If you were to guess, which of these components is installed in most devices world-wide?

[muddle@infosec.exchange]

@bagder Hmm. It's like asking if there are more windows or doors in the world?

[dontony@hachyderm.io]

@bagder do they have to be devices that are still active? i would imagine the mp3 players and Game Boys of days past would have more need of decompression than networking or databases. but the majority of them are in landfills or drawers nowadays.

[notgull@hachyderm.io]

@bagder There's no way it isn't sqlite.

[xeniac@troet.cafe]

@bagder i wonder why so many people bet on sqlite. IMHO it's the newest competitor in this game, and the are so many alternatives to it.
My bets are on zlib. I don't know any device that don't use an compressed kernel, compressed partitions, or libs.

[jawnsy@mastodon.social]

@pythno @bagder I figured OpenSSL would be most popular (you need encryption even if you're not using curl), but then I remembered that other TLS stacks are popular in embedded devices, where libcurl is pretty commonly found

[tbortels@infosec.exchange]

@xeniac @bagder

This. I'm also thinking it might be a dependency for lots of other libraries, maybe including libcurl. Optional perhaps - but what distro doesn't throw in the kitchen sink?

[gergolippai@mastodon.social]

@paolo_lulli @bagder the only reason i voted sqlite is it's also kindof a default thing with offline devices, so little embedded crap that would never even dream of anything internet. i'm pretty sure there are about 5 sqlite instances in my 1 meter range where i'm sitting now: an (electric) piano, a looper, a crappy projector, my watch (also libcurl!), and something else I can't think of now.

[jabwd@mastodon.social]

@jawnsy @pythno @bagder I went for sqlite simply because it is also found on non internet connected devices but then again libz and libcurl might even be in places on accident almost.. what a fun question wish we could tally

[can@haz.pink]

@muddle obviously windows. Most rooms only have one door. Many rooms have multiple windows. @bagder

[muddle@infosec.exchange]

@can @bagder Advent calendars, though... are they windows or doors?

[aanee@mastodon.online]

@bagder Isn't libz basically a kernel dependency now days? So if you run linux you'd have it installed... unless you chose not to compress your kernel.
libcurl as a second if you want to talk over a network.
Then sql, cause everything needs a database now days.
Lastly OpenSSL because "security is out of scope for our LAN only thingamajig that's definitely never going to be connected to the Internet".

But I'm basing this on a guess that Linux use trumps network use, which might be naïve.

[bagder@mastodon.social]

@aanee there are many billions of devices without Linux that run sqlite and libcurl...

[babble_endanger@freeradical.zone]

@bagder Can't be SQLite because my car's stupid infotainment unit keeps forgetting that I set it to "Shuffle"

[faker@infosec.exchange]

@xeniac @bagder it depends on how you count. Mobile iOS and Android applications often use sqlite. If you count any database file as an installation it wins (IMO). If you count every sqlite client library it might still (since devs might still include a library and not use the system provided ones).

[geert@society.oftrolls.com]

@bagder Having seen Android App sources that contained multiple copies (and versions, of course) of some of these components in one single app, I guess the answer is all of them.

[dermoth@jasette.facil.services]

@bagder the thing about OpenSSL is that it would probably win if we grouped all SSL alternatives into one, but there is just one libcurl!

[bagder@mastodon.social]

@dermoth there are multi-billion installs of libcurl using other TLS libraries than OpenSSL though

[numeredevs@fosstodon.org]

@babble_endanger @bagder Sounds like a VW, right?

[thefeditest@mastodon.social]

@bagder i voted libcurl, but was thinking sqlite

[pollita@phpc.social]

@bagder

libcurl often pulls in libz and openssl, so its installs *may* inflate the other two. So I think it's *less* likely (but not impossible) to be #1.

libsqlite I don't have a vibe on. I know it's popular for embedded... ‍️

OpenSSL has multiple alternatives on POSIX and Win/Mac have OS level crypto APIs. Embedded uses are probably better served by more... minimized, task-specific libraries.

zlib is the go-to IF interop (esp for legacy) is needed, but better algos exist for greenfield.