Hacker News Reader

Comment by jiqiren | Hacker News Reader

SSH Agent forwarding issue >5years old now. :( https://github.com/mobile-shell/mosh/issues/120

Ssh agent forwarding is insecure. Don't use it.

https://heipei.github.io/2015/02/26/SSH-Agent-Forwarding-con...

This link is full of counter arguments the author even concedes. If this is so serious why doesn't openssh team remove the feature?

There is no excuse for denying mosh users existing patches/features and the above link changes nothing.

X Forwarding and TCP Forwarding is also insecure. Not everyone has the same threat model, but for the average person it's a bad idea to do agent Forwarding unless they fully understand the consequences. This doesn't mean the OpenSSH team should remove it.

To be clear a FeatureRequest not a Bug. So I think the age is understandable.

No, what it shows is that this project is just in maintance mode. There is plenty to be improved, but there is zero momentum.

This is hard for open source projects in general. What it needs is not just a happy user base, but also developers and a strong leader wanting to move this into the future. I think specially the latter is missing. I think Mosh was a great thesis project, but stalled after that.

It has so much potential. I wish they would push this to the next level and do proper protocol documentation and an IETF proposal like an RFC.

I figure this can go along like screen for a long time. I remember in about 1999 I was really annoyed that screen wasn't getting better fast enough and no one wanted my patches. Then I got used to using screen and it was fine. Now the cool kids use tmux or something and I can't be bothered to change, but I am abstractly glad the world is improving. Similarly I expect someone to clone/replace/improve mosh, and for people who demand the best new functionality to eventually head there.

A patch for SSH Agent forwarding has existed for 4+ years, and there have been several iterations of PRs to merge that into Mosh. The maintainers don't care enough to merge working code for an oft-requested feature.

PRs:

Most recent: https://github.com/mobile-shell/mosh/pull/696

Oldest: https://github.com/mobile-shell/mosh/pull/423

https://github.com/mobile-shell/mosh/pull/583

Reply on news.ycombinator.com