31–40 of 88 posts
Earlier quoted context omitted.
I stand to be corrected, but I’m pretty sure Mosh uses SSH under the hood. Perhaps Mosh could be modified to support Oxy?
Mosh only uses SSH to setup the initial connection, when the handshake between server and client has been created SSH is no longer used.
This is interesting, but shows some of the problems with the word "secure" The app. promises to be more secure than OpenSSH and provides a number of reasons why it thinks it will be. However the site is entirely anonymous, so you have no idea who wrote this tool and what their affiliations or background are. So either you audit the code to get some assurance, or you trust the author(s) without any evidence. Also the…
It's super fun to play with cryptography, but giving a false confidence to users who may seriously rely on it is what can lead to major problems.
I'm not a security expert, so could one of the security experts who frequent HN weigh in on this? Otherwise this looks super cool.
>Upon successful verification of the signature contained in the third message (and verification that the eight-byte timestamp is current), the server proceeds to send three symmetrical messages: a long term server public key, an ephemeral server public key, and a signature message authenticating the ephemeral key.
This might be vulnerable to replay attacks. The user proves freshness of his request by sending a signed unix timestamp, the server however doesn't seem to do that.
Shouldn't compromise the security of the protocol, just one thing that I noticed.
This is interesting, but shows some of the problems with the word "secure" The app. promises to be more secure than OpenSSH and provides a number of reasons why it thinks it will be. However the site is entirely anonymous, so you have no idea who wrote this tool and what their affiliations or background are. So either you audit the code to get some assurance, or you trust the author(s) without any evidence. Also the…
...and 10 lines of css would be nice.
This is interesting, but shows some of the problems with the word "secure" The app. promises to be more secure than OpenSSH and provides a number of reasons why it thinks it will be. However the site is entirely anonymous, so you have no idea who wrote this tool and what their affiliations or background are. So either you audit the code to get some assurance, or you trust the author(s) without any evidence. Also the…
I'd consider it primarily a source release. Since source is available, of course you should audit it, or at least glance over it before compiling.
Really? I don't think everybody auditing the source of the apps we use is at all realistic, and I don't think glancing at the source is worthwhile.
Barring an organized audit, I think confidence in an open source tools like this just comes with popularity, rightly or wrongly.
This is interesting, but shows some of the problems with the word "secure" The app. promises to be more secure than OpenSSH and provides a number of reasons why it thinks it will be. However the site is entirely anonymous, so you have no idea who wrote this tool and what their affiliations or background are. So either you audit the code to get some assurance, or you trust the author(s) without any evidence. Also the…
I'd consider it primarily a source release. Since source is available, of course you should audit it, or at least glance over it before compiling.
Since source is available, of course you should audit it, or at least glance over it before compiling.
- Does this have the buffer limitations for file transfer that ssh has? i.e. Can I send near wire speed?
- Which independent third party pen testing and code validation groups have reviewed this?
- Since this does not depend on rsync helpers for file transfers, are there any plans to add multipart transfers similar to lftp's p-get or other mirror sub-system functions? i.e. split a 40gb file into 20 chunks / streams.
- Is the UDP knocker optional? I can think of places that won't work. Captive portals, hotels, some airports, some public wifi, some corp networks.
- What setcap capabilities does this require?
- Any plans to add modules or helpers for things like U2F?
- Any thoughts on centralized management of key trusts? that is the biggest gap in openssh that I know of and the original author of ssh acknowledges. i.e. "who" is really logging in as "who", "where" and how old is that key?
Earlier quoted context omitted.
> Definition of guy > 1 a : man, fellow > b : person —used in plural to refer to the members of a group regardless of sex > saw her and the rest of the guys From https://www.merriam-webster.com/dictionary/guy
I don't know that you read the definition you just quoted as carefully as you think you did.
Earlier quoted context omitted.
> Definition of guy > 1 a : man, fellow > b : person —used in plural to refer to the members of a group regardless of sex > saw her and the rest of the guys From https://www.merriam-webster.com/dictionary/guy
I don't know that you read the definition you just quoted as carefully as you think you did.