37 ms·
Thrussh is not a "remake" of a ssh, it is simply yet another implementation, and I don't find that particularly unusual or problematic; if one is working on a R
by BlackFingolfin 6y ago
Thrussh is not a "remake" of a ssh, it is simply yet another implementation, and I don't find that particularly unusual or problematic; if one is working on a Rust based project, IMO it makes a lot of sense to work on a Rust based SSH implementation, too (for all kinds of reasons, ease of use and portability being one).
As a matter of fact there are dozens if not hundreds of them out there. For a time, I was tracking some of them to figure out which ones support which particular protocol extension; the result is https://ssh-comparison.quendi.de https://ssh-comparison.quendi.de and the list there is really incomplete (and sadly also outdated -- PRs welcome ;-)), I think I could easily double the number of entries there if I resumed work on it.
The one concern I'd have for a custom implementation is when they roll their own crypto... On a quick glance, that seems (?) to be the case here, see <https://docs.rs/crate/thrussh/0.28.0/source/src/cipher/chacha20poly1305.rs https://docs.rs/crate/thrussh/0.28.0/source/src/cipher/chach...>, albeit only for chacha20poly1305 which is relatively easy to implement "right" and "securely", but one can still mess that up...
- pmeunier 6y ago> I don't find that particularly unusual or problematic; if one is working on a Rust based project I'm the author, and you just made my day. Thanks. > On a quick glance, that seems (?) to be the case here Nope, I don't do crypto, I wouldn't work on other stuff if I did. That particular file you point to implements decoding from SSH packets, and passes everything on to libsodium.