Hacker Newsnew | past | comments | ask | show | jobs | submitlogin

Apple has deprecated OpenSSL as of Mac OS X 10.7 and they are not including it with iOS. Instead they provide their own APis.

The semi-official reason though is that OpenSSL doesn’t offer API compatibility between versions.



In case anyone's curious, here's a link to the libsecurity_ssl source (albeit not totally up to date — latest version is pre-"goto fail;" fix):

http://opensource.apple.com/source/Security/Security-55471/l...


I guess we see how well that worked out for them.


Compared to what?

You are aware that GnuTLS had a very similar "goto" style verification bypass bug, and that OpenSSL has had several flaws and broken stuff discovered, including the major recent "Heartbleed Bug".


Well... Certainly better right now.


OS X 10.9.2 still ships with OpenSSL. Luckily it's 0.9.8 and immune to the heartbeat bug.




Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: