"><div dir="ltr"><span></span><br><span>Most Intel based consumer products don't have firmware that is</span><br><span>supplied by Intel directly, and the IBVs have their own forks anyway,</span><br><span>so it is not even clear to me who would be affected by this.</span><br></div></blockquote><div><br></div><div>In my experience, things like security get little attention and thus, at least at first, forks will use whatever upstream uses. :(</div><br><blockquote type="cite"><div dir="ltr"><span></span><br><span>As for the use of mbetls or other [better] TLS libraries: I'd be all</span><br><span>for that, but I'm not sure how much work those libraries need to be</span><br><span>usable in the context of EDK2. IIRC, some changes went upstream into</span><br><span>OpenSSL for the UEFI execution context, and we'd probably need to do</span><br><span>the same for mbedtls.</span><br></div></blockquote><br><div>Not so sure, the big issue with OpenSSL is its embedded-unfriendly design. The biggest reason I could think of would be the ConvertPointer() theatre. I know for a fact that some folks use mbedtls even for UEFI purposes, but not whether that’s for RT code. It’s all closed source, so… :(</div><div><br></div><div>Best regards,</div><div>Marvin</div></body></html>
<div width="1" style="color:white;clear:both">_._,_._,_</div>
<hr>
Groups.io Links:<p>
You receive all messages sent to this group.
<p>
<a target="_blank" href="https://edk2.groups.io/g/devel/message/99639">View/Reply Online (#99639)</a> |
|
<a target="_blank" href="https://groups.io/mt/96722233/1813853">Mute This Topic</a>
| <a href="https://edk2.groups.io/g/devel/post">New Topic</a><br>
<a href="https://edk2.groups.io/g/devel/editsub/1813853">Your Subscription</a> |
<a href="mailto:devel+owner@edk2.groups.io">Contact Group Owner</a> |
<a href="https://edk2.groups.io/g/devel/unsub">Unsubscribe</a>
[edk2-devel-archive@redhat.com]<br>
<div width="1" style="color:white;clear:both">_._,_._,_</div>