If you were to guess, which of these components is installed in most devices world-wide?

[bagder@mastodon.social]

I deliberately chose to use the exact same wording for the question as when I ran the same poll back in late 2021.

[gbraad@mastodon.social]

@bagder BusyBox?

[avarice@critter.cafe]

@bagder i'd wager it goes libcurl, then openssl, then sqlite. maybe libcurl, sqlite, openssl in that order

[bagder@mastodon.social]

@svavar often yes, but it also support ten other TLS libraries. Like curl.exe on all windows 10 and 11 for example, they don't use OpenSSL. Then there's of course the question if the openssl forks count as openssl or not...

[varpie@peculiar.florist]

@bagder Hmm, that's a tricky one, if we just count the number of instances I think sqlite is higher than libcurl or OpenSSL because those would likely depend on dynamically linked libraries installed once per machine, but sqlite is often embedded and thus installed multiple times... but you're asking specifically about which one is installed in most devices, not most installed overall.

[bagder@mastodon.social]

@Varpie libcurl is also embedded and installed numerous times on for example every smartphone...

[solemarc@mastodon.social]

@bagder if it's number of installs it's probably sqlite since we all have that installed multiple times per device but if each device is only worth one point I assume it's much closer.

My entirely unsubstantiated guess is that curl is much more common in IOT devices than sqlite and thus, wins here.

[grishka@mastodon.social]

@bagder I voted sqlite, because there are more embedded devices that need a database than those that need networking. And out of those, not all use libcurl for networking.

The other two options I'm not sure. Every general-purpose device definitely ships with (likely several copies of) both.

[varpie@peculiar.florist]

@bagder I don't know how it's done on iOS, but on Android as far as I know the "native" (Kotlin/Java) implementations don't use libcurl, but Room uses sqlite, so it is more likely for apps to create a new instance of sqlite than libcurl. That being said, they depend on OpenSSL for HTTPS calls, so maybe OpsnSSL is the winner on Android devices, as basically all apps make HTTPS calls but not all apps have a local DB with sqlite, and libcurl installations don't scale linearly with the number of apps...

[taffer@mastodon.gamedev.place]

@bagder I voted for OpenSSL. When BlackBerry 10 devices shipped they had three different versions of OpenSSL in them (all with different vulnerabilities of course).

[tripplehelix@tech.lgbt]

@km @bagder

When you score 100% you're definitely right.

[werschweinchen@mountains.social]

@bagder Since I had to build some SBOMs lately, I can tell that zlib is everywhere (including the linux kernel). In a typical configuration of curl and sqlite, zlib is a dependency, and it can also be a dependency to OpenSSL (although I think it is more esoteric configuration, not sure), but I'd estimate it has to be zlib by a large margin.

[kaito02@mastodon.social]

@bagder I would've given the point to libcurl but it feels like every Android app uses sqlite. Also would libcurl even work without openssl?

[yojimbo@masto.hackers.town]

@bagder I was very tempted by sqlite ... on all the Androids for example, but not on Windows by default. OpenSSL is out, because there are other implementations. libz follows closely on a general-purpose OS and anything with web; but libcurl covers protocols other than HTTP; FTP and friends have been around for a lot longer, and there are a lot of IoT devices ...

[muddle@infosec.exchange]

@bagder Hmm. It's like asking if there are more windows or doors in the world?

[dontony@hachyderm.io]

@bagder do they have to be devices that are still active? i would imagine the mp3 players and Game Boys of days past would have more need of decompression than networking or databases. but the majority of them are in landfills or drawers nowadays.

[notgull@hachyderm.io]

@bagder There's no way it isn't sqlite.

[xeniac@troet.cafe]

@bagder i wonder why so many people bet on sqlite. IMHO it's the newest competitor in this game, and the are so many alternatives to it.
My bets are on zlib. I don't know any device that don't use an compressed kernel, compressed partitions, or libs.

[jawnsy@mastodon.social]

@pythno @bagder I figured OpenSSL would be most popular (you need encryption even if you're not using curl), but then I remembered that other TLS stacks are popular in embedded devices, where libcurl is pretty commonly found

[tbortels@infosec.exchange]

@xeniac @bagder

This. I'm also thinking it might be a dependency for lots of other libraries, maybe including libcurl. Optional perhaps - but what distro doesn't throw in the kitchen sink?