Hacker News Reader

HNHacker News

Top New Best Ask Show Jobs

Comment by gunapologist99 | Hacker News Reader

Parent Full thread

gunapologist99·

Excellent point; it does appear that the author did consider timing attacks in at least one location:

https://github.com/mohammed90/caddy-ssh/blob/master/internal...

View on HN

To be fair, this bit is borrowed/forked from github.com/gliderlabs/ssh.

Curious why you would just copy the entire gilderlabs/ssh package into your repo instead of referencing it as a module? How do you plan to keep up to date with bug / security fixes?

Some of the changes necessary were too invasive/breaking to gliderlabs/ssh, such as https://github.com/gliderlabs/ssh/pull/161 so making a copy ended up making more sense, I think. That's my understanding from what Mohammed's told me, anyways.

That's right. Moreover, the activity no the repo has been a bit stagnant (no disrespect to the maintainers, they are likely busy with other projects or life). Other projects have opted to fork the repo, rewrite the module repo path, and maintain their fork (e.g. https://github.com/tailscale/ssh/, but I've seen many others too). I didn't want to maintain a fork, so a copy under internal/ in my own repo means it's firm-fork (between soft and hard) where I can confidently break its APIs I'm the only one depending on without worry. It will slowly morph to fit the needs of the project only.

The maintainers gliderlabs/ssh have plans for a new version with more ergonomic APIs but the work hasn't started yet. I didn't want to wait either.

Reply on news.ycombinator.com