<div dir="ltr">I don't know why they care about it, but yes it will take long time:<div><a href="https://www.openssl.org/blog/blog/2017/08/17/fips/">https://www.openssl.org/blog/blog/2017/08/17/fips/</a><br></div></div><div class="gmail_extra"><br><div class="gmail_quote">On Fri, Aug 18, 2017 at 8:41 PM, Alexander Kanavin <span dir="ltr"><<a href="mailto:alexander.kanavin@linux.intel.com" target="_blank">alexander.kanavin@linux.intel.com</a>></span> wrote:<br><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"><span class="">On 08/18/2017 08:56 PM, Mark Hatle wrote:<br>
<blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">
Even with that patch to rename openssl10 back to openssl we still need to solve<br>
the openssl-native which wasn't reverted back to 1.0.<br>
<br>
Upstream nodejs isn't going to be openssl-1.1 for a bit longer as explained:<br>
<a href="https://github.com/nodejs/node/pull/14761" rel="noreferrer" target="_blank">https://github.com/nodejs/node<wbr>/pull/14761</a><br>
</blockquote>
<br>
I wanted to pull out a specific comment from the above link that shows one of<br>
the reasons why OpenSSL 1.1 support is delayed by many:<br>
<br>
7 days ago: shigeki commented:<br>
<blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">
We're also waiting for FIPS support of 1.1.x. They are now working on it as <a href="https://www.openssl.org/blog/blog/2017/07/25/fips/" rel="noreferrer" target="_blank">https://www.openssl.org/blog/b<wbr>log/2017/07/25/fips/</a>.> ...<br>
</blockquote>
<br>
Until the OpenSSL 1.1.x FIPS work is further along, a lot of projects (and major<br>
distributions) are going to wait to deploy it.<br>
</blockquote>
<br></span>
What I don't understand is why node even cares about FIPS? FIPS compliance is needed to win software supplier contracts with one certain government; I haven't seen any other reasons.<br>
<br>
Another point is that getting FIPS done will take a very long time, possibly two years or more, and this work is just starting now with no clear funding or completion date (see the openssl blog link). Meanwhile, all major desktop linux distros have 1.1 by default already; seems to me that they don't care.<br>
<br>
Alex<br>
</blockquote></div><br></div>