Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

OpenSSH for Windows update

blogs.msdn.com

Post reply on HN
Print view View original

131–140 of 146 posts

Re: OpenSSH for Windows update

#131

Post by ionised »

daveloyall wrote: post #49
PlzSnow wrote: post #35

Earlier quoted context omitted.

No.

Sorry, I don't understand this response. Are you saying that you are familiar with the events that DonnyV is referring to but you are confident that they are mere legend? That you disagree with the published accounts? Or are you saying that you are not familiar with that particular scandal, you've never heard of it, and your response is simply "Not that I know of."?

If you check his post history he basically just blanket denies everything relating to the Snowden NSA leaks and accuses people of believing in 'magic' when they discuss the agency's capabilities.

Re: OpenSSH for Windows update

#132

Post by PlzSnow »

ionised wrote: post #131
daveloyall wrote: post #49

Earlier quoted context omitted.

Sorry, I don't understand this response. Are you saying that you are familiar with the events that DonnyV is referring to but you are confident that they are mere legend? That you disagree with the published accounts? Or are you saying that you are not familiar with that particular scandal, you've never heard of it, and your response is simply "Not that I know of."?

If you check his post history he basically just blanket denies everything relating to the Snowden NSA leaks and accuses people of believing in 'magic' when they discuss the agency's capabilities.

That's not true at all. I question it when people post conspiracy theory stuff with no evidence whatsoever. HackerNews is not that type of website, and I hope it never degenerates into it.

Re: OpenSSH for Windows update

#133

Post by pjmlp »

teacup50 wrote: post #74
antics wrote: post #56

Earlier quoted context omitted.

SUA was not half-baked, this is a very, very hard problem. There is a very serious difference in the way POSIX and Windows model a lot of really important OS primitives, from asynchronicity model in signals, to the semantics of syscalls like `fork`. Every process using these primitives on POSIX has specific behavior defined under those primitives, and if you don't choose _exactly_ the right behavior on the POSIX subs…

Microsoft does control the kernel, and given that, none of this stuff is particularly complicated. As for choosing "_exactly_ the right behavior" ... the whole point of POSIX is to clearly define the exact right behavior!

Which for everyone that has written code across UNIX systems knows it has quite some issues across systems that are supposed to share some kind of common architecture.

Even worse when the architecture is completely different.

Re: OpenSSH for Windows update

#134

Post by ryanlol »

daveloyall wrote: post #71
nailer wrote: post #65

Earlier quoted context omitted.

The main aim is to be useful . Someone who wants to lookup Whois is better served by giving them something that will achieve that task. If you have other suggestions though, send a pull request. The project has already gotten a bunch from the SmartOS and FreeBSD communities.

If I could send a pull request to Microsoft for inclusion of a legit whois binary on their OS--nope, you're right, I'm just full of spite on this subject. :)

Actually, pretty sure most linux distributions don't ship with the whois binary.

(This is entirely based on the fact that I find myself installing it far too often)

Re: OpenSSH for Windows update

#135

Post by e12e »

Asmod4n wrote: post #123
e12e wrote: post #116

The more things change..., from: https://github.com/PowerShell/Win32-OpenSSH/wiki/Deploy-Win3... "If you need key-based authentication: Install key-auth package run setup-ssh-lsa.cmd reboot " Reboot? And this gem: "SSH daemon needs to run as System to support key-based authentication". Which means, either use weak authentication, or run the daemon as system. I don't even understand why, it's not like the public keys…

Regarding System User: https://github.com/PowerShell/Win32-OpenSSH/issues/2 , it needs that right to generate user tokens

Thank you for that. It makes a certain kind of sense, that impersonating a user/creating user sessions requires a high privilege. I think I'd still be more happy with it running as a low privilege user allowing log-in as "nobody"/"guest" and then elevating to a user with login/pw via "runas" or equivalent.

I can see how the only way to login directly to a certain user id would either require ssh to run as that user id or as System.

Re: OpenSSH for Windows update

#136

Post by ionised »

ionised wrote: post #130
DonnyV wrote: post #27

Earlier quoted context omitted.

I really don't like that there replacing an open source crypto with a closed source one. Putting on my tin foil hat but didn't Microsoft hand over a back door to the NSA already.

They collaborated with the NSA to develop an exploit in the SSL implementation used in Outlook.com. From the Snowden documents; July 31, 2012 Microsoft (MS) began encrypting web-based chat with the introduction of the new outlook.com service. This new Secure Socket Layer (SSL) encryption effectively cut off collection of the new service for FAA 702 and likely 12333 (to some degree) for the Intelligence Community (IC)…

Actually, sorry that was the FBI they worked with.

Re: OpenSSH for Windows update

#138

Post by kohenkatz »

e12e wrote: post #116

The more things change..., from: https://github.com/PowerShell/Win32-OpenSSH/wiki/Deploy-Win3... "If you need key-based authentication: Install key-auth package run setup-ssh-lsa.cmd reboot " Reboot? And this gem: "SSH daemon needs to run as System to support key-based authentication". Which means, either use weak authentication, or run the daemon as system. I don't even understand why, it's not like the public keys…

Have you checked what user OpenSSH usually runs as on a linux machine in order to allow key-based authentication? I'll give you a hint: it's root. That's no different than running as SYSTEM on Windows.

Re: OpenSSH for Windows update

#139

Post by togusa »

jen20 wrote: post #105
MichaelGG wrote: post #18

Earlier quoted context omitted.

It really is surprisingly bad, isn't it? I recently was involved in a continuous deployment system targeting Windows. We simply couldn't get WinRM to reliably upload fast and ended up installing SSH everywhere.

Having worked on that code (in Packer) - the WinRM protocol is completely unsuitable for use as an SCP replacement. It's amazing it works at all even for small files! The actual "winrmcp" implementation is here https://github.com/packer-community/winrmcp if you're interested in the inner workings.

Oh wow that's just horrible. I wish I hadn't looked now!

Re: OpenSSH for Windows update

#140

Post by togusa »

MichaelGG wrote: post #113
jen20 wrote: post #105

Earlier quoted context omitted.

Having worked on that code (in Packer) - the WinRM protocol is completely unsuitable for use as an SCP replacement. It's amazing it works at all even for small files! The actual "winrmcp" implementation is here https://github.com/packer-community/winrmcp if you're interested in the inner workings.

OK, but that code (cp.go) uploads base64 chunks of 8K and echo's them to a file and decodes when done. That surely isn't the real WinRM file copy implementation right? Well... I just went looking for how it's implemented and holy shit I don't think they considered this case. Top results say "use a file share". Wow. I feel less inadequate.

Yep that's horrible whatever the basis for it is.
Post reply on HN