I think I might not have been clear enough in my point. The people at OpenSSH are good, that was not in question. The point I was making is that the "anti-sec m

I think I might not have been clear enough in my point. The people at OpenSSH are good, that was not in question. The point I was making is that the "anti-sec movement" are miles away from trustworthy. Without a confirmation from the actual devs that the current (5.x) versions are OK from the "exploit" I will not be upgrading from the most recent version that is on my distro. Taking a random "hacker" without proof at face value on the internet is not my cup of tea. As randallsquared pointed out here http://news.ycombinator.com/item?id=692344 http://news.ycombinator.com/item?id=692344 it is entirely possible that the latest version has the problem and this is all a social engineering hack to get everyone to upgrade to a compromised version without any data whatsoever.