Hacker News Reader

Comment by yabones | Hacker News Reader

While it's not good to ship outdated client libraries & software, it would be much worse to distribute an old OpenSSH release... Can anybody with a Windows 10/11 box check the version they supply? That, to me, would be a much more serious problem.

View on HN

SSH -V on Windows 11 returns

>OpenSSH_for_Windows_8.1p1, LibreSSL 3.0.2

That LibreSSL is newer than even the latest macOS 12 Monterey beta: OpenSSH_8.6p1, LibreSSL 2.8.3

Yeah, but nobody has fun hating on Mac any more right? Thanks for the context.

Perhaps - but Apple has used very old core utilities for a very long time (licensing issues) but ensures they get security updates. Until recently, they used, what, bash from 2006?

There's no licensing issue with LibreSSL, nor any of the other ancient utilities from FreeBSD or elsewhere that Apple doesn't keep up-to-date.

There were issues with utilities that were using GPLv3. That is why they switched to Zsh instead of Bash for example.

If the old version has known security flaws it should be possible to exploit them, correct?

If those exploits don’t work perhaps Apple is playing dolly nuggets with the version number.

Nah, there are all sorts of missing features, some of which were added over a decade ago. With a few small exceptions and modifications much of the Unix base has been quite dead for a long time.

The suggestion being made is that bugs and vulnerabilities are being fixed without adding new features, in order to provide a safe but very stable feature set.

Well people (including me) are bashing Apple for this deviation. Also it has been a constant consideration when linking/shipping binaries in production. So I feel it is fine to bash Microsoft for doing the same thing.

Perhaps Microsoft has an ABI reason for doing so? I can't imagine why else.

According to https://www.libressl.org/releases.html, LibreSSL 3.0.2 was released on October 19th, 2019. So it's exactly two years out of date.

edit: on my windows 10 21H1, the timestamp in COFF/File header for ssh.exe shows '1584509394' (Wed, 18 Mar 2020 05:29:54 UTC).

Odd, I'm on the Dev insider build (22478.1012) and I see

> OpenSSH_for_Windows_8.6p1, LibreSSL 3.3.3

Same on Win 10 21H1 19043.1288 ssh -V OpenSSH_for_Windows_8.1p1, LibreSSL 3.0.2

Same for the daemon? (yes, windows comes with (installable) ssh daemon now).

SSH --V on Windows 10 returns OpenSSH_for_Windows_7.7p1, LibreSSL 2.6.5

Mine Win10 returns: OpenSSH_for_Windows_8.1p1, LibreSSL 3.0.2

  where.exe ssh.exe
  C:\Windows\System32\OpenSSH\ssh.exe
  systeminfo.exe | sls "OS V"
  OS Version:                10.0.19043 N/A Build 19043

Getting the same for win 10 20H2 (Build 19042.1288)

Reply on news.ycombinator.com