Jeroen Ooms

This week we released version 3.0 of the
[curl](https://cran.r-project.org/web/packages/curl/vignettes/intro.html)
R package to CRAN. You may have never used this package directly, but
`curl` provides the foundation for most HTTP infrastructure in R,
including `httr`, `rvest`, and all packages that build on it. If R
packages need to go online, chances are traffic is going via curl.

This release introduces an important change for Windows users: we are
switching from OpenSSL to Secure Channel on Windows 7 / 2008-R2 and up.
Let me explain this in a bit more detail.

## Why Switching SSL backends

The [libcurl](https://curl.haxx.se/libcurl/) C library requires an
external crypto library to provide the SSL layer (the S in HTTPS). On
Linux / MacOS, libcurl is included with the OS so we don't worry about
this. However on Windows we ship our own build of libcurl so we can
choose if we want to build against [OpenSSL](https://www.openssl.org/)
or Windows native SSL api called [Secure
Channel](https://msdn.microsoft.com/en-us/library/windows/desktop/aa380123(v=vs.85).aspx),
also referred to as just "WinSSL".

Thus far we have always used libcurl with OpenSSL, which works
consistently on all versions of Windows. However OpenSSL requires that
we provide our own CA bundle, which is not ideal. In particular users on
corporate / government networks have reported difficulty connecting to
the internet in R. The reason is often that their enterprise gateway /
proxy uses custom certificates which are installed in the Windows
certificate manager, but are not present in R's bundle.

Moreover shipping our own CA bundle can be a security risk. If a CA gets
hacked, the corresponding certificate needs to be revoked immediately.
Operating systems can quickly push a security update to all users, but
we cannot do this in R.

## Switching to WinSSL

If we build libcurl against Windows native [Secure
Channel](https://msdn.microsoft.com/en-us/library/windows/desktop/aa380123(v=vs.85).aspx),
it automatically uses the same SSL certificates as Internet Explorer.
Hence we do not have to ship and maintain a custom CA bundle. Earlier
this year I tried to switch the `curl` package to WinSSL, and everything
seemed to work great on my machine.

However when we started checking reverse dependecies on CRAN WinBuilder,
many packages depending on curl started to fail! It turned out Windows
versions before Windows 7 do not natively support TLS 1.1 and 1.2 by
default. Because TLS 1.2 is used by the majority of HTTPS servers today,
WinSSL is basically useless on these machines. Unfortunately this also
includes CRAN WinBuilder which runs Windows 2008 (the server edition of
Vista).

So we had no choice but to roll back to OpenSSL in order to keep
everything working properly on CRAN. Bummer.

## Towards Dual SSL

I had almost given up on this when a few weeks ago Daniel Stenberg
posted the following
[announcement](https://curl.haxx.se/mail/lib-2017-08/0118.html) on the
libcurl mailing list:

> Hi friends!As of minutes ago, libcurl has the ability to change SSL
> backend dynamicallyat run-time - if built with the support enabled.
> That means that the choicedoes no longer only have to happen at
> build-time.

This new feature gives us exactly the flexibility we need. We can take
advantage of native Secure Channel on Windows 7 and up which are almost
all users. However we can keep things working in legacy servers by
falling back on OpenSSL on these machines, including the CRAN win
builder.

[![code](/assets/blog-images/curl30.png)](https://github.com/cran/curl/blob/3.0/src/ssl.c#L11-L17)

So this is where we are. Version 3.0 of the curl R package uses the
latest [libcurl 7.56.0](https://github.com/rwinlib/libcurl/releases) and
automatically switches to native SSL on Windows 7 and up. If all goes
well, nobody should not notice any changes, except those people on
enterprise networks where things will, hopefully, magically start
working.

## Feedback

Because each Windows network seems to have a different setup, testing
and debugging these things is often difficult. We are interested to hear
from Windows users if updating to curl 3.0 has improved the situation,
or if any unexpected side effects arise. Please [open an
issue](https://github.com/jeroen/curl/issues) on Github if you run into
problems.


This week we released version 3.0 of the curl R package to CRAN. You may have never used this package directly, but curl provides the foundation for most HTTP infrastructure in R, including httr, rvest, and all packages that build on it. If R packages need to go online, chances are traffic is going via curl.

