Live data from Hacker News

OpenSSH for Windows update

blogs.msdn.com

51–60 of 146 posts

Re: OpenSSH for Windows update

#51

Out of curiosity...why run this as a service? EDIT: I misread this and though it was only a client . Geez. If it's a server, then of course it should be a service.

How else would you expect an SSH server to run? As a desktop application?

Oh, I thought this was just a client.

Re: OpenSSH for Windows update

#52
post #9

> Address POSIX compatibility concerns Best way to address POSIX compatibility concerns is implementing a proper POSIX layer in Windows (and not in a half-baked manner like the now deprecated SUA). I can't imagine how it would hurt anybody.

Is this not what midipix.org intends to do? Granted, they're nowhere near close to being finished at this point in time, but it would be great to see the project pick up steam in this space.

midipix looks awesome, but seems to be GPL (not LGPL). Does that mean anything using it must be GPL too? I think that would be unacceptable for such a low layer of the stack.

Re: OpenSSH for Windows update

#54
post #9

> Address POSIX compatibility concerns Best way to address POSIX compatibility concerns is implementing a proper POSIX layer in Windows (and not in a half-baked manner like the now deprecated SUA). I can't imagine how it would hurt anybody.

[deleted]

Re: OpenSSH for Windows update

#55
post #7

I am waiting the moment when I can throw away WinRM and SSH to all the servers.

You have to create a god damn scheduled task to do Windows Updates over WinRM. And it takes ages for Powershell to realise the task is running, and polling the status of the job is a PITA. Took me days to automate Windows 2012 with Packer. Ugh

For others facing a similar situation, I very strongly recommend starting here instead of DIY. :-)

https://github.com/joefitzgerald/packer-windows

Re: OpenSSH for Windows update

#56
post #9

> Address POSIX compatibility concerns Best way to address POSIX compatibility concerns is implementing a proper POSIX layer in Windows (and not in a half-baked manner like the now deprecated SUA). I can't imagine how it would hurt anybody.

SUA was not half-baked, this is a very, very hard problem. There is a very serious difference in the way POSIX and Windows model a lot of really important OS primitives, from asynchronicity model in signals, to the semantics of syscalls like `fork`. Every process using these primitives on POSIX has specific behavior defined under those primitives, and if you don't choose _exactly_ the right behavior on the POSIX subsystem in Windows you will definitely break programs.

So, no. You can't "just" implement a POSIX subsystem correctly. These systems are just not compatible. It will always be half broken.

Re: OpenSSH for Windows update

#57
post #31

Earlier quoted context omitted.

That is a valid concern. On the other hand, win32 has a strong developer community with 20+ years of legacy as the primary API of Windows. Now only if Microsoft hadn't try to screw its own developers by trying to push a new framework every 5 years.

It does but as you say due to the emperor's new clothes every few years, the loyalty isn't there now. I know of no companies doing greenfield desktop dev that are using any of their tech. It's all Qt, CEF, python/wx and JavaFX. Even the financial companies we deal with who were pretty heavy with the WPF are canning it next cycle. Incumbent MFC, Winforms and WPF stuff will live as long as VB6 did (and still does) thou…

That's interesting.

>> Even the financial companies we deal with who were pretty heavy with the WPF are canning it next cycle.

Where are you based? What are they planning to adopt?

My company is consulting a couple of hedge funds in New York and they have no plans of replacing WPF for their trading apps.

The desktop CLR VM plus proper GPU acceleration makes WPF faster than any alternative (when avoiding binding). As far as I'm aware no other UI toolkit comes anywhere close.

Re: OpenSSH for Windows update

#58
post #5
post #3

> Leverage Windows crypto api’s instead of OpenSSL/LibreSSL and run as Windows Service Was wondering about that. I'm surprised the OpenBSD team is accepting the commits - something so fundamental and Windows specific doesn't seem like their kind of thing - but great! PS. If you're coming from a Unix background and interested in learning posh: https://certsimple.com/rosetta-stone

Was just coming here to voice my concerns over this choice as well, wondering what their reasoning is for changing crypto systems.

Also, keep in mind that modern OpenSSH does not need to link against OpenSSL anymore. You will have to make do with the bundled ciphers ed25519 and chacha, which is useless for talking to your legacy systems, but if you are making a new deployment it might suffice (or even be desirable).

The article is not clear if that's an option with this new Windows port, but it would decrease the attack surface a lot, which can only be good. SChannel has had its fair share of nasties over the years.

Re: OpenSSH for Windows update

#59
post #39

I'm interested in how this is going to work in PowerShell with the way everything works now, if there happen to be any details about that (whether here, somewhere else, or a past link)?

I don't know anything about PowerShell, but I have a similar question, I think: how is this going to work? Will I be able to do something like this command line (from my *nix machine)? ssh user@windows.machine.local dir d: | less

[deleted]

Re: OpenSSH for Windows update

#60
post #46
post #3

> Leverage Windows crypto api’s instead of OpenSSL/LibreSSL and run as Windows Service Was wondering about that. I'm surprised the OpenBSD team is accepting the commits - something so fundamental and Windows specific doesn't seem like their kind of thing - but great! PS. If you're coming from a Unix background and interested in learning posh: https://certsimple.com/rosetta-stone

Why would the OpenBSD team not accept the commits? It is just linking to a system library that will always be present on the platform. It's like saying Windows opensource should be forced to use some thrid party filesystem library.

My guess is they won't just write an openssl to schannel shim and instead sprinkle ifdefs throughout the code which would be a recipe for disaster.

Looking at the new code I feel like the chances this ever makes it upstream to pretty close to 0.

Post reply on HN