On Sat, Mar 29, 2014 at 11:31 PM, hasufell <[email protected]> wrote: > We have had those debates whether the "+" should follow upstream > decisions and such. Short answer: the maintainer decides. There is no > consistency for this and there will never be.
That may be true, I still think it behooves us to be particularly careful about including non-upstream patches on extremely sensitive software such as openssh, so I don't think saying "maintainer decides" is a good enough response to Toralf's questions. On Mon, Mar 31, 2014 at 1:15 AM, Duncan <[email protected]> wrote: > Gentoo has never pretended to be a hand-holding distribution (tho it > seems to be getting rather more so these days); gentooers ignoring that > recommendation... get to keep the pieces. =:^) While I can see where you're coming from, that doesn't mean the Gentoo developers shouldn't provide sensible defaults. If we load up all Gentoo systems with an insecure OpenSSH by default, saying "ah, you should have fixed the configuration" is just a cop-out. So, I'm interested... How widely used is the HPN patch set? Are there any good indications that it doesn't negatively impact security? Cheers, Dirkjan
