If you were to guess, which of these components is installed in most devices world-wide?

[varpie@peculiar.florist]

@bagder I don't know how it's done on iOS, but on Android as far as I know the "native" (Kotlin/Java) implementations don't use libcurl, but Room uses sqlite, so it is more likely for apps to create a new instance of sqlite than libcurl. That being said, they depend on OpenSSL for HTTPS calls, so maybe OpsnSSL is the winner on Android devices, as basically all apps make HTTPS calls but not all apps have a local DB with sqlite, and libcurl installations don't scale linearly with the number of apps...

[taffer@mastodon.gamedev.place]

@bagder I voted for OpenSSL. When BlackBerry 10 devices shipped they had three different versions of OpenSSL in them (all with different vulnerabilities of course).

[tripplehelix@tech.lgbt]

@km @bagder

When you score 100% you're definitely right.

[werschweinchen@mountains.social]

@bagder Since I had to build some SBOMs lately, I can tell that zlib is everywhere (including the linux kernel). In a typical configuration of curl and sqlite, zlib is a dependency, and it can also be a dependency to OpenSSL (although I think it is more esoteric configuration, not sure), but I'd estimate it has to be zlib by a large margin.

[kaito02@mastodon.social]

@bagder I would've given the point to libcurl but it feels like every Android app uses sqlite. Also would libcurl even work without openssl?

[yojimbo@masto.hackers.town]

@bagder I was very tempted by sqlite ... on all the Androids for example, but not on Windows by default. OpenSSL is out, because there are other implementations. libz follows closely on a general-purpose OS and anything with web; but libcurl covers protocols other than HTTP; FTP and friends have been around for a lot longer, and there are a lot of IoT devices ...

[muddle@infosec.exchange]

@bagder Hmm. It's like asking if there are more windows or doors in the world?

[dontony@hachyderm.io]

@bagder do they have to be devices that are still active? i would imagine the mp3 players and Game Boys of days past would have more need of decompression than networking or databases. but the majority of them are in landfills or drawers nowadays.

[notgull@hachyderm.io]

@bagder There's no way it isn't sqlite.

[xeniac@troet.cafe]

@bagder i wonder why so many people bet on sqlite. IMHO it's the newest competitor in this game, and the are so many alternatives to it.
My bets are on zlib. I don't know any device that don't use an compressed kernel, compressed partitions, or libs.

[jawnsy@mastodon.social]

@pythno @bagder I figured OpenSSL would be most popular (you need encryption even if you're not using curl), but then I remembered that other TLS stacks are popular in embedded devices, where libcurl is pretty commonly found

[tbortels@infosec.exchange]

@xeniac @bagder

This. I'm also thinking it might be a dependency for lots of other libraries, maybe including libcurl. Optional perhaps - but what distro doesn't throw in the kitchen sink?

[gergolippai@mastodon.social]

@paolo_lulli @bagder the only reason i voted sqlite is it's also kindof a default thing with offline devices, so little embedded crap that would never even dream of anything internet. i'm pretty sure there are about 5 sqlite instances in my 1 meter range where i'm sitting now: an (electric) piano, a looper, a crappy projector, my watch (also libcurl!), and something else I can't think of now.

[jabwd@mastodon.social]

@jawnsy @pythno @bagder I went for sqlite simply because it is also found on non internet connected devices but then again libz and libcurl might even be in places on accident almost.. what a fun question wish we could tally

[can@haz.pink]

@muddle obviously windows. Most rooms only have one door. Many rooms have multiple windows. @bagder

[muddle@infosec.exchange]

@can @bagder Advent calendars, though... are they windows or doors?

[aanee@mastodon.online]

@bagder Isn't libz basically a kernel dependency now days? So if you run linux you'd have it installed... unless you chose not to compress your kernel.
libcurl as a second if you want to talk over a network.
Then sql, cause everything needs a database now days.
Lastly OpenSSL because "security is out of scope for our LAN only thingamajig that's definitely never going to be connected to the Internet".

But I'm basing this on a guess that Linux use trumps network use, which might be naïve.

[bagder@mastodon.social]

@aanee there are many billions of devices without Linux that run sqlite and libcurl...

[babble_endanger@freeradical.zone]

@bagder Can't be SQLite because my car's stupid infotainment unit keeps forgetting that I set it to "Shuffle"

[faker@infosec.exchange]

@xeniac @bagder it depends on how you count. Mobile iOS and Android applications often use sqlite. If you count any database file as an installation it wins (IMO). If you count every sqlite client library it might still (since devs might still include a library and not use the system provided ones).