how not to link with OpenSSL (yes, turbo-octo-dangerzone was actually proposed by @GitHub on the first try)