Critical security fixes for multiple vulnerabilities in strongSwan affect Debian users. Immediate update is recommended.

Ladybird（瓢虫浏览器）号称“真正独立的 web 浏览器”，用自有的引擎渲染并处理网页内容。最初是以 SerenityOS HTML 查看器为起点，然后逐渐发展成为一个跨平台的浏览器，以追随 web 标准为第一要务，目标是以良好的性能、稳定性和安全性渲染现代化的网页。 浏览器主要使用以下几个关键库： * LibWeb：Web 渲染引擎 * LibJS：JavaScript 引擎 * LibWasm：WebAssembly 实现 * LibCrypto/LibTLS：密码基元+传输层安全 * LibHTTP：HTTP/1.1 客户端 * LibGfx：2D 图形库、图像渲染及解码 * LibUnicode：Unicode 和区域支持 * LibMedia：音视频后端 * LibCore：事件循环、系统抽象层 * LibIPC：跨进程通讯 ladybird.org ### Ladybird Ladybird is a truly independent web browser, backed by a non-profit.

kornel: > For example, we have `openssl`, `boring`, `aws-lc`, `libtls` and `ring`. They're all derivatives of `openssl`, but they're not the same "`ssl`" library. There are differences in their APIs and feature sets. There's also `rustls`, `native-tls`, `schannel`, `security-framework`, and `superboring` and smaller pieces overlapping with RustCrypto crates. I agree that in your provided example, moving from `openssl`, `boring`, `aws-lc` etc to `company-a.io/tls`, `cool-project.com/tls` etc seems like a degredation in user experience. I disagree that this is automatically the result (nor the goal, in my opinion) of the proposal though. Enabling something does not mean removing something else, and these crates will (probably) remain to be named as they are. However, namespacing would allow me to publish a patched version of any of those (which I would never do for a cryptography-related crate, I know my limits ). And it would be really clear I am using my patched version because I'd likely publish it as `my-website.nl/boring`. It would make it immediately clear that this is mine, not the official version. Just like if I were to publish it as `jarrovgit-boring` today with a `lib.name = boring`. The difference to me is that the namespace clearly conveys identity association, while using the currently possible workflow (`lib.name`) is only by convention. Enabling publishers to name their package to the crate's domain (e.g. `my-website.nl/xml`, where the previous mentioned "domain" refers to `xml` in this example) does not make it required to do so. Just like all of the `openssl`, `boring` and `aws-lc` package owners could already name their libraries `tls` with their wildly different APIs and confuse everybody. They are not doing that today and I don't see a reason for expecting this to happen when such a proposal as this would ever see an implementation. kornel: > There are some benefits to having extra identity and flexibility in naming, but ability to remove distinction between implementations is not a benefit, but a confusing downside of the proposal. TL;DR of my reply: this is not an added confusion, this is current behavior already through the existence of `lib.name`.

kornel: > However, I don't agree with the premise that different packages implementing the same thing should have the same name. It matters which (whose) implementation is it, and not only when picking packages, but while using them too. > > For example, we have `openssl`, `boring`, `aws-lc`, `libtls` and `ring`. They're all derivatives of `openssl`, but they're not the same "`ssl`" library. There are differences in their APIs and feature sets. There's also `rustls`, `native-tls`, `schannel`, `security-framework`, and `superboring` and smaller pieces overlapping with RustCrypto crates. The full name matters when you're doing a dependency audit and want to find out if `tls::` is OpenSSL v3.6, OpenSSL v3.6.1, or BoringSSL v0.20260413.0, but for normal everyday programming it's nice to be able to look at some code and know that `tls::` is a TLS library (vs being required to intuit that from `superboring::`. kornel: > I would be genuinely annoyed if the same `ssl` was used for `sfackler.github.io/ssl` , `sfackler.github.io/ssl` and `sfackler.github.io/ssl` (AKA `openssl` , `native-tls` and `security-framework` in the global namespace - the same author created more than one SSL library). This wouldn't be possible because the package names would be in conflict. You'd have to do something like `sfackler.github.io/ssl` and `sfackler2.github.io/ssl` -- the library names are non-unique, but package names _are_ unique, otherwise there's no way for the registry to map the package name to a `(urls, checksum)` tuple (which is the whole point of a package registry). kornel: > So even if library-renaming namespacing was possible, it'd be annoying, and I'd advocate for keeping library names unique anyway, like `aws.amazon.com/aws-lc` , `sfackler.github.io/native-tls` , `openssl.org/openssl` , etc. For some domains, such as cryptography, the quality of the implementation matters enough that users might insist on branding. You can always just decide to refuse to use dependencies that have names you think are too generic. As long as I'm allowed (as a package author) to publish a package, I don't really care if some subset of people don't use it for non-technical reasons.