9 ms·
> I kind of think it's worth breaking people's workflows here, but idk. Why? As many times mentioned in these replies there are a dozen alternatives if you ju
by josefx 6y ago
> I kind of think it's worth breaking people's workflows here, but idk.
Why? As many times mentioned in these replies there are a dozen alternatives if you just want file transfer. Why break argument parsing in scp when those alternatives are readily available?
- im3w1l 6y agoSeems preferable to evolve it in line with how 99% of people are using it, rather than deprecate it because 1% of people are using it in a dangerous way. It's also a shame to waste a nice 3-char name that, as the article puts it "is deeply wired into the fingers of many Linux users and developers" > Finally, while the danger is remote, it is worth noting that a local file name containing `backticks` (a file named `touch you-lose`, for example) will be handled the same way on the other end; if a user can be convinced to perform a recursive copy of a directory tree containing a file with a malicious name, bad things can happen. And, is this really what anyone wants?
- josefx 6y agoIf tricking the user is the issue then we should also symlink ssh to chrome. Would be a waste to loose an otherwise fine three letter name to something as dangerous as giving someone direct remote access to a system.
- pseudalopex 6y agoIt was deprecated already. Seems simpler to just make the scp command use the SFTP protocol. Someone is already working on it.