SSL in Pop Peeper

[kzinnato]

Despite what it says on your plugins site (it says the version of SSL is 1.0.2.11) hovering over the link shows this https://www.esumsoft.com/products/pop-p ... sl102n.zip. At a minimu can you update the plugin site info and indicate correctly that this is 1.0.2.14

102n = 1.0.2.14 (n being the 14th letter in the alphabet)

Why do you still package 1.0.2.11 (aka 102k) with your latest download of the application?




As for me, I just download the latest 1.0.2 win32 version from (moderator: link removed) and copy those over to the PopPeeper folder. Been doing that for years, no problems. Currently this is 102o = 1.0.2.15

[Jeff]

This is done somewhat intentionally. Years back, there was a version of OpenSSL that caused random crashes, so what I've done since then is posted the latest update available for manual download, while the automatic installers use a well-established, stable version. Admittedly, I tend to allow the latest version to be tested far longer than it should...

I removed your link because we're dealing with security here. I don't want people downloading very sensitive SSL files from some random folder. I'm sure it's probably safe, I just like to be cautious. 1.0.2o/15 is not the latest, OpenSSL is currently at 1.0.2p/16, which is now available for manual download (using the zip option):
https://www.esumsoft.com/products/pop-p ... ugins/#SSL


As a semi-relevant side-note: POP Peeper v5 will be using OpenSSL v1.1. v1.0 and v1.1 are not compatible (meaning PPv4 can't use SSLv1.1 and PPv5 can't use SSLv1.0).

[lwc]

As a semi-relevant side-note: POP Peeper v5 will be using OpenSSL v1.1. v1.0 and v1.1 are not compatible (meaning PPv4 can't use SSLv1.1 and PPv5 can't use SSLv1.0).

Actually, enough years have passed since v1.1 was launched that by now there are already two new versions past the stable stage - v1.1.0 and v1.1.1. Will PPv5 skip v1.1.0 to support v1.1.1?

[Jeff]

If I remember OpenSSL's versioning correctly, v1.1.1 should be binary compatible with v1.1.0.

[lwc]

They may be true, but support for v1.1.0 has already ended except security fixes ("1.1.1 is our new LTS release we are strongly advising all users to upgrade as soon as possible").

Speaking of which, support for v1.0.2 ends next month and it'll only get security fixes too.
By the end of 2019, everything older than v1.1.1 will be completely unsupported.

[Jeff]

I know you alluded to it, but I want to be clear for other people: SSL v1.0.2 is supported by OpenSSL until Dec 31, 2019 (over a year), but they are ending what they call "full support" at the end of this year. What this means is that, as of Jan 1 2019, v1.0.2 will only have new releases for security issues, but bugs are no longer addressed. OpenSSL v1.1.1 (which is supported in POP Peeper v5.0, but not v4) adds support for the new TLS v1.3 protocol.