Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

SSH3: Faster and rich secure shell using HTTP/3

github.com

Post reply on HN
Print view View original

81–90 of 276 posts

Re: SSH3: Faster and rich secure shell using HTTP/3

#81

Post by Fnoord »

Written in Go. Terrible name, already discussed in various other comments and author acknowledges.

The secret path, otherwise giving 404 would need brute-force protection (on HTTPd level?). I think it is easier to run SSH on a non-standard port on IPv6, but it remains true that anyone with network read access between the endpoints can figure it out.

What isn't explained is why would one care about 100 ms latency during auth? I rather have mosh which has resuming support and will work on high latency (tho IIRC won't work over TOR?). But even then, with LTE and NG, my connections over mobile have become very stable here in NL (YMMV).

Re: SSH3: Faster and rich secure shell using HTTP/3

#82

Post by theandrewbailey »

throwaway127482 wrote: post #69
theandrewbailey wrote: post #47

Earlier quoted context omitted.

Maybe SSH/3 instead ( SSH + HTTP /3 )?

Doesn't /3 mean v3? I mean, for HTTP itself, doesn't the HTTP/3 == HTTPv3? If so, I don't see how this is any better than SSH3 - both SSH3 and SSH/3 read to me like "SSH v3"

Yes, but HTTP is about the only thing that versions with a slash. By writing it SSH/3, it would emphasize its relationship with HTTP/3, instead of it being the third version of SSH.

Re: SSH3: Faster and rich secure shell using HTTP/3

#85

Post by temp0826 »

oofbey wrote: post #75
temp0826 wrote: post #5

I don't know why it makes me a little sad that every application layer protocol is being absorbed into http.

I hear you that it feels like something is off. The lack of diversity feels like we're losing robustness in the ecosystem. But it can be a good thing too. A lot of security issues are concentrated into one stack that is very well maintained. So that means everything built on top of it shares the same attack surface. Which yes means it can all come crashing down at once, but also that there are many eyes looking for v…

Humbug. I feel an urge to implement token ring over fiber. Excuse me while I yell at clouds.

Re: SSH3: Faster and rich secure shell using HTTP/3

#86

Post by [deleted] »

theandrewbailey wrote: post #82
throwaway127482 wrote: post #69

Earlier quoted context omitted.

Doesn't /3 mean v3? I mean, for HTTP itself, doesn't the HTTP/3 == HTTPv3? If so, I don't see how this is any better than SSH3 - both SSH3 and SSH/3 read to me like "SSH v3"

Yes, but HTTP is about the only thing that versions with a slash. By writing it SSH/3, it would emphasize its relationship with HTTP/3, instead of it being the third version of SSH.

[deleted]

Re: SSH3: Faster and rich secure shell using HTTP/3

#87

Post by axiolite »

eqvinox wrote: post #66

I feel like this should really be SSH over QUIC, without the HTTP authorization mechanisms. Apart from the latter not really being used at all for users (only for API calls, Bearer auth), shell logins have a whole truckload of their own semantics. e.g. you'd be in a rather large amount of pain trying to wire PAM TOTP (or even just password+OTP) into HTTP auth…

That has been around for years:

https://github.com/moul/quicssh

Re: SSH3: Faster and rich secure shell using HTTP/3

#88

Post by s-macke »

thayne wrote: post #74
s-macke wrote: post #23

Earlier quoted context omitted.

It is not faster in this sense. However, an SSH connection can have multiple substreams, especially for port forwarding. Over a single classical connection, this can lead to head-of-line blocking, where an issue in one stream slows everything down. QUIC/HTTP3 protocol can solve this.

Does this implementation do that do, or does it just use a single h3 stream?

The answer is yes according to code and documentation [0]:

> The stream multiplexing capabilities of QUIC allow reducing the head-of-line blocking that SSHv2 encounters when multiplexing several SSH channels over the same TCP connection

....

> Each channel runs over a bidirectional HTTP/3 stream and is attached to a single remote terminal session

[0] https://www.ietf.org/archive/id/draft-michel-remote-terminal...

Re: SSH3: Faster and rich secure shell using HTTP/3

#89

Post by axiolite »

ur-whale wrote: post #54

Knee-jerk reaction: if it aint broke ...

Telnet, FTP and rlogin wasn't broke, either. They had their own encrypted variants before SSH came along.

Listing all the deficiencies of something, and putting together a thing that fixes all of them, is the kind of "designed by committee" project that everyone hates. Real progress requires someone to put together a quick project, with new features they think are useful, and letting the public decide if it is useful or not.

Re: SSH3: Faster and rich secure shell using HTTP/3

#90

Post by rootnod3 »

Don't get me wrong, this might likely be a fantastic tool. But something as essential as a secure connection would definitely need a good pair of eyes for audit before I'd use that for anything in production.

But it's a good start. Props to exploring that kind of space that needs improvement but is difficult to get a foothold in.

Post reply on HN