On Wed, 14 May 2008, chefren wrote:

quoted text
> On 5/13/08 7:08 PM, Marc Espie wrote:
> 
> > More details show that someone seriously fucked up in debian.
> 
> Well, this Kurt has seriously asked for details on the relevant openssl-dev
> list:
> 
> http://marc.info/?l=openssl-dev&m=114651085826293&w=2
> 
> And see what "arrogant as usual" Ben Laurie states:
> 
> http://www.links.org/?p=327
>
> "they should contribute their patches upstream to the package
> maintainers. Had Debian done this in this case, we (the OpenSSL Team)
> would have fallen about laughing, and once we had got our breath back,
> told them what a terrible idea this was."
>
> Kurt has clearly done so,

No, he hasn't. A question posed to a predominatly users' mailing list is
not the same as a proper bug report and patch submission. Vendors,
especially the size of Debian, should be held to a high standard of 
behaviour. Critically, he didn't identify that he was considering removing
these lines *for every user of Debian*.

quoted text
> and I know personally of another totally
> ignored patch from our company and I have heard in the past about
> OpenBSD people trying to send patches to OpenSSL maintainers to no
> avail.

Speaking as someone who has done the last two revs of the OpenBSD libssl,
I haven't tried to upstream our changes - they OpenBSD specific things
like using /dev/arandom and /dev/crypto. I think that any serious patch
we sent would have a good chance of inclusion.

quoted text
> The OpenSSL maintainers have proven not to read their mail, they aren't
> interested in cleaning up their big mess.
>
> Laurie also states "never fix a bug you dont understand" and this
> OpenSSL "hero" seems to forget that something that seems smart and OK
> now and here can be plain bad and ugly when looked at with some more
> distance or knowledge.

No, he is 100% correct. Vendors "adding value" to security software 
when they lack basic code comprehension skills is simply dangerous to
their users. It is surprising that this should be controversial.

quoted text
> His "Adding uninitialised memory to it can do no harm and might do
> some good, which is why we do it." is pure arrogant and shortsighted
> shit to me.

Congratulations, you have just demonstrated youself to be the same
category of incomprehension as the Debian developers.

-d