5 ms·

SSH -V on Windows 11 returns >OpenSSH_for_Windows_8.1p1, LibreSSL 3.0.2

JDW1023 5y ago
According to https://www.libressl.org/releases.html https://www.libressl.org/releases.html, LibreSSL 3.0.2 was released on October 19th, 2019. So it's exactly two years out of date. edit: on my windows 10 21H1, the timestamp in COFF/File header for ssh.exe shows '1584509394' (Wed, 18 Mar 2020 05:29:54 UTC).
1over137 5y ago
That LibreSSL is newer than even the latest macOS 12 Monterey beta: OpenSSH_8.6p1, LibreSSL 2.8.3
- pseudosavant 5y ago
  Yeah, but nobody has fun hating on Mac any more right? Thanks for the context.
  - eftychis 5y ago
    Well people (including me) are bashing Apple for this deviation. Also it has been a constant consideration when linking/shipping binaries in production. So I feel it is fine to bash Microsoft for doing the same thing. Perhaps Microsoft has an ABI reason for doing so? I can't imagine why else.
  - gjsman-1000 5y ago
    Perhaps - but Apple has used very old core utilities for a very long time (licensing issues) but ensures they get security updates. Until recently, they used, what, bash from 2006?
    - 1over137 5y ago
      There's no licensing issue with LibreSSL, nor any of the other ancient utilities from FreeBSD or elsewhere that Apple doesn't keep up-to-date.
      - bombcar 5y ago
        If the old version has known security flaws it should be possible to exploit them, correct? If those exploits don’t work perhaps Apple is playing dolly nuggets with the version number.
        arp242 5y ago
        Nah, there are all sorts of missing features, some of which were added over a decade ago. With a few small exceptions and modifications much of the Unix base has been quite dead for a long time.
        simonh 5y ago
        The suggestion being made is that bugs and vulnerabilities are being fixed without adding new features, in order to provide a safe but very stable feature set.
      - _-david-_ 5y ago
        There were issues with utilities that were using GPLv3. That is why they switched to Zsh instead of Bash for example.
neodymiumphish 5y ago
Odd, I'm on the Dev insider build (22478.1012) and I see > OpenSSH_for_Windows_8.6p1, LibreSSL 3.3.3
Semaphor 5y ago
Getting the same for win 10 20H2 (Build 19042.1288)
dachryn 5y ago
SSH --V on Windows 10 returns OpenSSH_for_Windows_7.7p1, LibreSSL 2.6.5
- jve 5y ago
  Mine Win10 returns: OpenSSH_for_Windows_8.1p1, LibreSSL 3.0.2 where.exe ssh.exe C:\Windows\System32\OpenSSH\ssh.exe systeminfo.exe | sls "OS V" OS Version: 10.0.19043 N/A Build 19043
tarnith 5y ago
Same on Win 10 21H1 19043.1288 ssh -V OpenSSH_for_Windows_8.1p1, LibreSSL 3.0.2
e12e 5y ago
Same for the daemon? (yes, windows comes with (installable) ssh daemon now).

According to https://www.libressl.org/releases.html https://www.libressl.org/releases.html, LibreSSL 3.0.2 was released on October 19th, 2019. So it's exactly two years out of date. edit: on my windows 10 21H1, the timestamp in COFF/File header for ssh.exe shows '1584509394' (Wed, 18 Mar 2020 05:29:54 UTC).

1over137 5y ago

That LibreSSL is newer than even the latest macOS 12 Monterey beta: OpenSSH_8.6p1, LibreSSL 2.8.3

pseudosavant 5y ago
Yeah, but nobody has fun hating on Mac any more right? Thanks for the context.
- eftychis 5y ago
  Well people (including me) are bashing Apple for this deviation. Also it has been a constant consideration when linking/shipping binaries in production. So I feel it is fine to bash Microsoft for doing the same thing. Perhaps Microsoft has an ABI reason for doing so? I can't imagine why else.
- gjsman-1000 5y ago
  Perhaps - but Apple has used very old core utilities for a very long time (licensing issues) but ensures they get security updates. Until recently, they used, what, bash from 2006?
  - 1over137 5y ago
    There's no licensing issue with LibreSSL, nor any of the other ancient utilities from FreeBSD or elsewhere that Apple doesn't keep up-to-date.
    - bombcar 5y ago
      If the old version has known security flaws it should be possible to exploit them, correct? If those exploits don’t work perhaps Apple is playing dolly nuggets with the version number.
      - arp242 5y ago
        Nah, there are all sorts of missing features, some of which were added over a decade ago. With a few small exceptions and modifications much of the Unix base has been quite dead for a long time.
        simonh 5y ago
        The suggestion being made is that bugs and vulnerabilities are being fixed without adding new features, in order to provide a safe but very stable feature set.
    - _-david-_ 5y ago
      There were issues with utilities that were using GPLv3. That is why they switched to Zsh instead of Bash for example.

neodymiumphish 5y ago

Odd, I'm on the Dev insider build (22478.1012) and I see > OpenSSH_for_Windows_8.6p1, LibreSSL 3.3.3

Semaphor 5y ago

Getting the same for win 10 20H2 (Build 19042.1288)

dachryn 5y ago

SSH --V on Windows 10 returns OpenSSH_for_Windows_7.7p1, LibreSSL 2.6.5

jve 5y ago
Mine Win10 returns: OpenSSH_for_Windows_8.1p1, LibreSSL 3.0.2 where.exe ssh.exe C:\Windows\System32\OpenSSH\ssh.exe systeminfo.exe | sls "OS V" OS Version: 10.0.19043 N/A Build 19043

tarnith 5y ago

Same on Win 10 21H1 19043.1288 ssh -V OpenSSH_for_Windows_8.1p1, LibreSSL 3.0.2

e12e 5y ago

Same for the daemon? (yes, windows comes with (installable) ssh daemon now).