News for hackers. Stuff that matters.
Re:35-year-old vulnerability discovered in scp by walrus01 on Tuesday January 15, 2019 @03:31AM (#18909621)
The risk mitigation part here is that you know in advance a server has moved before you try to SSH to it. The real risk is less than cautious people who might choose 'yes' to accept a new host key when sshing towards a sshd that they have no prior knowledge of having changed IPs, or having been re-imaged, etc.
Re:35-year-old vulnerability discovered in scp by jedberg on Tuesday January 15, 2019 @03:33AM (#18909638)
Unix has usually been pretty good about giving you plenty of rope to hang yourself. :) Tools don’t usually protect from their own misuse — in this case not verifying a changed host key.