openssh unix dev - Jul 2013 - Bug #866

It's great to see this fixed.  It's too bad that:

a) I didn't have the sense of humor in 2004 to propose KnownUnknowns,
and even UnknownUnknowns (a boolean, natch);

b) you used a different parameter name than SunSSH (which uses IgnoreIfUnknown).

It may not be too late to do something about either of those...  I
think the Oracle folks will have no problem adding IgnoreUnknown as an
alias of IgnoreIfUnknown, so (b) is not a problem.  And humor or lack
thereof is not a problem either.  So there may be nothing to do here,
though if I were at Oracle I'd probably ask you if you could match the
SunSSH parameter just to avoid unnecessary divergence.

I'm actually more interested in knowing why this got fixed now.  I
searched the list archives for discussion of the need for this, but
found nothing in the past two years (I gave up searching then).  Has
NFS (or similar) become more widely used by the dev team?  Were there
off-list requests for this feature?

Nico

PS: I'm Nicolas.Williams at sun.com, or was anyways.

On Tue, 30 Jul 2013, Nico Williams wrote:
> I'm actually more interested in knowing why this got fixed now.  I
> searched the list archives for discussion of the need for this, but
> found nothing in the past two years (I gave up searching then).  Has
> NFS (or similar) become more widely used by the dev team?  Were there
> off-list requests for this feature?
Why now? The proliferation of vendor packages that patch in things like
GSSAPI-KEX and have default configurations that enable them explicitly.
It makes it quite difficult to use custom-compiled packages of OpenSSH
on these systems.

For the record, I think turning on the attack surface of GSSAPI by
default is a Very Bad Decision all by itself.

-d