No, he hasn't. A question posed to a predominatly users' mailing list is
not the same as a proper bug report and patch submission. Vendors,
especially the size of Debian, should be held to a high standard of
behaviour. Critically, he didn't identify that he was considering removing
these lines *for every user of Debian*.
> and I know personally of another totally
Speaking as someone who has done the last two revs of the OpenBSD libssl,
I haven't tried to upstream our changes - they OpenBSD specific things
like using /dev/arandom and /dev/crypto. I think that any serious patch
we sent would have a good chance of inclusion.
> The OpenSSL maintainers have proven not to read their mail, they aren't
No, he is 100% correct. Vendors "adding value" to security software
when they lack basic code comprehension skills is simply dangerous to
their users. It is surprising that this should be controversial.
> His "Adding uninitialised memory to it can do no harm and might do
Congratulations, you have just demonstrated youself to be the same
category of incomprehension as the Debian developers.
