I went in expecting some kind of Tavis Ormandy type magic to copy files without authentication.

"You can authenticate with keys" wasn't the punchline I was expecting but perhaps if I had noticed the domain I may have set my expectations differently.

There is one piece of information, I think, that isn't obvious and needs to be communicated. Since I am anonymous, I am not embarrassed to ask even on HN.

If you copy a file using this method from host B to host C by issuing an scp command on host A, do the bits go directly from host B to host C? or do they go through host A on their way to host C ?

I suspect the latter is what happens on Windows network fileshares, because it takes significantly longer to perform a file transfer from \\hostB to \\hostC while in \\hostA than just doing it direct from \\hostB or \\hostC.

What happens in linux behind the scenes for such 3-party scp transfers?

scp has a -3 option so you decide whether the data travels through your local system or not

     -3      Copies between two remote hosts are transferred
             through the local host.  Without this option the
             data is copied directly between the two remote
             hosts.  Note that this option disables the
             progress meter.

It’s what you suspected. It uses host a as a proxy. It downloads from host b to host a and uploads from host a to host c.

Thank you for asking this! I was ignorant of the same process and held the same theory for Windows filetransfers.

Corollary to Clarke's Third Law:

Any technology demonstrated to a sufficiently unsophisticated audience is indistinguishable from sufficiently advanced technology, which is indistinguishable from magic.

My spider sense when reading the headline was “this is going to be some reinvented BS that ultimately could be replaced by just using scp” so I’m also disappointed but simultaneously pleasantly surprised it’s just good ol scp.

If SCP/SFTP is not an option and you've got netcat installed on the target you can definitely perform some magic. now of course this does require you to log in on the destination though

~~ Receiving system `# nc -l -p $arbitraryPort > /path/to/file `

~~ Sending system `# cat /path/to/file | nc $receivingSystemIP -p $arbitraryPort `

eg: `# nc -l -p 9669 > /home/user/staging/httpd.conf ` `# cat /etc/httpd/httpd.conf | nc 10.50.50.1 -p 9669 `

This method is a useful feather to have in one's cap when used in combination with tar and Pipeviewer `pv`.

I've used this several times doing a backup of a large database and when I don't have enough space locally to hold the copy.

Note: you can do the opposite as well to achieve the same thing, e.g. listen on the "sending system", in which case when you connect, you get the file.

Seems like it is written for Windows users. They would use tools like filezilla etc for copying files. Besides it could be IBM effect, they used to publish fine articles on their developerworks website.