In message <200405172021.QAA14761@Sparkle.Rodents.Montreal.QC.CA>
der Mouse writes:

>> There's no good nor compelling reason for a kernfs alternative to
>> PF_KEY to exist *at all*.
>
>No compelling reason, no.   [...]

Good.  We agree on that.  So why are you yammering about it,
in the classic fashion of ``a person given to unproductive activity''?

The simple fact is that the very existence of the kernfs API to
SPD/SADB (as a partial alternative to the RFC-2367 PF_KEY API) is a
kludge, no more and no less; a workaround for a well-known bug in the
KAME implementation of the PF_KEY API.

The correct response to that is to *fix the damn bug*, not to introduce
an new, ad-hoc nonstandard API, and then *not* fix the PF_KEY API.
Because that's how NetBSD prides itself on doing things.

In other words: the kernfs API should never have existed in the first
place.  Adding bloat -- adding redundant APIs -- merely to meet the
agenda of people who want more bloat/functionality in kernfs, is
simply not relevant to that point.  *That* is where you need to read
for comprehension.


[[ One point I didn't spell out earlier: anyone using IPsec cares
about security. For those who care about security, you start with the
perspective that things are excluded, unless there's some good reason
to put them in. From that perspective, I think the kernfs API should
actively be ripped out. Just compare the kernel hooks required for
kernfs with the corresponding sysctl interface.  ]]