Re: Terrapin

>> (a) As I understand it, OpenSSH's "strict kex" is, currently, using
>> an @openssh.com name.  Such experiments are what @fqdn extension
>> names are _for_.
> Right, but because of OpenSSH's dominance in the market, their
> experiments end up being de facto MUST's for everyone else.  This is
> what happened with EtM- OpenSSH, it got set as the only permitted
> mode by OpenSSH and/or some major distros and then everyone had to
> implement it whether they wanted to or not because without it they
> couldn't interoperate with a pile of servers.

Curious; I'm moderately sure I don't implement any
packet-length-in-the-clear mode, and I've interoperated with a bunch of
recently-installed Linux boxen without running into any algorithm
choice trouble.

But this is really a human-layer bug.

One point of view is that the problem is that there's a single
implementation in that dominant a position.  (I don't like
monocultures; the only monoculture I can think of offhand that I don't
consider a major problem is ASCII's dominance, and that I consider at
least a minor problem).

Another point of view is that _far_ too few people are willing to say
"I don't care how much of a monopoly they are, it's still broken;
reconfigure, fix, or replace it".  (I actually see this as an aspect of
the net being invaded by suits; this is just one of many cases where
corporate (or corporate-style) "I don't care about technical, just make
it talk to them" happens, overriding "but they're the oens who aren't
conforming to the spec" and leading to the standards being little more
than suggestions in practice.)

/~\ The ASCII				  Mouse
\ / Ribbon Campaign
 X  Against HTML		[email protected]
/ \ Email!	     7D C8 61 52 5D E7 2D 39  4E F1 31 3E E8 B3 27 4B