7 ms·

I doubt this will be accepted. It'll break a lot of valid functionality that relies on it, and the only case I can see presented as to why is for situations wh

I doubt this will be accepted. It'll break a lot of valid functionality that relies on it, and the only case I can see presented as to why is for situations when servers choose to offer scp when they should have chosen to offer sftp. Complaining that some people hand out shell access and this creates a "problem" that they gave people access to shell commands verges on ridiculous.

hannob 6y ago
It looks like the openssh main dev is positive about this change: https://github.com/openssh/openssh-portable/pull/194#pullrequestreview-450344807 https://github.com/openssh/openssh-portable/pull/194#pullreq... That sounds like it will probably be accepted after a few more minor fixes.
TheRealPomax 6y ago
You can deprecate something while still letting people add it back into their PPA manually. If you absolutely need an deprecated tool, no one's going to stop you: it's linux. Heck, just com,pile it from source and be on your merry unsupporteed way.
- monoideism 6y ago
  Yeah, and lose the security updates? I much prefer the status quo. Don't agree that this change is necessary.
  - TheRealPomax 6y ago
    The scp protocol is literally deprecated: what do you not agree with? The idea (and already being worked on) is to change the scp command's underlying code so that it behaves exactly the same as before, all your scripts will keep working just fine, it just won't use the now dead scp protocol under the hood and will instead use the universally supported sftp protocol.
    - monoideism 6y ago
      The replacement scp was described as not even being an official project of OpenSSH, so it's not being officially replaced. Is that not correct? And you don't deprecate a 25-year old utility with just a replacement "idea".
craftinator 6y ago
So... have you heard of wayland? If X11 can be deprecated without a drop-in replacement, then scp is pretty much doomed.
- deleted 6y ago
  [deleted]
- fuzxi 6y ago
  X11 has not been deprecated. It is still actively developed. The most recent commit was 23 hours ago. [1] [1]: https://cgit.freedesktop.org/xorg/lib/libX11 https://cgit.freedesktop.org/xorg/lib/libX11
  - pabs3 6y ago
    I think these are the articles that craftinator was referring to: https://ajaxnwnk.blogspot.com/2020/10/on-abandoning-x-server.html https://ajaxnwnk.blogspot.com/2020/10/on-abandoning-x-server... https://news.ycombinator.com/item?id=24920183 https://news.ycombinator.com/item?id=24920183 https://www.phoronix.com/scan.php?page=news_item&px=XServer-Abandonware https://www.phoronix.com/scan.php?page=news_item&px=XServer-... https://news.ycombinator.com/item?id=24884988 https://news.ycombinator.com/item?id=24884988
eneveu 6y ago
Having servers offer scp instead of ssh is not the only problem. What about this part of the article: Finally, while the danger is remote, it is worth noting that a local file name containing `backticks` (a file named `touch you-lose`, for example) will be handled the same way on the other end; if a user can be convinced to perform a recursive copy of a directory tree containing a file with a malicious name, bad things can happen.
deleted 6y ago
[deleted]

hannob 6y ago

It looks like the openssh main dev is positive about this change: https://github.com/openssh/openssh-portable/pull/194#pullrequestreview-450344807 https://github.com/openssh/openssh-portable/pull/194#pullreq... That sounds like it will probably be accepted after a few more minor fixes.

TheRealPomax 6y ago

You can deprecate something while still letting people add it back into their PPA manually. If you absolutely need an deprecated tool, no one's going to stop you: it's linux. Heck, just com,pile it from source and be on your merry unsupporteed way.

monoideism 6y ago
Yeah, and lose the security updates? I much prefer the status quo. Don't agree that this change is necessary.
- TheRealPomax 6y ago
  The scp protocol is literally deprecated: what do you not agree with? The idea (and already being worked on) is to change the scp command's underlying code so that it behaves exactly the same as before, all your scripts will keep working just fine, it just won't use the now dead scp protocol under the hood and will instead use the universally supported sftp protocol.
  - monoideism 6y ago
    The replacement scp was described as not even being an official project of OpenSSH, so it's not being officially replaced. Is that not correct? And you don't deprecate a 25-year old utility with just a replacement "idea".

craftinator 6y ago

So... have you heard of wayland? If X11 can be deprecated without a drop-in replacement, then scp is pretty much doomed.

deleted 6y ago
[deleted]
fuzxi 6y ago
X11 has not been deprecated. It is still actively developed. The most recent commit was 23 hours ago. [1] [1]: https://cgit.freedesktop.org/xorg/lib/libX11 https://cgit.freedesktop.org/xorg/lib/libX11
- pabs3 6y ago
  I think these are the articles that craftinator was referring to: https://ajaxnwnk.blogspot.com/2020/10/on-abandoning-x-server.html https://ajaxnwnk.blogspot.com/2020/10/on-abandoning-x-server... https://news.ycombinator.com/item?id=24920183 https://news.ycombinator.com/item?id=24920183 https://www.phoronix.com/scan.php?page=news_item&px=XServer-Abandonware https://www.phoronix.com/scan.php?page=news_item&px=XServer-... https://news.ycombinator.com/item?id=24884988 https://news.ycombinator.com/item?id=24884988

eneveu 6y ago

Having servers offer scp instead of ssh is not the only problem. What about this part of the article: Finally, while the danger is remote, it is worth noting that a local file name containing `backticks` (a file named `touch you-lose`, for example) will be handled the same way on the other end; if a user can be convinced to perform a recursive copy of a directory tree containing a file with a malicious name, bad things can happen.

deleted 6y ago

[deleted]