1 files changed, 9 insertions, 0 deletions

diff --git a/debian/README.Debian b/debian/README.Debian
index cb1444a47..4f076f898 100644
--- a/debian/README.Debian
+++ b/debian/README.Debian
@@ -115,6 +115,15 @@ As of OpenSSH 3.1, the remote $DISPLAY uses localhost by default to reduce
 the security risks of X11 forwarding. Look up X11UseLocalhost in
 sshd_config(8) if this is a problem.
 
+OpenSSH 3.8 invented ForwardX11Trusted, which when set to no causes the
+ssh client to create an untrusted X cookie so that attacks on the
+forwarded X11 connection can't become attacks on X clients on the remote
+machine. However, this has some problems in implementation - notably a
+very short timeout of the untrusted cookie - breaks large numbers of
+existing setups, and generally seems immature. The Debian package
+therefore sets the default for this option to "no" (in ssh itself,
+rather than in ssh_config).
+
 Fallback to RSH
 ---------------