He just didn't say so in that interview, however : From: 9fans@cse.psu.edu (rob pike) Date: Mon, 1 Jan 2001 09:37:12 -0500 Subject: [9fans] Re: The problem w

He just didn't say so in that interview, however : From: 9fans@cse.psu.edu (rob pike) Date: Mon, 1 Jan 2001 09:37:12 -0500 Subject: [9fans] Re: The problem with SSH2 Message-ID: <20010101143731.DB61F199E7@mail.cse.psu.edu> My disagreement with SSH is more specific. It is a securitymonger's plaything, so has been stuffed with every authentication and encryption technology known, yet those that are configured when it is installed is a random variable. Therefore both sides must negotiate like crazy to figure how to talk, and one often finds that there is no shared language. This is idiocy. The complexity is silly, but much worse is that there isn't at least one guaranteed protocol for authentication and encryption that both ends always have and can use as a fallback. I would argue that that would always be sufficient, but I know I'm in the minority there. I do argue that it's demonstrably necessary. Algorithms everywhere, and not a byte to send. By making the thing too complicated, they defeat the very purpose of security. Difficult administration results in incorrect or inadequate installation. There are cases when I can't use ssh, a direct consequence. -rob Russ Cox chimes in we're stuck with ssh, but let's not delude ourselves into thinking it's a good protocol. (i'm talking about ssh1; ssh2 looks worse.) russ