3 ms·
No CVEs yet. It would be truly exceptional should that record withstand widespread adoption.
by voakbasda 5y ago
No CVEs yet. It would be truly exceptional should that record withstand widespread adoption.
- chasil 5y agoForegoing dynamic memory allocation, removing all non-DJB ciphers, and supporting only inetd drastically reduces the attack surface, so there is some hope that no CVEs will ever be found.
- voakbasda 5y agoThere may be some hope, but I would not bet on it. Indeed, I can imagine this very thread resulting in a miffed security researcher uttering "challenge accepted" and finding a way to break it. Again, that is not something I would bet against, given enough time and eyeballs. That said, I greatly appreciate this kind of effort, and I will probably even look into using it for small embedded projects in the future. My pessimism about security track records does not block out my optimism that we can and should do better, and this sounds much better than some other alternatives.
- chasil 5y agoIt is also quite useful for older systems where the native SSH doesn't support newer features. I have to support an Oracle 10g database on this platform, and I run tinyssh on port 26: $ ssh -p 26 myserver.com $ cat /etc/redhat-release /etc/oracle-release Red Hat Enterprise Linux Server release 5.11 (Tikanga) Oracle Linux Server release 5.11 $ ps -e -o user,pid:5,args | grep tinyssh root 14147 tinysshd -lpsv -x sftp=/usr/libexec/openssh/sftp-server /etc/tinyssh/sshkeydir $ size /usr/sbin/tinysshd text data bss dec hex filename 122828 1428 680156 804412 c463c /usr/sbin/tinysshd Unfortunately, I can't get it running on HP-UX 10.20, but I only have one of those left.