4 ms·

This is the state of libssh. As if it wasn’t already, “many eyeballs theory” is turning over in it’s grave. Contrast this level of insanity to a proposed stand

by zaroth 8y ago

This is the state of libssh. As if it wasn’t already, “many eyeballs theory” is turning over in it’s grave. Contrast this level of insanity to a proposed standard of “developers should be liable for the damage caused by their negligent code”. Just, wow.

Sir_Cmpwn 8y ago
libssh is pretty niche. This isn't openssh.
- kevingadd 8y ago
  So "niche" it was used by github, albeit in a configuration that protected them from this
- akvadrako 8y ago
  libssh is used because openssh isn't suited to be used as a library. So it's one of the most popular ways to automate the most popular remote shell protocol. It's not really niche - I'd say it's an average popularity library and likely used by a bunch of internal projects.
  - duskwuff 8y ago
    The libssh client code is used pretty commonly for that sort of thing. The libssh server code, on the other hand, is pretty niche.
throwaway2048 8y ago
Except for github, its unlikely you use any software that uses libssh. Just because it has that name dosen't make it some kind of official SSH library that tons of software uses.
- lostmsu 8y ago
  What does git use?
  - dijit 8y ago
    OpenSSH.
    - raimue 8y ago
      Actually, just whatever 'ssh' binary is installed. That is not necessarily OpenSSH, but it is the most common choice.
  - deleted 8y ago
    [deleted]
heavenlyblue 8y ago
>> developers should be liable for the damage caused by their negligent code To be fair, at this point I would rather see developers not writing code; rather than writing buggy one. I had a friend on FB who's just completed a security course and wrote a password generator in Go. The random was seeded from a current date in nanoseconds. The issue is that while no one will probably ever reverse his passwords, but the guy open-sourced his script. How many people will be influenced by that piece of code? Lawyers have that: if you can't be liable - you're not a lawyer. GTFO.
- lrvick 8y ago
  I found that same exact issue in Terraform Go code where it generates passwords for AWS IAM users: https://www.cvedetails.com/cve/CVE-2018-9057/ https://www.cvedetails.com/cve/CVE-2018-9057/ We need to find out who is teaching this stupidity and make them stop.

by zaroth 8y ago

Sir_Cmpwn 8y ago

libssh is pretty niche. This isn't openssh.

kevingadd 8y ago
So "niche" it was used by github, albeit in a configuration that protected them from this
akvadrako 8y ago
libssh is used because openssh isn't suited to be used as a library. So it's one of the most popular ways to automate the most popular remote shell protocol. It's not really niche - I'd say it's an average popularity library and likely used by a bunch of internal projects.
- duskwuff 8y ago
  The libssh client code is used pretty commonly for that sort of thing. The libssh server code, on the other hand, is pretty niche.

throwaway2048 8y ago

Except for github, its unlikely you use any software that uses libssh. Just because it has that name dosen't make it some kind of official SSH library that tons of software uses.

lostmsu 8y ago
What does git use?
- dijit 8y ago
  OpenSSH.
  - raimue 8y ago
    Actually, just whatever 'ssh' binary is installed. That is not necessarily OpenSSH, but it is the most common choice.
- deleted 8y ago
  [deleted]

heavenlyblue 8y ago

>> developers should be liable for the damage caused by their negligent code To be fair, at this point I would rather see developers not writing code; rather than writing buggy one. I had a friend on FB who's just completed a security course and wrote a password generator in Go. The random was seeded from a current date in nanoseconds. The issue is that while no one will probably ever reverse his passwords, but the guy open-sourced his script. How many people will be influenced by that piece of code? Lawyers have that: if you can't be liable - you're not a lawyer. GTFO.

lrvick 8y ago
I found that same exact issue in Terraform Go code where it generates passwords for AWS IAM users: https://www.cvedetails.com/cve/CVE-2018-9057/ https://www.cvedetails.com/cve/CVE-2018-9057/ We need to find out who is teaching this stupidity and make them stop.