OpenSSH 7.4 released
openssh.com
OpenSSH 7.4 released
1–10 of 43 posts
Re: OpenSSH 7.4 released
#2Why isn't openssh.com served over https ?
You'd think it would be, given where it comes from, who those people are and what it is. (tone: I'm just surprised)
Re: OpenSSH 7.4 released
#3Why isn't openssh.com served over https ? You'd think it would be, given where it comes from, who those people are and what it is. (tone: I'm just surprised)
https works as well: https://www.openssh.com/txt/release-7.4
Maybe submitter here on HN just put http. Would be better if it did the redirect automatically though.
Re: OpenSSH 7.4 released
#4Why isn't openssh.com served over https ? You'd think it would be, given where it comes from, who those people are and what it is. (tone: I'm just surprised)
https works as well: https://www.openssh.com/txt/release-7.4 Maybe submitter here on HN just put http. Would be better if it did the redirect automatically though.
Yes it would certainly be better :)
Thank you, I didn't think to manually check as I assumed it would have redirected me.
Re: OpenSSH 7.4 released
#5It's good to see support for obsolete features and weak crypto being removed.
Does anyone know why there is no support for Curve448 being added? There is a draft RFC at https://tools.ietf.org/html/draft-ietf-curdle-ssh-curves-00 describing this, together with SHA-512.
Previous versions of OpenSSH have already supported the privately defined "curve25519-sha256@libssh.org" key exchange protocol.
Re: OpenSSH 7.4 released
#6Earlier quoted context omitted.
https works as well: https://www.openssh.com/txt/release-7.4 Maybe submitter here on HN just put http. Would be better if it did the redirect automatically though.
Yes it would certainly be better :) Thank you, I didn't think to manually check as I assumed it would have redirected me.
It does redirect for me, thanks to HTTPS everywhere ;-)
Re: OpenSSH 7.4 released
#7Why isn't openssh.com served over https ? You'd think it would be, given where it comes from, who those people are and what it is. (tone: I'm just surprised)
https works as well: https://www.openssh.com/txt/release-7.4 Maybe submitter here on HN just put http. Would be better if it did the redirect automatically though.
Observation: their CA is Let's Encrypt
Re: OpenSSH 7.4 released
#8Openssh is one of the pieces of software that I would argue needs to be kept up to the latest and greatest regardless of the original version shipped by the distro.
I would similarly push for latest version of OpenSSL but that's harder to get right.
Re: OpenSSH 7.4 released
#9Why isn't openssh.com served over https ? You'd think it would be, given where it comes from, who those people are and what it is. (tone: I'm just surprised)
It would be if you were using HTTPS Everywhere.
Re: OpenSSH 7.4 released
#10Openssh is one of the pieces of software that I would argue needs to be kept up to the latest and greatest regardless of the original version shipped by the distro. I would similarly push for latest version of OpenSSL but that's harder to get right.
Right now distros who backport, such as Debian, need to very carefully read changelogs and decide what and what not to backport. Quite a daunting task.