8 ms·

> Mosh is a replacement for SSH. It's more robust and responsive, > Mosh doesn't listen on network ports or authenticate users. The mosh client logs in to the

> Mosh is a replacement for SSH. It's more robust and responsive, > Mosh doesn't listen on network ports or authenticate users. The mosh client logs in to the server via SSH Umm.. > Unlike SSH, mosh's UDP-based protocol handles packet loss gracefully So it's not a replacement for SSH, but instead sits on top. Not only that, but it has some separate self-designed protocol that it uses to implement its ju-ju, presumably heavily peer reviewed for security design defects considering the claims of being an SSH replacement that are being made. :)

ezyang 15y ago
It's a replacement in the sense that, whenever you'd type 'ssh', you should type 'mosh' instead.
- wdaher 15y ago
  Exactly. It just happens to use ssh to bootstrap itself.
  - keithwinstein 15y ago
    Yeah -- we use ssh to authenticate the user and log them in and start up the mosh server (an unprivileged helper process). Then we shut down the SSH connection and establish a direct (roaming) connection over UDP.
    - zobzu 15y ago
      haskish :)
  - forgotusername 15y ago
    There are 101 million ways to screw these kinds of protocols up, that's why I'm sceptical. There are too many avenues to list, but here are a few: * Security product written in C++, leveraging 2 huge libraries (Google protocolbuffers, Boost) * One man band by the looks of it * Includes its own private crypto code (has rijndael-alg-fst.cc been vetted for timing issues?) * Implements its own private crypto protocol (has it been vetted for replay attacks? padding attacks? [insert 20 years of perplexing bugs confounding the greatest minds in computer science]?) etc. And besides all that, this page is begging you to download it. It ticks every box: sexy Bootstrap design, prepackaged installers for every OS, and not one mention of a single downside! That raises the question: what is the author's agenda? (At a guess, school cred, but still, this isn't reason enough for me to swap out something as critical as SSH)
    - keithwinstein 15y ago
      We certainly welcome your eyes on the code. Any novel secure datagram protocol is going to have to prove itself; this one is no exception. Of course we think the radical simplicity of the design is an advantage, but of course others have thought that and have been wrong. So it's going to take time for everybody to get comfortable with it. Regarding the Web site, I think Hacker News is able to take a little ribbing. You guys are always throwing up these twee Web sites; surely the free software community can have a little fun with the genre. :-)
      - forgotusername 15y ago
        From my limited perspective the code actually looks quite clean (although often this is the very quality that hides the worst of bugs!). One issue with UDP is dealing with NATs and firewalls (for example, in public WiFi hotspots where SSH is often permitted, but random other ports are not). The dependency on protocolbufs seems a little redundant given the size of your protocol (that is one huge library to import for the sake of 24 fields). Will definitely give this a whirl at some stage, as the feature set is quite compelling, and assuming it gets healthy reviews from the talented crypto folk on HN. :) Good luck!
        alwillis 15y ago
        It’s good to be careful and perhaps a little skeptical when there’s a new approach that’s not the tried and true ssh. The quote from the homepage tells me they get it: Why you should trust Mosh with your remote terminal needs: we worry about details so obscure, even USENIX reviewers don't want to hear about them.
        aidenn0 15y ago
        Agreed on the protocol buffers; that's a huge overkill for what it is used for.
      - deleted 15y ago
        [deleted]
    - deleted 15y ago
- mellifluousmind 15y ago
  That does not work. It seems to me that you need to install mosh server, which doesn't have much documentation at this moment. I just installed the mosh client, and replacing ssh with mosh command alone doesn't work. By not working, I meant the error message is "/opt/local/bin/mosh: Did not find mosh server startup message."
  - ComputerGuru 15y ago
    Hint: you need to install mosh on both client and server. That error message means you have the client installed locally, but not remotely.
    - deleted 15y ago
      [deleted]
    - mellifluousmind 15y ago
      No kidding. Too bad they don't have good documentation on server installation (just client)
      - mellifluousmind 15y ago
        Keep down voting me as you like. The fact remains that Mosh is crap. If it works, it should just work. Otherwise, it is just crap. I encourage people to uninstall mosh on Ubuntu, sudo apt-get autoremove mosh on Mac with MacPort, sudo port uninstall mosh
        Karunamon 15y ago
        I'm downvoting you not because of your stance on Mosh, but because you're being, in the technical term: "A dick."
        ballard 15y ago
        First they hate you and then they sing your praises. Is there an iPhone app?
ajross 15y ago
It uses ssh as the authentication and authorization channel to set up the socket on the remote machine. I don't want to make too many pronouncements as I haven't used it, but surely that's an example of being conservative with security behavior, not cavalier. That said, I think the single biggest annoyance for me with ssh is the connection setup latencies (something like ... 9 round trips and a by-default-rdns-lookup I think?). This thing can only be worse in that respect.
- nelhage 15y ago
  Well, it helps in that you need to initiate a connection much less often. Once you have a connected mosh session, it will transparently roam with you, across suspend/resume or changing networks, as long as you like. But yes, it can't help with the initial connection, which has to be bootstrapped over ssh.
- illumin8 15y ago
  Any time you are moving from one IP address to another, it better have some damn good security or else anyone will be able to hijack your session.
  - ajross 15y ago
    For some definition of "damn good" I guess. All security protocols can have holes. But a trivial session key is hardly rocket surgery. And spoofing attacks (which I assume is what you're talking about) don't require moving between one IP and another anyway.
- jake_morrison 15y ago
  If you are opening multiple ssh connections to the same host, you can add the following to your .ssh/config file # Multiplex connections if there is more than one Host * ControlMaster auto ControlPath ~/.ssh/master-%r@%h:%p
redcircle 15y ago
It doesn't sound like it is tunneled within SSH --- rather, it uses SSH as a sign-in method to launch mosh's own protocol handler that uses its own socket. Once mosh launches, ssh exits. Since it uses ssh for authentication, it has eliminated some of its peer-review problems.

