Talk:OpenSSL

message: I propose we merge in SSLeay. Unless we expect to be writing a large article on it, I suggest it'd probably be better off described in a paragraph in this article in a "History of OpenSSL" section. — Matt Crypto 22:58, 29 January 2006 (UTC)
replies: text: I guess there's noone disagreeing with you on this one.  Feel free to merge, or I will some time in the future.  Janizary 01:09, 8 February 2006 (UTC)
thread_title:  Merge [[SSLeay]] 

message: This really should just be a section in the OpenSSL article after all.  65.95.229.9 01:06, 25 March 2006 (UTC)
replies: text: No, OpenSSL is derived from SSLeay - there is a significant difference, besides which I already did that merge.  Janizary 23:55, 15 June 2006 (UTC)
thread_title:  Merge [[OpenSSL exception]] 

message: * wget's readme file, including the GPL with exception
This link is dead. I did not find any recent link to replace it with, therefore I am copying it here.
David Andel 15:29, 27 August 2007 (UTC)
replies: text: Their repository now appears to be hosted here.  -- Bovineone 18:57, 27 August 2007 (UTC)
thread_title:  dead link 

message: Right now, well over 50% of the article consists of arguing about the OpenSSL license terms. This is clearly an example of undue weight under Wikipedia policy, and it also violates our guideline against coat racks. Much of the discussion is original research as well. This section needs to be drastically trimmed. *** Crotalus *** 07:49, 2 January 2008 (UTC)
replies: text: I've taken a hatchet to the article and removed the  template. Hope thats OK. --Salix alba (talk) 22:45, 4 January 2008 (UTC)
thread_title:  Undue weight and coatracking 

message: BADLY DONE!  total gibberish to anyone who does not have a degree in computer whatevering!
 
WHAT is it - example: limewire is a p2p program  
                                        OPEN SSL IS ????
WHAT is it USED FOR - example: limewire permits sharing of several types of files over the internet 
                                                             OPEN SSL DOES???????????  
this appeared recently on my computer, thus i have NO idea what it is used for, why and how it was installed etc. or whether this should or can be removed.  and going online to try to find some CLEAR and STRAIGHTFORWARD information is a laughable task.  —Preceding unsigned comment added by 76.67.124.201 (talk) 21:02, 4 July 2010 (UTC)
thread_title:  explanation 

message: Dear Badly,
Please re-read the article.
Viz:  OPEN SSL IS??? "OpenSSL is an open source implementation of the SSL and TLS protocols."
Viz:  OPEN SSL DOES??? ". . .implements . . . basic cryptographic functions"
Especially, re-read the linked articles about SSL and TLS protocols.
Unfortunately, even in an encyclopedic source like Wikipedia, there has to be some presumption of domain knowledge to prevent articles from becoming unwieldy.  An article on n-mutexes has to presume a knowledge of both programming and statistics, because it would be - literally - impossible to explain if it were necessary to describe everything from binary logic on up.  Journals on Quality Engineering assume a domain knowledge of statistical analysis.  Pilots, in their conversations, don't have to explain what the rudder pedals are for.
One of the advantages of Wikipedia is that interesting and informative articles - helping to explain the article in question - can be directly hyperlinked.  You should try following some of them, it will be an enlightening experience.
Jim (JR)
24.107.232.143 (talk)  —Preceding undated comment added 05:08, 2 October 2010 (UTC)
thread_title: ==========================

message: If you could resolve this problem, please posted it.  —Preceding unsigned comment added by 219.87.128.204 (talk) 11:39, 9 September 2010 (UTC)
thread_title:  Does OpenSSL support ECIES ? 

