Comment by userbinator | Hacker News Reader

Comment by userbinator | Hacker News Reader

It's interesting that PSCP has this option:

    -unsafe   allow server-side wildcards (DANGEROUS)

and as explained in the doc (https://www.ssh.com/ssh/putty/putty-manuals/0.68/Chapter5.ht...),

"This is due to a fundamental insecurity in the old-style SCP protocol: the client sends the wildcard string (*.c) to the server, and the server sends back a sequence of file names that match the wildcard pattern. However, there is nothing to stop the server sending back a different pattern and writing over one of your other files"

I haven't used the Linux version much so I assumed it had the same option. PSCP has had this option for as long as I can remember. I guess no one bothered to look at scp, or as one of the other comments here notes, scp is overwhelmingly used with a server one already trusts.

> I guess no one bothered to look at scp, or as one of the other comments here notes, scp is overwhelmingly used with a server one already trusts.

It's the latter for me. It's not just wildcards. You can use any server-side shell code you want to specify the files as if you're writing in a command argument[1]. At least, I find this tremendously useful.

[1] https://news.ycombinator.com/item?id=18912188

I strongly discourage anyone from using PuTTY, not for this reason, but for its weird and nonstandard handling of SSH keys.

The last time I tried to help someone get it set up on a windows PC, totally normal ssh2 rsa 2048 and 4096 bit public/private key pairs created with openssh had to be converted into some other weird format before they could get public/private key auth working.

Why the developers of putty felt they needed to deviate from standard ssh2-rsa pub/privkey formats is a mystery to me.

It's quite easy. There are multiple tutorials on it. When you load up a key into putty the plain old key you're used to is sitting right there in a box in the app. Just copy.

PuTTY's changelog from 2000 shows that PuTTYgen uses "the same RSA key file format as SSH 1" (the proprietary one, that predates OpenSSH).

Reading and writing OpenSSH-style keys came later (2012).

https://www.chiark.greenend.org.uk/~sgtatham/putty/changes.h...

Reply on news.ycombinator.com