Re: Kerberos security vulnerability in SSH-1.2.27

[jts28 () CORNELL EDU (Schlachter, Jake)]

Just posting to note that there is indeed a ssh-1.2.28 release, but lo!
also a 1.2.29. The .28 release's ChangeLog is identical to the old .27, but
the .29 lists the Kerberos fix, as well as... an update to the License.
It appears that 1.2.29 (and, likely, following 1.x versions) will now be
governed by the much more strict Version 2.x license. This means that
unless you are a student who does not actually use ssh, you will most
likely be paying for it. ssh has quite a large following, and it is my
understanding that SSH Communications Security tried changing the 1.x
license once before, but a massive negative community action stayed their
hand.

Options: qualify under the new lower wire, buy a commercial license, use
an old version, switch to OpenSSH or another variant, or perhaps, by
speaking with the voice of community, remind SSH of the intangible
benefits of being part of that community...

Question for the Group: isn't the version 1.x license the only reason for
the 1.5 protocol's continued use? (aside from compatibility reasons,
which could probably be cleaned up were it not for the ver 2.x license)

Regards,
jts28