Earlier quoted context omitted.
HTTPSSH. Why not just SSH/QUIC, what does the HTTP/3 layer add that QUIC doesn’t already have?
QuickShell - it should be called
QSH?
SSH3: Faster and rich secure shell using HTTP/3
141–150 of 276 posts
Re: SSH3: Faster and rich secure shell using HTTP/3
#142> Establishing a new session with SSHv2 can take 5 to 7 network round-trip times, which can easily be noticed by the user. SSH3 only needs 3 round-trip times. The keystroke latency in a running session is unchanged. Bummer. From a user perspective, I don't see the appeal. Connection setup time has never been an annoyance for me. SSH is battle-tested. This feels risky to trust, even whenever they end up declaring it p…
If you are looking for a smoother UX: https://mosh.org/
Re: SSH3: Faster and rich secure shell using HTTP/3
#143Re: SSH3: Faster and rich secure shell using HTTP/3
#144Earlier quoted context omitted.
> use our single company identity we use for every single service for SSH as well How would that even work? Do you open your browser, log in, and then somehow transfer the session into your ssh client in a terminal? Does the browser assimilate the terminal? And let me remind you, HTTP authentication isn't a login form. It's the browser built-in "HTTP username + password" form and its cousins. We're talking HTTP 401.…
> How would that even work? Do you open your browser, log in, and then somehow transfer the session into your ssh client in a terminal? Does the browser assimilate the terminal? That's pretty well covered in RFC8628 and doesn't even require a browser on the same device where the SSH client is running. > And let me remind you, HTTP authentication isn't a login form. It's the browser built-in "HTTP username + password"…
Everything you've said is true for web authentication, and almost nothing of what you said is true for HTTP authentication.
This is HTTP authentication: https://httpd.apache.org/docs/2.4/mod/mod_auth_basic.html
https://github.com/francoismichel/ssh3/blob/5b4b242db02a5cfb...
https://www.iana.org/assignments/http-authschemes/http-auths...
Note the OAuth listed there is OAuth 1.0. Support for "native" HTTP authentication was removed in OAuth 2.0.
This discussion is about using HTTP authentication. I specifically said HTTP authentication in the root post. If you want to do SSH + web authentication, that's a different thread.
Rule of thumb: if you need HTML in any step of it —and that includes as part of generating a token— it's web auth, not HTTP.
Re: SSH3: Faster and rich secure shell using HTTP/3
#145Earlier quoted context omitted.
> Do you open your browser, log in, and then somehow transfer the session into your ssh client in a terminal? You start the ssh client in the terminal, it opens a browser to authenticate, and once you're logged in you go back to the terminal. The usual trick to exfiltrate the authentication token from the browser is that the ssh client runs an HTTP server on localhost to which you get redirected after authenticating.
That, or the SSH client opens a separate connection to the authorization server and polls for the session state until the user has completed the process; that would be the device code grant, which would solve this scenario just fine.
You're both talking about web authentication, not HTTP authentication. cf. https://news.ycombinator.com/item?id=45399594
Re: SSH3: Faster and rich secure shell using HTTP/3
#146I do hate the name ssh3. I was glad to see this at the top of the repo: > SSH3 is probably going to change its name. It is still the SSH Connection Protocol (RFC4254) running on top of HTTP/3 Extended connect, but the required changes are heavy and too distant from the philosophy of popular SSH implementations to be considered for integration. The specification draft has already been renamed ("Remote Terminals over H…
Same - this feels equivalent of some rando making a repo called "Windows 12" or "Linux 7".
C.f. “JSON5”.
Re: SSH3: Faster and rich secure shell using HTTP/3
#147> Establishing a new session with SSHv2 can take 5 to 7 network round-trip times, which can easily be noticed by the user. SSH3 only needs 3 round-trip times. The keystroke latency in a running session is unchanged. Bummer. From a user perspective, I don't see the appeal. Connection setup time has never been an annoyance for me. SSH is battle-tested. This feels risky to trust, even whenever they end up declaring it p…
If you are looking for a smoother UX: https://mosh.org/
Sadly this project looks dead.
Re: SSH3: Faster and rich secure shell using HTTP/3
#148I do hate the name ssh3. I was glad to see this at the top of the repo: > SSH3 is probably going to change its name. It is still the SSH Connection Protocol (RFC4254) running on top of HTTP/3 Extended connect, but the required changes are heavy and too distant from the philosophy of popular SSH implementations to be considered for integration. The specification draft has already been renamed ("Remote Terminals over H…
HTTP3 Shell or H3S
Re: SSH3: Faster and rich secure shell using HTTP/3
#149Re: SSH3: Faster and rich secure shell using HTTP/3
#150> Establishing a new session with SSHv2 can take 5 to 7 network round-trip times, which can easily be noticed by the user. SSH3 only needs 3 round-trip times. The keystroke latency in a running session is unchanged. Bummer. From a user perspective, I don't see the appeal. Connection setup time has never been an annoyance for me. SSH is battle-tested. This feels risky to trust, even whenever they end up declaring it p…
> Connection setup time has never been an annoyance for me.
It has always bothered me somewhat. I sometimes use ssh to directly execute a command on a remote host.