3 ms·
Oxy is trying: https://github.com/oxy-secure/oxy https://github.com/oxy-secure/oxy But it’s important to remember that SSH is a lot less fucked overall than th
by lvh 8y ago
Oxy is trying: https://github.com/oxy-secure/oxy https://github.com/oxy-secure/oxy
But it’s important to remember that SSH is a lot less fucked overall than the VPN situation was. People mostly grok SSH. SSH mostly doesn’t negotiate BF-CBC.
- tptacek 8y agoI disagree! SSH is not great! Because it doesn't need to support every browser on the Internet, new crypto percolates through the ecosystem much faster than it does in TLS. But it's still a janky protocol with dumb options, and a Noise-based no-negotiation alternative that fulfilled the same interface would indeed be super useful.
- lvh 8y agoI don’t think we actually disagree; I said “a lot less fucked” not “great” :) you can get real AEADs with Ed25529 in SSH easily; and some of the dumb options problems may still apply with Oxy, depending on what you’re taking about.