Hacker News Reader

Comment by Aissen | Hacker News Reader

According to the article, there's an scp patch in the works (proposed upstream) to use the sftp protocol, it might be tested in Fedora: https://lwn.net/ml/fedora-devel/5c5ff586-c5af-2375-d189-b72d...

View on HN

> missing -3 support, it will not work if the server does not run sftp subsystem

Eh.

Seems like a half-assed solution for a non-problem, that will simply break stuff, remove functionality, and increase attack space for no benefit. If you need sftp, use sftp.

Isn't it decreasing attack surface if it's removing functionality? Unless you typically disable SFTP on your servers, in which case it seems like there would be basically equal attack surface after this change.

It will indeed decrease attack surface by removing (long-term, not day one) SCP protocol support. I'm not even sure gp did read the article on the security history (and unfixed bugs!) of said protocol.

There is no security history[0]; you gave the client shell access and they used shell access; that's all there is to it.

0: that is specific to scp rather than ssh in general, and where the client (rather than some third party) is the attacker

SCP also has security implications for the client though.

Actually, what will happen is that if there is lots of breakage, people will not upgrade their SSH server and client. That sounds worse than the current situation.

Is there a reason to think there will be any breakage at all? Furthermore, the situation you are describing could only become a problem for environments where you control both the client and server (in which case, why not let them shoot themselves in the foot if they want to?)

Good luck with OpenWrt routers and other embedded stuff which only have Dropbear without sftp.

Reply on news.ycombinator.com