Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Fun with Kermit and ZMODEM over SSH

cambus.net

Post reply on HN
Print view View original

51–60 of 110 posts

Re: Fun with Kermit and ZMODEM over SSH

#51

Post by rsync »

So, on the one hand ...

I have actually used 'sz' and 'rz' in relatively modern times for quick and dirty file transfer and found it very convenient in a very narrow set of use-cases.

However ...

It's a serious violation of the cleanliness and available attack surface involved in a terminal interface and we should be on the lookout for, and reject, similar interfaces and applications.

In order for zmodem to work over the terminal, the terminal program itself needs to know something about the text flowing over the connection and then invoke special, extra routines based on monitoring that textual flow.

This opens up all manner of weird, extra attack surface.

The beauty of the text terminal is that I can, theoretically, cat any file I want to without fear of what it contains. I can open up (perhaps with 'strings' or 'hexedit') any email attachment without fear of the strings that it contains. I can do this because I am using a dumb terminal.

As soon as the terminal is smart - even a little bit - you've got vectors for weird strings doing things you don't want them to.

Re: Fun with Kermit and ZMODEM over SSH

#52

Post by nrclark »

geocrasher wrote: post #44
YesThatTom2 wrote: post #26

sz and rz! Such good memories.

I came here to say this. I still think rz and sz should be supported everywhere. Even now, I can't tell you how many times I wish I could grab a file straight form the terminal. We lost something when we stopped using zmodem. (and for the record, yes, I do know about all the other things that aren't saving a file direct from the terminal)

On the off-chance that your use-case is "minicom to some Linux serial-console", you might be surprised to learn that minicom has rz/sz support built right into it! Assuming that your remote device has lrzsz installed, you can copy files right through your terminal, exactly like you're describing. It's certainly not the fastest transfer-rate, but it's handy in a pinch.

Re: Fun with Kermit and ZMODEM over SSH

#53

Post by blueflow »

rsync wrote: post #51

So, on the one hand ... I have actually used 'sz' and 'rz' in relatively modern times for quick and dirty file transfer and found it very convenient in a very narrow set of use-cases. However ... It's a serious violation of the cleanliness and available attack surface involved in a terminal interface and we should be on the lookout for, and reject , similar interfaces and applications. In order for zmodem to work ove…

I have bad news for you. Do you know what (n)curses is for? Its basically a library for those magic strings (and ascii control characters) that run extra routines in the terminal. And every terminal has these routines.

Re: Fun with Kermit and ZMODEM over SSH

#54

Post by somat »

distantsounds wrote: post #46

lrzsz is one of the first packages i install when configuring a new system. being able to send and receive files between remote and local without needing a separate ssh session is such a time saver. it's really fast as well. i do wonder if anyone has developed something more modern to make it even more performant?

I have used bare netcat to transfer files. works well enough when the link is good, when it's not... Well I suspect that is when you dig out better tools.

nc -l 1234 > fname

nc host 1234 < fname

Re: Fun with Kermit and ZMODEM over SSH

#55

Post by mbreese »

blueflow wrote: post #53
rsync wrote: post #51

So, on the one hand ... I have actually used 'sz' and 'rz' in relatively modern times for quick and dirty file transfer and found it very convenient in a very narrow set of use-cases. However ... It's a serious violation of the cleanliness and available attack surface involved in a terminal interface and we should be on the lookout for, and reject , similar interfaces and applications. In order for zmodem to work ove…

I have bad news for you. Do you know what (n)curses is for? Its basically a library for those magic strings (and ascii control characters) that run extra routines in the terminal. And every terminal has these routines.

As I see it, the parent is specifically worried about the terminal needing to monitor input and fork a process in response. Control character handling should be pretty robust (or worst-case, a NOP). Curses-based programs read/write specific control characters to move the cursor, etc (really any tty should support control characters).

But they don’t fork a new process… (unless I’m very mistaken).

Re: Fun with Kermit and ZMODEM over SSH

#56

Post by RobotToaster »

Sohcahtoa82 wrote: post #29
yjftsjthsd-h wrote: post #15

Earlier quoted context omitted.

Thanks for the laugh (but also kind of serious) - reminds me of https://xkcd.com/2221/ (what a fast floppy drive you have!)

Now I'm wondering if there's ever been emulated software that crashed because it tried to calculate a data transfer rate, but the emulator transferred the data faster than the delta in the time measuring in the emulated machine, so it divided by zero.

Not emulated as such, but I seem to remember certain old computers having problems with compact flash adapters replacing the hard drive because they were too fast.

Re: Fun with Kermit and ZMODEM over SSH

#57

Post by blueflow »

mbreese wrote: post #55
blueflow wrote: post #53

Earlier quoted context omitted.

I have bad news for you. Do you know what (n)curses is for? Its basically a library for those magic strings (and ascii control characters) that run extra routines in the terminal. And every terminal has these routines.

As I see it, the parent is specifically worried about the terminal needing to monitor input and fork a process in response. Control character handling should be pretty robust (or worst-case, a NOP). Curses-based programs read/write specific control characters to move the cursor, etc (really any tty should support control characters). But they don’t fork a new process… (unless I’m very mistaken).

See xterm manpage, "printerCommand" or urxvt manpage, "print-pipe". They may be triggered remotely by the media copy commands. Good news is, this is supposed to be disabled per default.

Re: Fun with Kermit and ZMODEM over SSH

#58

Post by anthk »

mikecoles wrote: post #7
mikecoles wrote: post #3

The article mentions 'Terminate'. That software was a joy to use. https://web.archive.org/web/19980627010642/http://www.termin...

Checking up on other old favorites such as BitchX/irssi and slrn, I found they're still being developed: slrn --- NNTP/spool-based Usenet newsreader last updated: 2023-03-18T04:31:51 [UTC] repository: git://git.jedsoft.org/git/slrn.git tarfile: slrn-pre1.0.4-9.tar.gz ( size: 1563860 bytes; md5: f193d983e104a82ef4fd70b1037f8b60 ) github: https://github.com/jedsoft/slrn https://github.com/BitchX/BitchX1.3 https://irssi…

I use SLRN daily.

Re: Fun with Kermit and ZMODEM over SSH

#59

Post by anthk »

poettering wrote: post #42

Still would love if desktop terminal emulators would implement the zmodem receiver side, so that you can ssh into some host of your choice and just type "sz" to copy arbitrary files of your choice onto your local system.

Just use sshfs, or rclone mount, and use the old

     cp -r
to get your files. MC can connect to ssh/ftps too, and you can copy files and dirs from pane to pane.

Re: Fun with Kermit and ZMODEM over SSH

#60

Post by blueflow »

mikecoles wrote: post #7
mikecoles wrote: post #3

The article mentions 'Terminate'. That software was a joy to use. https://web.archive.org/web/19980627010642/http://www.termin...

Checking up on other old favorites such as BitchX/irssi and slrn, I found they're still being developed: slrn --- NNTP/spool-based Usenet newsreader last updated: 2023-03-18T04:31:51 [UTC] repository: git://git.jedsoft.org/git/slrn.git tarfile: slrn-pre1.0.4-9.tar.gz ( size: 1563860 bytes; md5: f193d983e104a82ef4fd70b1037f8b60 ) github: https://github.com/jedsoft/slrn https://github.com/BitchX/BitchX1.3 https://irssi…

I'm using irssi right now! There are still active irc communities.
Post reply on HN