Changes to Internet Connectivity in R on Windows

University of Glasgow

Roderic Page

![](http://taxonomy.zoology.gla.ac.uk/rod/icons/treeview.gif){align="right"
style="padding:4px"}  
Continuing the theme of [ancient programs of mine still being
used](http://iphylo.blogspot.com/2009/08/nexus-data-editor-and-windows-vista.html),
I\'ve been getting reports that the Windows version of
[TreeView](http://taxonomy.zoology.gla.ac.uk/rod/treeview.html) won\'t
install on Windows Vista and Windows 7. As with
[NDE](http://iphylo.blogspot.com/2009/08/nexus-data-editor-and-windows-vista.html),
it\'s the installer that seems to be causing the problem. I\'ve put a
new installer on the [TreeView web
page](http://taxonomy.zoology.gla.ac.uk/rod/treeview.html) (direct link
[here](http://taxonomy.zoology.gla.ac.uk/rod/treeview/1.6.6/setup.exe)).  
  
TreeView still seems to be used quite a bit, judging from responses to
my [question on
BioStar](http://biostar.stackexchange.com/questions/402/what-phylogeny-viewing-software-do-you-use),
even through there are more modern alternatives. I made a brief attempt
to create a replacement, namely [TreeView
X](http://darwin.zoology.gla.ac.uk/~rpage/treeviewx), but it lacks much
of the functionality of the original. I keep meaning to revisit TreeView
development, as [it\'s been very good to
me](http://iphylo.blogspot.com/2008/07/how-to-succeed-in-evolutionary-biology.html).


Continuing the theme of ancient programs of mine still being used, I've been getting reports that the Windows version of TreeView won't install on Windows Vista and Windows 7. As with NDE, it's the installer that seems to be causing the problem.

TreeView and Windows Vista

![nde.gif](http://lh6.ggpht.com/_Gct8lVAxKqQ/Sol2UGBoKmI/AAAAAAAAAg0/Sqt13Arxn_8/nde.gif?imgmax=800){border="0"
width="170" height="69" align="right"}Sometimes it\'s just
amazing/frightening how long a piece of software remains useful. I wrote
[Nexus Data Editor
(NDE)](http://taxonomy.zoology.gla.ac.uk/rod/NDE/nde.html) in the late
1990\'s, mainly to keep my then PhD student [Vince
Smith](http://vsmith.info) happy. Vince was constructing a morphological
dataset for lice, and he didn\'t like Macs (in those days, he\'s seen
the light now), and even if he did
[MacClade](http://macclade.org/macclade.html) didn\'t allow him to wax
lyrical about character states, so I wrote NDE for Windows (in those
days this meant Windows 95 and NT). Vince and other students found it
useful, so I wrote a manual and released it.  
  
Turns out people still use NDE, but it doesn\'t install on Vista. I
finally bit the bullet and put a installed a copy of Vista in VM Fusion
on my MacBook, and confirmed that the installation was broken. Fearing
I\'d have to compile NDE for Vista (a challenge as it was built using
the wonderful Borland 5.02 C++ compiler and IDE, now defunct). Turns
out, it\'s the install package itself that\'s broken (built using
Install Shield). The [Inno Setup](http://www.jrsoftware.org/isinfo.php)
installer I use for [TreeView
X](http://darwin.zoology.gla.ac.uk/~rpage/treeviewx/) works fine,
however.  
  
The upshot is, if you use(d) NDE and have Vista, download a new copy of
NDE [from the web
site](http://taxonomy.zoology.gla.ac.uk/rod/NDE/nde.html), and it should
work. Thanks to [Mike
Polcyn](http://smu.edu/smunews/dallasaurus/polcyn.asp) at the Southern
Methodist University, Dallas, for the prompting that finally got this
done.


Sometimes it's just amazing/frightening how long a piece of software remains useful. I wrote Nexus Data Editor (NDE) in the late 1990's, mainly to keep my then PhD student Vince Smith happy.

Rogue Scholar Beiträge

Changes to Internet Connectivity in R on Windows

TreeView and Windows Vista

Nexus Data Editor and Windows Vista