I disagree. The simplest thing an attacker can do is sniffing the local traffic. It's a passive job, they don't even have to crack or break into anything, and w

I disagree. The simplest thing an attacker can do is sniffing the local traffic. It's a passive job, they don't even have to crack or break into anything, and what they're doing is essentially undetectable. Encryption helps against this, but not against man-in-the-middle attacks, that's true. However, those attacks are much more difficult to pull off than sniffing. Especially if you exchange a cert with your server just once, as you do in SSH. I do believe denying users access to encryption out of a fear of man-in-the-middle attacks and instead defaulting them to a completely unsecured link was and remains a dick move. In case it wasn't obvious: I love SSH because it doesn't rely on cert authorities and because it's ridiculously easy to establish a reasonably secure connection; it empowers users and server admins to no end. Is it exploitable? Yes! But I do believe it's difficult and far less likely than exploiting an unencrypted connection. And I'll say it again: denying users access to this basic mechanism was not a nice maneuver.