News for hackers. Stuff that matters.

A comment on OpenSSH 7.3 released. Parent comment

Re:OpenSSH 7.3 released by OrpheanBeholder on Monday August 01, 2016 @01:02PM (#12204031)
> A bit ironic openssh.com doesn't have HTTPS

You can however access the release notes (or any other file/page from the website for that matter) over SSH using CVS

    $ cvs -d [email protected]:/cvs get www/openssh/txt/release-7.3
[ Parent | on HN ]
Re:OpenSSH 7.3 released by schmichael on Monday August 01, 2016 @01:58PM (#12204493)
Unless you've gotten anoncvs.ca.openbsd.org's host key fingerprint through some secure mechanism (say... HTTPS), SSH only encrypts the transport. It does nothing to stop a MITM (eg a malware injecting proxy).
[ Parent | on HN ]
Re:OpenSSH 7.3 released by OrpheanBeholder on Monday August 01, 2016 @03:35PM (#12205244)
Get the host fingerprints over TLS then?

https://www.openbsd.org/anoncvs.html

[ Parent | on HN ]
Re:OpenSSH 7.3 released by jlgaddis on Monday August 01, 2016 @06:49PM (#12206666)
In which case ISTM that they could have just enabled HTTPS on www.openssh.com and saved us a few steps.
[ Parent | on HN ]