7 ms·

SSH Implementation Comparison

40 points by yread 4y ago

deleted 4y ago
[deleted]
tialaramex 4y ago
Would probably be useful if this noted whether you can do FIDO Security Keys as user authentication. This would be sort-of a sub-feature of the publickey authentication feature. Because the Security Key is responsible for actually signing stuff, and it has no interest in the SSH protocol per se, the SSH client and server need custom handling for this case.
tambourine_man 4y ago
Layout is broken in Safari 15.4 (latest) https://imgur.com/a/HdY4jvv https://imgur.com/a/HdY4jvv
georgyo 4y ago
This really needs an ability to filter clients. If I wanted to see which choices were compatible between a few implementations, it is very hard to see that. Sightly unrelated, but the choice of many ciphers that can be added and deprecated over time is a great feature. There is a wave of single purpose tools that by design only support one and only one cipher (such as age and minisign). These tools will eventually be forcefully obsolete or become the thing they hate. Imagine if ssh or tls was hard coded to a single cipher and you needed to change tools every 5-10 years.
- oynqr 4y ago
  Imagine if you could increment your major version number and support newer crypto, removing old crypto. Amazing, I know.
- rfoo 4y ago
  Meanwhile, Git is still here and going strong.
l0b0 4y ago
Surprising to see that many (49?) SSH implementations. I'd've expected there to be maybe four libraries everyone was using, OpenSSH and a handful of NIH orgs. Why do Erlang, PuTTY, and SSH.NET not use existing libraries? Are there any articles explaining why the landscape is so fragmented?
- pdw 4y ago
  You're perhaps under the impression that OpenSSH was the original implementation: it's not, it's a relative latecomer :) The original SSH was (and still is) commercial software, see ssh.com. You basically end up with three groups: - The original SSH and it's commercial competitors. Some abandoned, some still surviving. - Various open source implementations. OpenSSH and PuTTY were the winners (PuTTY actually was released first). But there were more attempts (e.g. lsh). - Those early open source implementations were designed as stand-alone programs (clients and servers). So you have a later wave of library implementations. With of course at least one per language.
  - ktm5j 4y ago
    Wow I knew openssh wasn't the first, and that commercial implementations existed, but had no idea the first implementation was commercial.

40 points by yread 4y ago

deleted 4y ago

[deleted]

Would probably be useful if this noted whether you can do FIDO Security Keys as user authentication. This would be sort-of a sub-feature of the publickey authentication feature. Because the Security Key is responsible for actually signing stuff, and it has no interest in the SSH protocol per se, the SSH client and server need custom handling for this case.

tambourine_man 4y ago

Layout is broken in Safari 15.4 (latest) https://imgur.com/a/HdY4jvv https://imgur.com/a/HdY4jvv

georgyo 4y ago

This really needs an ability to filter clients. If I wanted to see which choices were compatible between a few implementations, it is very hard to see that. Sightly unrelated, but the choice of many ciphers that can be added and deprecated over time is a great feature. There is a wave of single purpose tools that by design only support one and only one cipher (such as age and minisign). These tools will eventually be forcefully obsolete or become the thing they hate. Imagine if ssh or tls was hard coded to a single cipher and you needed to change tools every 5-10 years.

oynqr 4y ago
Imagine if you could increment your major version number and support newer crypto, removing old crypto. Amazing, I know.
rfoo 4y ago
Meanwhile, Git is still here and going strong.

l0b0 4y ago

Surprising to see that many (49?) SSH implementations. I'd've expected there to be maybe four libraries everyone was using, OpenSSH and a handful of NIH orgs. Why do Erlang, PuTTY, and SSH.NET not use existing libraries? Are there any articles explaining why the landscape is so fragmented?

pdw 4y ago
You're perhaps under the impression that OpenSSH was the original implementation: it's not, it's a relative latecomer :) The original SSH was (and still is) commercial software, see ssh.com. You basically end up with three groups: - The original SSH and it's commercial competitors. Some abandoned, some still surviving. - Various open source implementations. OpenSSH and PuTTY were the winners (PuTTY actually was released first). But there were more attempts (e.g. lsh). - Those early open source implementations were designed as stand-alone programs (clients and servers). So you have a later wave of library implementations. With of course at least one per language.
- ktm5j 4y ago
  Wow I knew openssh wasn't the first, and that commercial implementations existed, but had no idea the first implementation was commercial.