Hacker News Reader

Comment by OrpheanBeholder | Hacker News Reader

> A bit ironic openssh.com doesn't have HTTPS

You can however access the release notes (or any other file/page from the website for that matter) over SSH using CVS

    $ cvs -d anoncvs@anoncvs.ca.openbsd.org:/cvs get www/openssh/txt/release-7.3

View on HN

Unless you've gotten anoncvs.ca.openbsd.org's host key fingerprint through some secure mechanism (say... HTTPS), SSH only encrypts the transport. It does nothing to stop a MITM (eg a malware injecting proxy).

Get the host fingerprints over TLS then?

https://www.openbsd.org/anoncvs.html

In which case ISTM that they could have just enabled HTTPS on www.openssh.com and saved us a few steps.

Reply on news.ycombinator.com