4 ms·

For anyone dealing with very shoddy connection, I'd highly recommend mosh: https://mosh.org https://mosh.org I used it when trying to use my iPad for minimalis

For anyone dealing with very shoddy connection, I'd highly recommend mosh: https://mosh.org https://mosh.org I used it when trying to use my iPad for minimalist development (mosh + ec2 + vim + Go) and it worked great compared to SSH.

fourmajor 4y ago
I wanted to try mosh, but noticed that its last release was in 2017, which doesn't inspire confidence in its security.
- gjs278 4y ago
- dwrodri 4y ago
  I did some digging, and apparently there's a new release candidate available which is accumulating those 5 years of code changes that for some reason haven't been turned into a release: https://github.com/mobile-shell/mosh/releases/tag/mosh-1.3.2.95rc1 https://github.com/mobile-shell/mosh/releases/tag/mosh-1.3.2... If anyone here is more knowledgeable, it'd be good to know why it's been this long since an official release. It looks like most of the authors of mosh are academics, so my best guess is that mosh is a volunteer effort and it's just something that slipped through the cracks
  - keithwinstein 4y ago
    Hi -- original Mosh author here. We're excited to be doing a new release, with a new team of maintainers (not academics!), fuzzing from oss-fuzz, 24color support, etc., and would appreciate all the testing of the release candidate that Hacker News is able to provide. Hopefully we'll have a 1.4 soon. Details here: https://mailman.mit.edu/pipermail/mosh-devel/2022-August/001611.html https://mailman.mit.edu/pipermail/mosh-devel/2022-August/001... Re: why has it been five years, I feel like I've written this message many times on HN (https://news.ycombinator.com/item?id=28151637 https://news.ycombinator.com/item?id=28151637 , https://news.ycombinator.com/item?id=31010005 https://news.ycombinator.com/item?id=31010005), but here's another go. :-) We take Mosh's security seriously. In the ten years that Mosh has been out (https://news.ycombinator.com/item?id=3819382 https://news.ycombinator.com/item?id=3819382), we've never had a real security hole -- that we know about. That's a fantastic (apparent) track record. I don't want us to boast about it because it's just tempting fate, and of course you never really know if you have a security hole (just the ones you find or people tell you about), but, in terms of "security holes discovered," Mosh's track record compares really well with OpenSSH, OpenSSL, etc. Of course those codebases (a) have a lot more features than Mosh, and do more than Mosh, and (b) release more often than Mosh, but I'm happy (and I think the rest of the team is too) that Mosh does the thing it does well and without having made our users vulnerable. Back in 2012 when Mosh first came out, with a novel C++ codebase, and a novel secure datagram protocol, a lot of people were skeptical that it was worth trusting, and I'm pretty happy with how things turned out. This was all before HeartBleed and before QUIC, when self-assured people told me to "use something vetted, like OpenSSL" instead of our own new protocol and codebase. It took a long time to earn the community's trust, and now there's a few million people using Mosh, and I don't want us to fuck that up. I had handed off the project to another maintainer, and my understanding is that he had some health challenges or maybe just got burnt out. Given the choice between "release the code with lots of new features, but without the normal procedure and without an active maintainer to take responsibility for it" vs. "don't release," we chose the conservative option. I think that was the right choice. Of course many people equate "how recently was there a release" to "how secure is this software," and... I guess we are a counterexample? Not sure what else to say. Thank you to HN and Patrick Collison for publicizing Mosh back when it first came out ten years ago (https://news.ycombinator.com/item?id=3819382 https://news.ycombinator.com/item?id=3819382) and hope the next 10 years goes similarly... uneventfully and full of secure, reliable, mobile terminal sessions. :-) And thank you to all of you who get a chance to test the release candidate!
- blueflow 4y ago
  Where does the expectation comes from that software needs to be permanently updated? Would you consider your car unsafe if it didn't need repairs for years?
  - mixmastamyk 4y ago
    Flaws are found regularly in security-centric software. Perhaps low level libs provided the improvements however.
theamk 4y ago
the article already mentions tmux, and tmux already handles ssh reconnection and more. You might still use mosh if your connection is high latency and you are ok with occasional display artifacts, but its utility is much less if you already have tmux
keithwinstein 4y ago
Thank you! We are about to have a new release (with a new team of maintainers) and would appreciate all the testing of the rc that Hacker News is willing to provide. Details here: https://mailman.mit.edu/pipermail/mosh-devel/2022-August/001611.html https://mailman.mit.edu/pipermail/mosh-devel/2022-August/001...
- ducktective 4y ago
  Thanks for all the hard work
hayd 4y ago
the big missing piece for my development env is port forwarding https://github.com/mobile-shell/mosh/issues/337 https://github.com/mobile-shell/mosh/issues/337
chlorion 4y ago
On a somewhat related note, Wireguard acts somewhat similar to Mosh in that it can handle poor connections and moving across networks without reconnecting anything. I use SSH over Wireguard on the home DSL which sometimes has significant packet loss and it works well. I also use ZNC over Wireguard on my phone so I can move between networks without having to reconnect (home wifi => cell network => public wifi => etc). Mosh has more features than just handling unreliable connections though, so SSH over Wireguard is not a proper replacement. Mosh reduces input latency by just echoing text right away and fixing it if needed and only syncs the visible part of the screen instead of making output block while catching up. It does other interesting things too that I don't understand very well! You can always run Mosh over Wireguard too! This is what I'm going to start doing I think.
- slim 4y ago
  you can use telnet over wireguard
8n4vidtmkvmk 4y ago
mosh breaks scrolling for me. that's a deal breaker
- ducktective 4y ago
  it doesn't support that in the first place (not that it breaks it) . use tmux or screen.
  - DakotaR 4y ago
    I only use Mosh, but it's annoying to have to hit C-b [ and end up with clunky scrolling in tmux.
    - ducktective 4y ago
      Honestly, I agree. Scrolling experience is subpar on tmux (or a ssh session fwiw)
  - hdjrudni 4y ago
    Ehhh... tomato tomato. I can scroll perfectly fine in my Ubuntu terminal. I can scroll perfectly fine when I connect with ssh. Mosh doesn't allow me to scroll. Don't really care whose fault it is. I did try tmux today. Also doesn't support mouse scrolling out of the box, but I did find the setting for it. Still screws with copy-paste and right clicking.
- donatj 4y ago
  Eternal Terminal is a great alternative that doesn’t break scrollback https://eternalterminal.dev/ https://eternalterminal.dev/
  - hdjrudni 4y ago
    Will have to check that out. Thanks!
planede 4y ago
I recently set up autossh + tmux for this. I don't use mosh, because I use X forwarding to share the clipboard with my remote session, and mosh does not support X forwarding.
donatj 4y ago
Eternal Terminal is way better. It’s like Mosh that doesn’t break scrollback. https://eternalterminal.dev/ https://eternalterminal.dev/
linsomniac 4y ago
Mosh is fantastic, my only gripe is the the default escape character interfering with my vi usage (Control-^). So I use: MOSH_ESCAPE_KEY='~' mosh host
ptman 4y ago
mosh is great for lots of lag, but tailscale seems to improve unreliable connections for more than ssh

