4 ms·
Heartbleed was in openssl, and Log4J in java. What does it have to do with openssh ?
by 400thecat 4y ago
Heartbleed was in openssl, and Log4J in java.
What does it have to do with openssh ?
- potatototoo99 4y agoOne day it will be openssh.
- traceroute66 4y ago> One day it will be openssh. As I said mate, go look at CVE. Its been YEARS/DECADES since the last serious vulnerability in OpenSSH. That's despite being one of the most widely deployed pieces of software on the internet.
- iwillbenice 4y agoHave you ever been responsible for security in a professional sense? Hiding attack surfaces is standard operating procedure. No one with a triple digit IQ seriously thinks any piece of software is going to be secure to infinity.
- anjbe 4y agoWhen that day comes, a machine running sshd on a high port will have to be wiped, because how can you trust that nobody’s scanned your ports, exploited your server, and eliminated the traces? When an OpenSSH zero‐day gets released, you can bet your bottom dollar people will be scanning full port ranges for SSH servers. And only one of them has to find you. If that’s the scenario you’re worried about, don’t rely on obscure ports. Run your sshd behind a VPN.
- deleted 4y ago[deleted]
- traceroute66 4y ago> Heartbleed was in openssl... What does it have to do with openssh ? Exactly. I can't speak for Log4J as I have no experience, but I do know that anyone sensible agrees that OpenSSL is a pile of bloated dog poo. OpenSSH, as I've already said, is written by the OpenBSD crew. They have a track record of having OCD about writing secure and correct software.
- dumpsterdiver 4y agoOkay, so are they going to live forever and keep writing impeccable software for eternity? What happens when they tire of their immortality, and decide to pass the torch?
- remram 4y agoThen we'll stop using it? On any port number?