3 ms·
> if you scp with an evil machine, bad things can happen. That's all. The problem is that remote hosts, even ones you think you control, should be assumed pote
by pengaru 6y ago
> if you scp with an evil machine, bad things can happen. That's all.
The problem is that remote hosts, even ones you think you control, should be assumed potentially evil (compromised).
- noobermin 6y agoThere has to be a limit to this logic, because the obvious response should be not to log into machines you control, or by extension do anything for that matter.
- pengaru 6y agoThe limit certainly isn't here. There's zero reason for a file transfer utility to support running arbitrary commands on the local machine at the remote host's command. That capability shouldn't exist in the protocol, full stop. But since it does, if you're going to use scp regardless of what we know about it, there's clearly a broad spectrum of risk separating a random VPS in who knows what cloud running who knows what bits vs. the NAS machine in your closet that's only on a wired LAN behind a firewall running nothing that talks to the outside. Probably not the best choice to use scp to copy files to/from the former.