fourmajor 4y ago

I wanted to try mosh, but noticed that its last release was in 2017, which doesn't inspire confidence in its security.

gjs278 4y ago
dwrodri 4y ago
I did some digging, and apparently there's a new release candidate available which is accumulating those 5 years of code changes that for some reason haven't been turned into a release: https://github.com/mobile-shell/mosh/releases/tag/mosh-1.3.2.95rc1 https://github.com/mobile-shell/mosh/releases/tag/mosh-1.3.2... If anyone here is more knowledgeable, it'd be good to know why it's been this long since an official release. It looks like most of the authors of mosh are academics, so my best guess is that mosh is a volunteer effort and it's just something that slipped through the cracks
- keithwinstein 4y ago
  Hi -- original Mosh author here. We're excited to be doing a new release, with a new team of maintainers (not academics!), fuzzing from oss-fuzz, 24color support, etc., and would appreciate all the testing of the release candidate that Hacker News is able to provide. Hopefully we'll have a 1.4 soon. Details here: https://mailman.mit.edu/pipermail/mosh-devel/2022-August/001611.html https://mailman.mit.edu/pipermail/mosh-devel/2022-August/001... Re: why has it been five years, I feel like I've written this message many times on HN (https://news.ycombinator.com/item?id=28151637 https://news.ycombinator.com/item?id=28151637 , https://news.ycombinator.com/item?id=31010005 https://news.ycombinator.com/item?id=31010005), but here's another go. :-) We take Mosh's security seriously. In the ten years that Mosh has been out (https://news.ycombinator.com/item?id=3819382 https://news.ycombinator.com/item?id=3819382), we've never had a real security hole -- that we know about. That's a fantastic (apparent) track record. I don't want us to boast about it because it's just tempting fate, and of course you never really know if you have a security hole (just the ones you find or people tell you about), but, in terms of "security holes discovered," Mosh's track record compares really well with OpenSSH, OpenSSL, etc. Of course those codebases (a) have a lot more features than Mosh, and do more than Mosh, and (b) release more often than Mosh, but I'm happy (and I think the rest of the team is too) that Mosh does the thing it does well and without having made our users vulnerable. Back in 2012 when Mosh first came out, with a novel C++ codebase, and a novel secure datagram protocol, a lot of people were skeptical that it was worth trusting, and I'm pretty happy with how things turned out. This was all before HeartBleed and before QUIC, when self-assured people told me to "use something vetted, like OpenSSL" instead of our own new protocol and codebase. It took a long time to earn the community's trust, and now there's a few million people using Mosh, and I don't want us to fuck that up. I had handed off the project to another maintainer, and my understanding is that he had some health challenges or maybe just got burnt out. Given the choice between "release the code with lots of new features, but without the normal procedure and without an active maintainer to take responsibility for it" vs. "don't release," we chose the conservative option. I think that was the right choice. Of course many people equate "how recently was there a release" to "how secure is this software," and... I guess we are a counterexample? Not sure what else to say. Thank you to HN and Patrick Collison for publicizing Mosh back when it first came out ten years ago (https://news.ycombinator.com/item?id=3819382 https://news.ycombinator.com/item?id=3819382) and hope the next 10 years goes similarly... uneventfully and full of secure, reliable, mobile terminal sessions. :-) And thank you to all of you who get a chance to test the release candidate!
blueflow 4y ago
Where does the expectation comes from that software needs to be permanently updated? Would you consider your car unsafe if it didn't need repairs for years?
- mixmastamyk 4y ago
  Flaws are found regularly in security-centric software. Perhaps low level libs provided the improvements however.

