3 ms·

GitHub is an example of a service that would want to disable this option. They get lots of legit ssh connections from all over the world including people who ma

• mardifoufs 2y ago
  I somehow didn't think about that, even if I used that feature just a few hours ago! Now I'm curious about how GitHub handles the ssh infra at that scale...
  • asveikau 2y ago
    Even the amount of SSH authorized_keys they would need to process is a little mind boggling, they probably have some super custom stuff.
  • jkrejcha 2y ago
    GitHub, as I've read[1], uses a different implementation of SSH which is tailored for their use case. The benefits is that it is probably much lighter weight than OpenSSH (which supports a lot of different things just because it is so general[2]) and can more easily integrate with their services, while also providing the benefit of not having to spin up a shell and deal with the potential security risks that contains. And even if somehow a major flaw is found in OpenSSH, GitHub (at least their public servers) wouldn't be affected in this case since there's no shell to escape to. [1]: I read it on HN somewhere that I don't remember now, however you can kinda confirm this yourself if you open up a raw TCP connection to github.com, where the connection string says SSH-2.0-babeld-9102804c According to an HN user[2], they were using libssh in 2015. [2]: https://news.ycombinator.com/item?id=39978089 https://news.ycombinator.com/item?id=39978089 [3]: This isn't a value judgement on OpenSSH, I think it is downright amazing. However, GitHub has a much more narrow and specific use case, especially for an intentionally public SSH server.