4 ms·
> A bit ironic openssh.com doesn't have HTTPS You can however access the release notes (or any other file/page from the website for that matter) over SSH using
by OrpheanBeholder 10y ago
> A bit ironic openssh.com doesn't have HTTPS
You can however access the release notes (or any other file/page from the website for that matter) over SSH using CVS
$ cvs -d anoncvs@anoncvs.ca.openbsd.org:/cvs get www/openssh/txt/release-7.3
- schmichael 10y agoUnless you've gotten anoncvs.ca.openbsd.org's host key fingerprint through some secure mechanism (say... HTTPS), SSH only encrypts the transport. It does nothing to stop a MITM (eg a malware injecting proxy).
- OrpheanBeholder 10y agoGet the host fingerprints over TLS then? https://www.openbsd.org/anoncvs.html https://www.openbsd.org/anoncvs.html
- jlgaddis 10y agoIn which case ISTM that they could have just enabled HTTPS on www.openssh.com and saved us a few steps.
- deleted 10y ago[deleted]