message: Why is the Heartbleed bug written as if it does not exist anymore? CapnZapp (talk) 05:26, 9 April 2014 (UTC)
replies: text: The actual vulnerability has been fixed in the latest version of OpenSSL; strictly speaking, the bug no longer exists.  However, private keys stolen before the fix was published remain a serious problem, especially if the server does not implement perfect forward secrecy.  Since there is no way to determine whether a key has been stolen, it is necessary to revoke and reissue the certificate, and other mitigation, such as forced password changes, may also be required.  --NYKevin  05:53, 9 April 2014 (UTC)

text: Sorry, you gave me a technical answer particular to this piece of software when I was fishing for a correction to wiki policy on how we write articles. Much better now. CapnZapp (talk) 11:39, 9 April 2014 (UTC)
thread_title:  past tense? 

message: Today's spike in page accesses must be due to this XKCD. Maproom (talk) 06:08, 9 April 2014 (UTC)
replies: text: Maybe. Or it could be the fact that the Heartbleed story is suddenly all over mainstream media reports, and this article is linked from the ITN section on the Main Page. xkcd is not the only thing that drives traffic. Modest Genius talk 10:32, 9 April 2014 (UTC)
thread_title:  XKCD 

message: I'm mystified. Wiki has this "heartbleed" OpenSSL vulnerability announcement on it's main page as headline news; Slashdot hadn't mentioned it, the announcement was one day ago? But there is an XKCD about it already (see above) and the bug is cited in its own domain www.heartbleed.com 
How can a bug have such superb marketing? What is the actual technical source for the bug?
I'd dismiss it as a hoax if it were not for the xkcd; I suspect that something that has been known for awhile has suddenly gotten press. Pete St.John (talk) 00:08, 10 April 2014 (UTC)
replies: text: Here's the official OpenSSL security advisory.  It is cited in the "History" section of Heartbleed bug.  --NYKevin  13:59, 10 April 2014 (UTC)

text: Thanks. I just want to note that the article you point to didn't exist yesterday. So really the news to me, is not so much the bug, but this abrupt spike regarding it. The heartbleed.com site doesn't cite anything and doesn't even have webmaster contact info, so while the bug evidently is real the reaction is suspicious to me. (Also I corrected a typo in "heartbleed" above)  Pete St.John (talk) 16:49, 10 April 2014 (UTC)

text: Not to mention that it has a f**** logo! Is this a Codenomicon PR-stunt?  — Preceding unsigned comment added by 84.130.164.211 (talk) 23:04, 10 April 2014 (UTC)
thread_title:  Heartbleed chronology? 

message: I think it would be good to add answers to the 6 journalistic W's into the lede.--Wuerzele (talk) 22:37, 14 April 2014 (UTC)
thread_title:  lede 

message: I think that's a bit harsh for OpenSSL, can we perhaps remove that logo? Opalraava (talk) 21:09, 11 January 2015 (UTC)
replies: text: I am assuming that you are using the Hovercards beta feature as this does not appear to happen to the Navigation popups gadget. From the Hovercards discussion page it list the following known issue . PaleAqua (talk) 03:35, 12 January 2015 (UTC)
thread_title:  When I hover over the [[OpenSSL]] link in wikipedia I see the heartbleed logo 

message: "The OpenSSL project management team consists of four Europeans." - what's the purpose of this sentence other than to show its authors xenophobic/ignorant character?  — Preceding unsigned comment added by 2001:8A0:EC5F:8501:D0E9:641B:5D21:6562 (talk) 14:13, 25 January 2015 (UTC)
thread_title:  Project history 

message: I've readded the distinguish headers between OpenSSL and OpenSSH. The two names are only one letter apart, there is or at least was confusion between the two projects. This can especially be seen by looking at some of the comment sections on news stores about the Heartbleed bug where commenters often conflated OpenSSL, OpenSSH and OpenBSD. PaleAqua (talk) 16:56, 5 September 2015 (UTC)
replies: text: Hello!  On second thought, I'm fine with those hatnotes I guess that an average reader isn't super-careful and oriented toward details, :) so having the hatnotes should be actually beneficial. — Dsimic (talk | contribs) 17:25, 5 September 2015 (UTC)
thread_title:  OpenSSL vs OpenSSH 