ezyang 15y ago

It's a replacement in the sense that, whenever you'd type 'ssh', you should type 'mosh' instead.

wdaher 15y ago
Exactly. It just happens to use ssh to bootstrap itself.
- keithwinstein 15y ago
  Yeah -- we use ssh to authenticate the user and log them in and start up the mosh server (an unprivileged helper process). Then we shut down the SSH connection and establish a direct (roaming) connection over UDP.
  - zobzu 15y ago
    haskish :)
- forgotusername 15y ago
  There are 101 million ways to screw these kinds of protocols up, that's why I'm sceptical. There are too many avenues to list, but here are a few: * Security product written in C++, leveraging 2 huge libraries (Google protocolbuffers, Boost) * One man band by the looks of it * Includes its own private crypto code (has rijndael-alg-fst.cc been vetted for timing issues?) * Implements its own private crypto protocol (has it been vetted for replay attacks? padding attacks? [insert 20 years of perplexing bugs confounding the greatest minds in computer science]?) etc. And besides all that, this page is begging you to download it. It ticks every box: sexy Bootstrap design, prepackaged installers for every OS, and not one mention of a single downside! That raises the question: what is the author's agenda? (At a guess, school cred, but still, this isn't reason enough for me to swap out something as critical as SSH)
  - keithwinstein 15y ago
    We certainly welcome your eyes on the code. Any novel secure datagram protocol is going to have to prove itself; this one is no exception. Of course we think the radical simplicity of the design is an advantage, but of course others have thought that and have been wrong. So it's going to take time for everybody to get comfortable with it. Regarding the Web site, I think Hacker News is able to take a little ribbing. You guys are always throwing up these twee Web sites; surely the free software community can have a little fun with the genre. :-)
    - forgotusername 15y ago
      From my limited perspective the code actually looks quite clean (although often this is the very quality that hides the worst of bugs!). One issue with UDP is dealing with NATs and firewalls (for example, in public WiFi hotspots where SSH is often permitted, but random other ports are not). The dependency on protocolbufs seems a little redundant given the size of your protocol (that is one huge library to import for the sake of 24 fields). Will definitely give this a whirl at some stage, as the feature set is quite compelling, and assuming it gets healthy reviews from the talented crypto folk on HN. :) Good luck!
      - alwillis 15y ago
        It’s good to be careful and perhaps a little skeptical when there’s a new approach that’s not the tried and true ssh. The quote from the homepage tells me they get it: Why you should trust Mosh with your remote terminal needs: we worry about details so obscure, even USENIX reviewers don't want to hear about them.
      - aidenn0 15y ago
        Agreed on the protocol buffers; that's a huge overkill for what it is used for.
    - deleted 15y ago
      [deleted]
  - deleted 15y ago
mellifluousmind 15y ago
That does not work. It seems to me that you need to install mosh server, which doesn't have much documentation at this moment. I just installed the mosh client, and replacing ssh with mosh command alone doesn't work. By not working, I meant the error message is "/opt/local/bin/mosh: Did not find mosh server startup message."
- ComputerGuru 15y ago
  Hint: you need to install mosh on both client and server. That error message means you have the client installed locally, but not remotely.
  - deleted 15y ago
    [deleted]
  - mellifluousmind 15y ago
    No kidding. Too bad they don't have good documentation on server installation (just client)
    - mellifluousmind 15y ago
      Keep down voting me as you like. The fact remains that Mosh is crap. If it works, it should just work. Otherwise, it is just crap. I encourage people to uninstall mosh on Ubuntu, sudo apt-get autoremove mosh on Mac with MacPort, sudo port uninstall mosh
      - Karunamon 15y ago
        I'm downvoting you not because of your stance on Mosh, but because you're being, in the technical term: "A dick."
        ballard 15y ago
        First they hate you and then they sing your praises. Is there an iPhone app?

ajross 15y ago

It uses ssh as the authentication and authorization channel to set up the socket on the remote machine. I don't want to make too many pronouncements as I haven't used it, but surely that's an example of being conservative with security behavior, not cavalier. That said, I think the single biggest annoyance for me with ssh is the connection setup latencies (something like ... 9 round trips and a by-default-rdns-lookup I think?). This thing can only be worse in that respect.

nelhage 15y ago
Well, it helps in that you need to initiate a connection much less often. Once you have a connected mosh session, it will transparently roam with you, across suspend/resume or changing networks, as long as you like. But yes, it can't help with the initial connection, which has to be bootstrapped over ssh.
illumin8 15y ago
Any time you are moving from one IP address to another, it better have some damn good security or else anyone will be able to hijack your session.
- ajross 15y ago
  For some definition of "damn good" I guess. All security protocols can have holes. But a trivial session key is hardly rocket surgery. And spoofing attacks (which I assume is what you're talking about) don't require moving between one IP and another anyway.
jake_morrison 15y ago
If you are opening multiple ssh connections to the same host, you can add the following to your .ssh/config file # Multiplex connections if there is more than one Host * ControlMaster auto ControlPath ~/.ssh/master-%r@%h:%p

redcircle 15y ago

It doesn't sound like it is tunneled within SSH --- rather, it uses SSH as a sign-in method to launch mosh's own protocol handler that uses its own socket. Once mosh launches, ssh exits. Since it uses ssh for authentication, it has eliminated some of its peer-review problems.