Should compression be opt-in?

[lpirl]

According to this thread, compression can be vulnerable to CRIME/BREACH attacks (if the encrypted data carries public data as well).

I am not into crypto but I guess compression should be opt-in, at least, shouldn't it?

[rndmh3ro]

Hi @lpirl, could you please open this issue in the ssh-baseline repository? The settings made in this role are derived from the tests there and this question is much better placed there.

[lpirl]

Thanks for the hint @rndmh3ro.
This is now dev-sec/ssh-baseline#78