3 ms·

I wouldn't call sftp more modern. They're from the same time. One is interactive, and the other isn't. Nothing more. Nothing less. So, if you're using it to lo

by ksaj 7y ago

I wouldn't call sftp more modern. They're from the same time. One is interactive, and the other isn't. Nothing more. Nothing less. So, if you're using it to load code for net booting, scp is the obvious choice since you want to automate the retrieval of a specific file from a specific place, to a specific destination. And you don't want to have to babysit it every time. If you're copying some specific files with lots of randomish names from your livingroom entertainment server's Downloads directory to your laptop's Documents directory, sftp is your friend. One doesn't supersede the other in any way whatsoever. There are so many things wrong with the idea that rsync is more modern. Isn't rsync older by quite a bit? And since it is lacking encryption, isn't scp the more obvious tool to use? You can't use rsync the way that you use sftp. Think of it this way: * Secure direct: scp <-- encrypted * Secure interactive: sftp <-- encrypted * Insecure direct: rsync <-- clear text * Insecure interactive: ftp <-- clear text Use clear text if the network is absolutely known to be secure (good luck on that in any productive environment) and stick to scp and sftp or equivalent secure protocols. Toss ftp and rsync to the dogs and pretend you've never heard of them except in dire emergencies where significantly better tools (like scp and sftp) aren't available.

rdtsc 7y ago
> Insecure direct: rsync <-- clear text rsync lately, and depending how it is compiled, defaults to using ssh, so it shouldn't be clear text in that case.
jabl 7y ago
> I wouldn't call sftp more modern. They're from the same time. No. scp was included in Tatu Ylönens original ssh in 1995. sftp is significantly newer, e.g. openssh gained both client and server implementation with the 2.5 release in 2001, and is dependent on the ssh 2.0 protocol. > One is interactive, and the other isn't. Nothing more. Nothing less. No. They are different network protocols. And per CVE-2019-6111 mentioned in the link I provided in the previous post, the scp protocol has some questionable semantics, which is why the openssh developers are recommending people to switch to better designed protocols such as sftp or rsync. > So, if you're using it to load code for net booting, scp is the obvious choice since you want to automate the retrieval of a specific file from a specific place, to a specific destination. And you don't want to have to babysit it every time. You can automate sftp as well. Fetching files is as simple as with scp, but uploading is more tedious, but doable if, for instance, you don't have rsync available. Something like "sftp -b - user@server:/path <<< 'put filename'". > There are so many things wrong with the idea that rsync is more modern. rsync is not a fundamentally broken network protocol like scp. And as another answer mentioned, you can tunnel rsync over ssh, which nowadays even is the default if you don't specify otherwise.

by ksaj 7y ago

rdtsc 7y ago

> Insecure direct: rsync <-- clear text rsync lately, and depending how it is compiled, defaults to using ssh, so it shouldn't be clear text in that case.

jabl 7y ago

> I wouldn't call sftp more modern. They're from the same time. No. scp was included in Tatu Ylönens original ssh in 1995. sftp is significantly newer, e.g. openssh gained both client and server implementation with the 2.5 release in 2001, and is dependent on the ssh 2.0 protocol. > One is interactive, and the other isn't. Nothing more. Nothing less. No. They are different network protocols. And per CVE-2019-6111 mentioned in the link I provided in the previous post, the scp protocol has some questionable semantics, which is why the openssh developers are recommending people to switch to better designed protocols such as sftp or rsync. > So, if you're using it to load code for net booting, scp is the obvious choice since you want to automate the retrieval of a specific file from a specific place, to a specific destination. And you don't want to have to babysit it every time. You can automate sftp as well. Fetching files is as simple as with scp, but uploading is more tedious, but doable if, for instance, you don't have rsync available. Something like "sftp -b - user@server:/path <<< 'put filename'". > There are so many things wrong with the idea that rsync is more modern. rsync is not a fundamentally broken network protocol like scp. And as another answer mentioned, you can tunnel rsync over ssh, which nowadays even is the default if you don't specify otherwise.