OpenSSH 5.0 released

> However, to my mind the real fault here lies with XXX

I think it was rather a unfortunate chain of multiple human errors. Blaming a sigle point
misses the whole point, when fiasco could have been avoided had almost anyone in the chain of
events not done their mistake:

x) confusing ipv4/ipv6 behaviour on socket bind

If someone as experienced as openssh developers fall to this, how many other will/have done
the same mistake? This api does not seem to follow the principle of least surprise.

x) openssh developers creating the bug

Not fully understanding the api you are using is quite common source of security problems.
Requesting an tcp listening socket and then telling X to connect to the ipv4 address via
$DISPLAY might seem reasonable to assume safe when ipv6 doesn't pop into your mind.

x) fedora fixing the bug without realizing the the security implications

Has also happened often before. Especially when dealing with software as critical to security
as openssh, every bug should be considered as a security bug until proven wrong. It is
unfortunate that distributions hold bugfixes in their packages without pushing them upstream..

x) reporting the security bug to debian via inproper channel

For a enduser, finding out the proper way of reporting bugs is hard enough.  Now it requires
even more to find out that there is a separate channel or security issues. Now documentation
might help but most people don't read them anyway. debbugs could support security bugs better
(as it already supports the security tag the user was properly using..)

x) reporting it to wrong upstream contact

Different person than above, but basically the same mistake.

x) Debian security not watching "security" tagged bugs closely.

Presumably caused by lack of manpower.

x) pushing the update to Debian not via the security channel

While it was somewhat reasonable to expect that people before him in buglog had contacted the
upstream properly, A bigger mistake was to upload to unstable directly instead notifying
debian security team to do security uploads to stable and testing.

--

While the specific people have probably learned by now and will not repeat their mistake(s),
new people will join and eventually do similar mistakes. It's quite hard to avoid human
mistakes without same time making contributing inhumanly hard.