OpenSSH: client bug CVE-2016-0777

theo must be mad.

Shaming people for leaving useless non essential feature in their code that results in security breach.

And now the jewel of his crown has been compromised.

The funniest part is now that his jewel has been tarnished, maybe people will understand what he was saying.

And maybe too, people that believed privacy can be achieved on the internet will finally look at the problem of believing the 2 general paradox can be solved without at least 2 different constant link on different plans. And the problem is belief is a poor substitute for thinking - critical thinking.

And maybe people will discover the sad truth of the internet.

Security requires a perfect world, where human beings neither makes mistakes nor are corruptible.

Errare humanum est, perseverare diabolicum

Oh! Some says that is what 2 factor authentication is.

I will answer, my intuition is telling me that 2 factor is good for a fixed amount of time/information and that using it correctly would annoy people to the utmost points.

Then people would say well let's accept that fraud exists. Business first. (costs/benefits)

Then I say giving 3% of all e-commerce to the bad guys is like admitting organized crime have a strong budget for even more crime ... and that we are fucked.

Unless you don't understand that ISIS is basically a startup. A startup that overthrow a state to make even more money and industrialize crime.

As mentioned in another thread, don't do this blindly. If there are `Host` or`Match` blocks in the config, this new line will only apply to the last of those blocks.

If it's not obvious, don't just add that config option, you have to also restart it.

Actually wait, is this only affecting the ssh client and not the server/daemon ?

It just sounds like a big code-base fuckup. They more or less admit it: "Server side was disabled/gutted for years already, but this aspect was surprisingly forgotten."

Sounds like this was put in at one time, forgotten about, and the code lingered for a long time until someone pointed it out. SSH as a protocol is pretty crazy. Everyone loves it, but its a lot of things in one, which ironically goes against the unix philosophy. Its a remote terminal, a file transfer server, a network tunnel server, a socks server, etc. There's a lot of stuff in there and I imagine difficult to work with sometimes.

No word if this is enabled in Putty, but I imagine it is if its using openssh libraries.

Server-side you can see the "full config" sshd uses:

  $ /usr/sbin/sshd -T -f /etc/ssh/sshd_config

Modify, if necessary, to point to the location of your `sshd` and configuration file.