Hello, I am a researcher measuring how post-quantum key exchange is being adopted across public TLS and SSH endpoints. https://www.google.com/url?q=http://git.haproxy.org&source=gmail&ust=1786908484334000&sa=E appears in my results, and since my paper names it, I wanted to give you a heads-up before publication and offer you the underlying record.
I am sending this to the public list because it is the contact channel https://www.google.com/url?q=http://haproxy.org&source=gmail&ust=1786908484334000&sa=E publishes. Nothing here is sensitive, so a public archive is fine by me, but I wanted to say so plainly rather than have it look like a misdirected report. What I observed, from a single rate-limited connection to the public endpoint: your SSH endpoint runs OpenSSH 8.9p1 (Ubuntu 3ubuntu0.15) and offers the post-quantum hybrid [email protected] without preferring it, while TLS on the same host negotiates classical key exchange. This is not a vulnerability. It involves no credentials and no private data, only the key exchange algorithms the endpoint advertises during a handshake. The pattern is what my paper is actually about: three unrelated operators show this same banner and the same posture, which points at a distribution default rather than at anyone's configuration decision. I am not asking for anything. This is a courtesy so the finding does not reach you first through the paper. If you would like the full record, or want to flag a concern with how it is described, I am glad to hear it before I post. Best regards, Azhad Shahzad Shaik [email protected] | ORCID 0009-0009-6450-5837
