A backdoor in xz [LWN.net]

A backdoor in xz

Posted Mar 29, 2024 20:30 UTC (Fri) by intelfx (subscriber, #130118)
In reply to: A backdoor in xz by diegor
Parent article: A backdoor in xz

>> Genuinely surprised that's there's no project to replace OpenSSH in a memory safe language that is designed around the OS that everyone actually uses.
>
> Windows? Not trolling, but just trying to make a point...

Perhaps we could amend that to "<...> around the OS that everyone actually uses OpenSSH on"?

to post comments

A backdoor in xz

Posted Mar 29, 2024 22:43 UTC (Fri) by magfr (subscriber, #16052) [Link] (4 responses)

Windows.
OpenSSH is part of Windows 10+
You can finally open up cmd and type ssh user@system and the right thing happens.

A backdoor in xz

Posted Mar 29, 2024 23:59 UTC (Fri) by skissane (subscriber, #38675) [Link]

Most Windows users never use OpenSSH.
Vast majority of Windows installs have the OpenSSH server disabled.

And a lot of Windows users who actually do use an SSH client aren't using the bundled OpenSSH client – they are using PuTTY, or Cygwin/MSYS2 OpenSSH, or WSL OpenSSH, or one of a dozen other open source and proprietary Windows SSH clients.

I really doubt use of Windows bundled OpenSSH is greater than OpenSSH use on Linux (which includes WSL)

A backdoor in xz

Posted Mar 30, 2024 3:51 UTC (Sat) by ibukanov (subscriber, #3942) [Link]

Like 3 years ago I lost a few hours after trying Windows-bundled ssh. During git clone or pull it sometimes stopped working.

A backdoor in xz

Posted Mar 30, 2024 7:04 UTC (Sat) by intelfx (subscriber, #130118) [Link]

> Windows.
> OpenSSH is part of Windows 10+
> You can finally open up cmd and type ssh user@system and the right thing happens.

That's not the openssh _daemon_. And it's not the OS everyone *uses* openssh on.

A backdoor in xz

Posted Mar 30, 2024 7:47 UTC (Sat) by jem (subscriber, #24231) [Link]

Last time I checked, OpenSSH on Windows was a joke. Microsoft is doing a half-hearted job with the Windows port. It typically lags a few versions behind, and they don't even bother to write their own documentation, but instead refer to the man pages of the upstream version. Microsoft uses the same version numbering, for example calling their version OpenSSH 8.2, even if they leave out features at will. For example, the last Windows version I checked completely lacked support for PKCS11 (smart cards). The -I option was not recognized.

Also, if you wanted to use ssh agent, you had to install the SSH server, because ssh agent was bundled with the server package, not the client package, showing a complete lack of understanding of what the role of ssh agent is.