you have to change your sf.net password - you should have received an email from sf.net about an attacking attempt and that they forced every user to change his password.
about the patch - why only curl and sdl? shouldn't it maybe be the default for every other, too. i would also have to check this against mingw-cross-env before i would apply such a change.