<html>
<head>
<meta http-equiv="Content-Type" content="text/html;
charset=windows-1252">
</head>
<body text="#000000" bgcolor="#FFFFFF">
<div class="moz-cite-prefix">On 30/05/21 14:05, Michael McKenney
wrote:<br>
</div>
<blockquote type="cite"
cite="mid:DM5PR1801MB20748F115A5D59FCFE4C22948C209@DM5PR1801MB2074.namprd18.prod.outlook.com">
<meta http-equiv="Content-Type" content="text/html;
charset=windows-1252">
<meta name="Generator" content="Microsoft Word 15 (filtered
medium)">
<style><!--
/* Font Definitions */
@font-face
{font-family:"Cambria Math";
panose-1:2 4 5 3 5 4 6 3 2 4;}
@font-face
{font-family:Calibri;
panose-1:2 15 5 2 2 2 4 3 2 4;}
/* Style Definitions */
p.MsoNormal, li.MsoNormal, div.MsoNormal
{margin:0in;
font-size:11.0pt;
font-family:"Calibri",sans-serif;}
span.EmailStyle17
{mso-style-type:personal-compose;
font-family:"Calibri",sans-serif;
color:windowtext;}
.MsoChpDefault
{mso-style-type:export-only;
font-family:"Calibri",sans-serif;}
@page WordSection1
{size:8.5in 11.0in;
margin:1.0in 1.0in 1.0in 1.0in;}
div.WordSection1
{page:WordSection1;}
--></style><!--[if gte mso 9]><xml>
<o:shapedefaults v:ext="edit" spidmax="1026" />
</xml><![endif]--><!--[if gte mso 9]><xml>
<o:shapelayout v:ext="edit">
<o:idmap v:ext="edit" data="1" />
</o:shapelayout></xml><![endif]-->
<div class="WordSection1">
<p class="MsoNormal">Why can't we get a proper installation
method to keep OpenSSL at the latest revision for Linux?<br>
<br>
My biggest compliant with Linux is it is so difficult to get
best practice installations for services like OpenSSL.
Ubuntu is still on 1.1.1f. I have been trying to upgrade to
1.1.1k. Openssl version -a states I am on 1.1.1k. When
programs in Wordpress that use OpenSSL show I am using
1.1.1.f. Spending hours of time on various sites like
AskUbuntu.com, only to be disappointed. Microsoft has best
practices guides for installations. Why can’t we get them
for Linux.
<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<br>
</div>
</blockquote>
this is both very hard and undesirable: <br>
openssl can be regarded as a low-level system library that is used
by many applications across the entire Linux distribution. You
cannot simply upgrade this low-level system library without breaking
these applications. Admittedly, for an upgrade from 1.1.1f ->
1.1.1k the risk of introducing an API change is quite low, but for
anything else (e.g. 1.1.0x -> 1.1.1k) you will almost certainly
have to rebuild and relink all applications that depend on the
OpenSSL libraries. <br>
This is not something you can expect from the Linux distro
maintainers. For them, it is far less risky to backport security
fixes to the version of OpenSSL that they built their distro on
(e.g. Ubuntu 20 > 1.1.1f; CentOS 7 -> 1.0.2k (yes!), etc).<br>
<br>
Note that most update woes that Windows 10 has had over the past few
years were related to library updates breaking applications - so
even microsoft has problems with "best practices".<br>
<br>
HTH,<br>
<br>
JJK<br>
<br>
</body>
</html>