theamk 4y ago

the article already mentions tmux, and tmux already handles ssh reconnection and more. You might still use mosh if your connection is high latency and you are ok with occasional display artifacts, but its utility is much less if you already have tmux

keithwinstein 4y ago

Thank you! We are about to have a new release (with a new team of maintainers) and would appreciate all the testing of the rc that Hacker News is willing to provide. Details here: https://mailman.mit.edu/pipermail/mosh-devel/2022-August/001611.html https://mailman.mit.edu/pipermail/mosh-devel/2022-August/001...

ducktective 4y ago
Thanks for all the hard work

hayd 4y ago

the big missing piece for my development env is port forwarding https://github.com/mobile-shell/mosh/issues/337 https://github.com/mobile-shell/mosh/issues/337

chlorion 4y ago

On a somewhat related note, Wireguard acts somewhat similar to Mosh in that it can handle poor connections and moving across networks without reconnecting anything. I use SSH over Wireguard on the home DSL which sometimes has significant packet loss and it works well. I also use ZNC over Wireguard on my phone so I can move between networks without having to reconnect (home wifi => cell network => public wifi => etc). Mosh has more features than just handling unreliable connections though, so SSH over Wireguard is not a proper replacement. Mosh reduces input latency by just echoing text right away and fixing it if needed and only syncs the visible part of the screen instead of making output block while catching up. It does other interesting things too that I don't understand very well! You can always run Mosh over Wireguard too! This is what I'm going to start doing I think.

slim 4y ago
you can use telnet over wireguard

8n4vidtmkvmk 4y ago

mosh breaks scrolling for me. that's a deal breaker

ducktective 4y ago
it doesn't support that in the first place (not that it breaks it) . use tmux or screen.
- DakotaR 4y ago
  I only use Mosh, but it's annoying to have to hit C-b [ and end up with clunky scrolling in tmux.
  - ducktective 4y ago
    Honestly, I agree. Scrolling experience is subpar on tmux (or a ssh session fwiw)
- hdjrudni 4y ago
  Ehhh... tomato tomato. I can scroll perfectly fine in my Ubuntu terminal. I can scroll perfectly fine when I connect with ssh. Mosh doesn't allow me to scroll. Don't really care whose fault it is. I did try tmux today. Also doesn't support mouse scrolling out of the box, but I did find the setting for it. Still screws with copy-paste and right clicking.
donatj 4y ago
Eternal Terminal is a great alternative that doesn’t break scrollback https://eternalterminal.dev/ https://eternalterminal.dev/
- hdjrudni 4y ago
  Will have to check that out. Thanks!

planede 4y ago

I recently set up autossh + tmux for this. I don't use mosh, because I use X forwarding to share the clipboard with my remote session, and mosh does not support X forwarding.

donatj 4y ago

Eternal Terminal is way better. It’s like Mosh that doesn’t break scrollback. https://eternalterminal.dev/ https://eternalterminal.dev/

linsomniac 4y ago

Mosh is fantastic, my only gripe is the the default escape character interfering with my vi usage (Control-^). So I use: MOSH_ESCAPE_KEY='~' mosh host

ptman 4y ago

mosh is great for lots of lag, but tailscale seems to improve unreliable connections for more than ssh