Brief items

I'm the maintainer of one of the affected SAML libraries.

People need to stop using SAML. This needs to be a priority. [...]

Obviously this is a crazy approach to one of the most security-critical parts of an application on the internet, and it breaks all the time.

In cases like this I would actually consider to write a bit in the bindings saying "this is inconsistent because we screwed up so be careful", standard bodies usually try to avoid that kind of statements because they have all kind of prestige involved with their work, but we don't so we can just as well admit it.

While we sometimes fall short of some of our technical goals in Debian, and while we don’t always agree on everything, we do tend to make great long-term progress, and usually in the right direction. We’ve proved that our method of building a system together is sustainable, that we can do so reliably and timely and that we can collectively support it. From there on it can only get even better when we join forces and work together, because when either individuals or organisations contribute to Debian, they can use the end result for both private or commercial purposes without having to pay any fee or be encumbered by legal gotchas.