https://bugzilla.mindrot.org/show_bug.cgi?id=764
ilf <[email protected]> changed: What |Removed |Added ---------------------------------------------------------------------------- Version|3.7.1p1 |-current CC| |[email protected] --- Comment #20 from ilf <[email protected]> --- I'd like to reopen this. More than ten years after the initial debate, the world is a different one. After Snowden, we know that nation-state actors at the same time kill people based on metadata and targed Angry Birds. So we should do all we can to minimize revealing metadata by default, or at least have the option to do so. Over in Debian, there's a similar Bug [0], which states that this version string "is used as a selector in NSA's XKEYSCORE queries in conjunction with the metadata database of potentially exploitable services (BLEAKINQUIRY) by the NSA group 'S31176' for targeted exploit and compromise [1][2]". I respect the argument, that it might be "necessary to use the version for protocol compatibility tweaks". So keep it in, and leave it enabled by default. But I see no reason why an operator if an SSHd should not be able to disable it, if (s)he is confident that his/her own clients can or must handle it. (Afterall, there are many config options which can lock out lots of clients - see Ciphers/MACs and mobile clients.) So please reconsider an optional setting to disable (or edit) the remote software version string. 0. https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=786987#50 1. http://www.spiegel.de/international/germany/inside-the-nsa-s-war-on-internet-security-a-1010361.html 2. http://www.spiegel.de/media/media-35515.pdf -- You are receiving this mail because: You are the assignee for the bug. You are watching someone on the CC list of the bug. _______________________________________________ openssh-bugs mailing list [email protected] https://lists.mindrot.org/mailman/listinfo/openssh-bugs
