SSL with "accept" command?

[ahsoftware]

On 09/07/2016 03:30 PM, Bob Sneidar wrote:
> I have looked into this some and it gets really dicey. First of all, SSL (if you mean openSSL) has licensing requirements. This is why the compiled versions of mySQL for windows do not use openSSL, they use yaml ssl which I think is a fork of openSSL. They could not distribute compiled versions of the openSSL library for some reason I do not understand. It violates the license I guess, or maybe money had to change hands or something.

OpenSSL is dual-licensed. LiveCode uses OpenSSL and there is no conflict 
there. MySQL is messy because Oracle.

>
> Then there are versions of SSL and TLS.

If you mean the library called SSL, it's been deprecated for quite some 
time.

OpenSSL 2.0 was apparently compromised a couple years back (if you 
recall the heartbleed bug) and TLS got caught up in it because TLS 1.0 
was written to fall back on SSL if TLS failed. Now we have SSL 1.0, 2.0 
and 3.0, as well as TLS 1.0, 1.1 and 1.2. Additionally, there was an 
update to TLS 1.2 to no longer fall back on SSL.

Heh.
https://xkcd.com/1354/

Again, SSL <version-anything> is outdated. Even Microsoft issued a 
notice about it. Heartbleed affected OpenSSL version 1.0.1 only. The fix 
was released in 1.0.1g, although Debian patched its own version ahead of 
the official release with a separate version number (1.0.1e-2), which 
provided false positives on heartbleed scanners.

HTTPS uses TLS, which is sometimes erroneously called SSL. I believe the 
fallback removal was just to disable fallback to SSL 2.0 (which should 
never have seen the light of day in the first place), but I'm sure 
someone will correct me if I'm wrong.

> So the upshot is, SSL is a mess right now.

Again, if you're referring to OpenSSL, it's always been a mess. There 
are half a dozen different technologies inside, and their cooperation is 
so fragile that tweaking things gets ugly quickly. And it's so big that 
nobody wants to take on the task of rewriting it.

I would love to see an updated SSL library that actually works...

No. The first rule of creating your own encryption is don't.

> There is a neat telnet utility called SMTPConsole

I read as far as "Requires Windows and .Net Framework 2.0 or greater."

-- 
  Mark Wieder
  ahsoftware at gmail.com