Re: [9front] [PATCH] libsec: add minimal support for the tls renegotiation extension

[hiro <23hiro@gmail.com>]

> I'm not defending their decision. I just fixed the problem
> months ago and moved on with my life. I was checking in to see
> if you guys still wanted the patch or not.

1) your writeup of this issue is excellent and transparent

2) i agree it's unlikely openssl would listen to us

3) it's pragmatic to implement it and move on.

now this sabotage is well summarized on this mailinglist.

i think it should also be documented in the code and the commit message.
this way, no historian will ever misunderstand the code's existence as
a legitimization of openssl's practices.

errors happen, they can be reverted. but if the integrity of the
openssl developers is damaged, the community will only be able to look
at the summation of such events and find the people responsible and
prevent their continual involvement in this critical core internet
infrastructure.

maybe this is not the tipping point. but we'll get there only if we
keep awareness high. in the long run it will all have to get
addressed.

if anybody from here ever meets an openssl in person, we will have
something to discuss. i find this kind of practice unthinkable for
such an important project.

keep up the fight.