OpenSSL Google Security Alert

Solar2D General Questions/Discussion
#41

I believe the legacy facebook plugin should still be there and it should work with the latest builds.

#42

Which version of CoronaSDK are you using?  What operating system are you using?

#43

Corona SDK Enterprise v2016.2830  I’m developing on Windows 7.

Thanks, Greg

#44

I got the same thing… The plugin needs upgrading

#45

I got the same warning from Google today…

#46

I got same email from Google.

Here is the log of Corona SDK.

Copyright © 2009-2016  C o r o n a   L a b s   I n c .
4月 01 04:30:08.284:     Version: 3.0.0
4月 01 04:30:08.284:     Build: 2016.2839
4月 01 04:30:11.622: lua-openssl version: 0.0.5    Lua 5.1    OpenSSL 1.0.1j 15 Oct 2014
 

#47

I got the email too. Yesterday I noticed a shed load of apps with warning messages on the dashboard. Won’t be able to update or add any new apps with this current ssl version after July.

#48

Same here, built using Corona SDK Enterprise v2016.2830 on OSX Yosemite. As adrianm says, perhaps the plugin needs upgrading.

#49

Same email here. I only use OpenSSL for local encryption (not communication, which is where I believe the security vulnerabilities lie), but Google does not recognize that distinction. 

By the way, if the OpenSSL library could be updated to also be compatible with running in the iOS Simulator (it currently causes an error, as has been mentioned here before), that would be even better.

#50

Same here yo1… Don’t want anyone with a text editor and root privileges giving themselves free iaps!

#51

Engineering is aware of this and are investigating solutions.

#52

Just want to +1 this.  Need this plug-in updated.

#53

Just want to +1 this.  I only use OpenSSL for local encryption but google does not care

#54

Ive just been working on a jason>string mangler/demangler, with verification. Ill add one more pass to it tomorrow then i can do away with SSL plugin. 

#55

Rob, any update on updating the OpenSSL plugin? Normally would be more patient but those of us using it are up against a deadline with Google and will need to find a work around if Corona is not able tp update it quick enough.

#56

The deadline is July 11, 2016. That’s over 3 months away. Our engineers need time to access the issue and make sure we get a solid solution out to you. We are quite aware of this and we will be working to fix it. We understand your desire to get this solved sooner than later, but we hope you understand we need need time to research this and give you a non-rushed solution.

Rob

#57

There is an alternative way for the impatient like me.

You get your save table, converted to json. Convert it to a string, mangle it up and use that to save. On load you un-mangle it and it works a treat. I can supply an example and you can use that as a base if anyone is interested. The only downside is that if you removed the plugin, you wont be able to open up any existing games saves. The plan to that is to keep the plugin AND the new method on next apk update so i can load the save data and convert it to my new save data format. Then I will have to update the apk again with the plugin removed. 

#58

Rob,

I completely understand, We have a lot of apps affected and we don’t want to be 3 months down the road and rushing to implement a solution as we will “need time to access the issue and make sure we get a solid solution.”

Thanks for the update.

#59

Thanks for the suggestion. This is very similar to my Plan B. Iam hoping not go this route which is why getting an idea of the timeline for Corona to fix this issue is a deciding factor. 

#60

I use in my project, only 2 of the openssl functions

openssl = require “plugin.openssl”

cipher = openssl.get_cipher ( “aes-256-cbc” )

cipher:encrypt() --1
cipher:decrypt() --2

Is there an analog thereof in pure lua?