[fragmede]

Why is that worse than the issue itself? If someone could figure out, say, my root password via an ssh timing attack, that seems bad. Sending 100 packets for each keystroke to protect against this seems cheap in the face of that.

[sam_lowry_]

Because it breaks our mental model of how things work.

[skinfaxi]

Or it means it is time to update the model. Models need to change as the world they model changes, right?

[sam_lowry_]

The OpenBSD developers could have opted for a warning, like the one you see about post-quantum encryption when connecting to old servers.

Instead, they just sneaked the change upon the world.