message: I question the relevance of the note "This article's introduction section may not adequately summarize its contents."
I think the intro should primarily tell the reader /what/ OpenSSL is, and why it is notable.
That is more important than "summarizing" the contents of the article.
This article needed an accessible overview of what OpenSSL is, not an overview of the article's contents. (I have just added some words to improve that.)
Once the intro has told what OpenSSL is, there is not much more to say about that.
A deeper discussion of encryption, authentication, and the SSL and TLS protocols belongs in articles not tied to one particular implementation.
The particulars about the API are way too technical stuff for an encyclopedia.
The rest of the article contains supplementary informations about the subject.
This may give the impression that the article talks about something else than the intro does.
The article contains a large section about the vulnerabilities of OpenSSL.
Yet I do not think it would be appropriate to write about that in the lead.
That would create an impression that OpenSSL is particularly riddled with holes. 
The flaws have general interest because so much depends on OpenSSL's security, not because OpenSSL is more flawed than other comparable software.
If you want to add something about the flaws in the lead, one could perhaps write about how (in particular) the discovery of the heartbleed vulnerability became a wake-up call, 
creating awareness that the world had come to trust this fundamental piece of software and take its quality for granted.
One could add stuff about the adoption of this library if there are any sources. Otherwise a section about that will tend to be original research.
One could add something about when the first feature-complete version appeared, but I suspect that was quite immediately since the basis in SSLeay was quite good already in 1998.
One could add something about alternatives, or about what functionality has been added since the beginning in 1998. 
11:56, 16 September 2015 (UTC)
thread_title:  The intro does adequately summarize its contents 

message: Hello fellow Wikipedians,
I have just modified 5 external links on OpenSSL. Please take a moment to review my edit. If you have any questions, or need the bot to ignore the links, or the page altogether, please visit this simple FaQ for additional information. I made the following changes:
*Corrected formatting/usage for https://online.wsj.com/news/articles/SB20001424052702303873604579495362672447986
*Added archive https://web.archive.org/web/20150120120428/https://www.openssl.org/news/openssl-1.0.1-notes.html to https://www.openssl.org/news/openssl-1.0.1-notes.html
*Added  tag to http://cvs.openssl.org/fileview?f=openssl%2Fengines%2Fccgost%2FREADME.gost
*Added archive https://web.archive.org/web/20071010000622/http://www.gcn.com/online/vol1_no1/43142-1.html to http://www.gcn.com/online/vol1_no1/43142-1.html
*Added archive https://web.archive.org/web/20080102164139/http://users.ugent.be/~bpuype/wget/ to http://users.ugent.be/~bpuype/wget
*Added archive https://web.archive.org/web/20110212024627/http://www.climm.org/download.shtml.en to http://www.climm.org/download.shtml.en
When you have finished reviewing my changes, you may follow the instructions on the template below to fix any issues with the URLs.
Cheers.—InternetArchiveBot (Report bug) 11:22, 20 January 2018 (UTC)
thread_title:  External links modified (January 2018) 

message: Did someone play a prank on Wikipedia by adding two false links? The link to the OpenSSL Programming Guide is a Hewlett Packard document on OpenVMS. The link to the Open SSL Programming Manual is a link to IBM's Linux documentation. Would someone in charge please correct this spam? Perhaps it was the same perpetrator that included OpenSSL in the page on Arbitrary-Precision Arithmetic software? Hpfeil (talk) 21:37, 27 April 2020 (UTC)
thread_title:  April Fools Joke? OpenSSL Programming?? 

message: The section "Denial of service: ASN.1 parsing" looks like it has a redundant sentence, but the two sentences seem to be in conflict with each other. Not sure which version is more accurate. Quesoteric (talk) 07:14, 11 February 2024 (UTC)
thread_title:  Redundancy in ASN.1 parsing paragraph