4 ms·

Thrussh -- they remake ssh, but they never say why. They only say that it is difficult because of all the interoperability issues they keep discovering. Ssh ha

Thrussh -- they remake ssh, but they never say why. They only say that it is difficult because of all the interoperability issues they keep discovering. Ssh has such a large surface, I don't see why they would do this. I also hope they allow you to use openssh as a fall back.

CodesInChaos 6y ago
I'm not sure why it would even use SSH instead of SSL/TLS.
- exDM69 6y ago
  Authentication. Ssh deals with keys and accounts and all that which SSL/TLS don't do.
  - jcranmer 6y ago
    TLS has client certificates, and I actually have used them for authentication before.
    - exDM69 6y ago
      Sure, but then you can't use your existing ssh credentials. And need to have a custom server and protocol. And being able to use pijul (or git) over plain old ssh is a pretty nice feature.
pmeunier 6y ago
First reason: writing servers that are easy to secure and maintain. Second reason: SSH on Windows used to be the most nightmarish thing you can imagine.
BlackFingolfin 6y ago
Thrussh is not a "remake" of a ssh, it is simply yet another implementation, and I don't find that particularly unusual or problematic; if one is working on a Rust based project, IMO it makes a lot of sense to work on a Rust based SSH implementation, too (for all kinds of reasons, ease of use and portability being one). As a matter of fact there are dozens if not hundreds of them out there. For a time, I was tracking some of them to figure out which ones support which particular protocol extension; the result is https://ssh-comparison.quendi.de https://ssh-comparison.quendi.de and the list there is really incomplete (and sadly also outdated -- PRs welcome ;-)), I think I could easily double the number of entries there if I resumed work on it. The one concern I'd have for a custom implementation is when they roll their own crypto... On a quick glance, that seems (?) to be the case here, see <https://docs.rs/crate/thrussh/0.28.0/source/src/cipher/chacha20poly1305.rs https://docs.rs/crate/thrussh/0.28.0/source/src/cipher/chach...>, albeit only for chacha20poly1305 which is relatively easy to implement "right" and "securely", but one can still mess that up...
- pmeunier 6y ago
  > I don't find that particularly unusual or problematic; if one is working on a Rust based project I'm the author, and you just made my day. Thanks. > On a quick glance, that seems (?) to be the case here Nope, I don't do crypto, I wouldn't work on other stuff if I did. That particular file you point to implements decoding from SSH packets, and passes everything on to libsodium.

CodesInChaos 6y ago

I'm not sure why it would even use SSH instead of SSL/TLS.

exDM69 6y ago
Authentication. Ssh deals with keys and accounts and all that which SSL/TLS don't do.
- jcranmer 6y ago
  TLS has client certificates, and I actually have used them for authentication before.
  - exDM69 6y ago
    Sure, but then you can't use your existing ssh credentials. And need to have a custom server and protocol. And being able to use pijul (or git) over plain old ssh is a pretty nice feature.

pmeunier 6y ago

First reason: writing servers that are easy to secure and maintain. Second reason: SSH on Windows used to be the most nightmarish thing you can imagine.

BlackFingolfin 6y ago

Thrussh is not a "remake" of a ssh, it is simply yet another implementation, and I don't find that particularly unusual or problematic; if one is working on a Rust based project, IMO it makes a lot of sense to work on a Rust based SSH implementation, too (for all kinds of reasons, ease of use and portability being one). As a matter of fact there are dozens if not hundreds of them out there. For a time, I was tracking some of them to figure out which ones support which particular protocol extension; the result is https://ssh-comparison.quendi.de https://ssh-comparison.quendi.de and the list there is really incomplete (and sadly also outdated -- PRs welcome ;-)), I think I could easily double the number of entries there if I resumed work on it. The one concern I'd have for a custom implementation is when they roll their own crypto... On a quick glance, that seems (?) to be the case here, see <https://docs.rs/crate/thrussh/0.28.0/source/src/cipher/chacha20poly1305.rs https://docs.rs/crate/thrussh/0.28.0/source/src/cipher/chach...>, albeit only for chacha20poly1305 which is relatively easy to implement "right" and "securely", but one can still mess that up...

pmeunier 6y ago
> I don't find that particularly unusual or problematic; if one is working on a Rust based project I'm the author, and you just made my day. Thanks. > On a quick glance, that seems (?) to be the case here Nope, I don't do crypto, I wouldn't work on other stuff if I did. That particular file you point to implements decoding from SSH packets, and passes everything on to libsodium.