On 5/13/08 7:08 PM, Marc Espie wrote:

quoted text
> More details show that someone seriously fucked up in debian.

Well, this Kurt has seriously asked for details on the relevant 
openssl-dev list:

http://marc.info/?l=openssl-dev&m=114651085826293&w=2


And see what "arrogant as usual" Ben Laurie states:

http://www.links.org/?p=327

"they should contribute their patches upstream to the package 
maintainers. Had Debian done this in this case, we (the OpenSSL Team) 
would have fallen about laughing, and once we had got our breath back, 
told them what a terrible idea this was."


Kurt has clearly done so, and I know personally of another totally 
ignored patch from our company and I have heard in the past about 
OpenBSD people trying to send patches to OpenSSL maintainers to no avail.

The OpenSSL maintainers have proven not to read their mail, they aren't 
interested in cleaning up their big mess.


Laurie also states "never fix a bug you dont understand" and this 
OpenSSL "hero" seems to forget that something that seems smart and OK 
now and here can be plain bad and ugly when looked at with some more 
distance or knowledge.

His "Adding uninitialised memory to it can do no harm and might do some 
good, which is why we do it." is pure arrogant and shortsighted shit to me.

+++chefren