On 5/13/08 7:08 PM, Marc Espie wrote:
More details show that someone seriously fucked up in debian.
Well, this Kurt has seriously asked for details on the relevant
openssl-dev list:
http://marc.info/?l=openssl-dev&m=114651085826293&w=2
And see what "arrogant as usual" Ben Laurie states:
http://www.links.org/?p=327
"they should contribute their patches upstream to the package
maintainers. Had Debian done this in this case, we (the OpenSSL Team)
would have fallen about laughing, and once we had got our breath back,
told them what a terrible idea this was."
Kurt has clearly done so, and I know personally of another totally
ignored patch from our company and I have heard in the past about
OpenBSD people trying to send patches to OpenSSL maintainers to no avail.
The OpenSSL maintainers have proven not to read their mail, they aren't
interested in cleaning up their big mess.
Laurie also states "never fix a bug you dont understand" and this
OpenSSL "hero" seems to forget that something that seems smart and OK
now and here can be plain bad and ugly when looked at with some more
distance or knowledge.
His "Adding uninitialised memory to it can do no harm and might do some
good, which is why we do it." is pure arrogant and shortsighted shit to me.
+++chefren
