2 ms·
More interesting statistics question is: how many connections over the world are opened to the servers with and without public domain/IP? I think that github a
by vbezhenar 1y ago
More interesting statistics question is: how many connections over the world are opened to the servers with and without public domain/IP?
I think that github alone makes a sizeable chunk of these connections. So if there was some better mechanism to establish trust before first handshake, that would benefit all of these connections.
One approach that I could envision is to simply host ssh public key on some well known path (github.com/.well-known/ssh.pub) and ssh client will grab it over https before first connection and when key suddenly changes.
- deleted 1y ago[deleted]
- kbolino 1y agoI think your proposed solution is a great idea, but we're evaluating it at the wrong layer of the software stack. The real problem is Git(Hub)'s (mis-)use of SSH, not SSH itself per se. Adding full TLS and HTTP stacks to SSH clients would be massive bloat and a security/maintenance burden that OpenSSH, PuTTY, etc. probably don't want to take on. Whereas, it would be much easier for Git to add this functionality to its client, since it already has HTTPS support. I think we could also attack this problem from the angle of phasing out git+ssh protocol (or at least greatly reducing its use) by improving unattended/headless HTTPS user authentication.