{"slug": "dropbear", "name": "Dropbear", "category": "other", "category_name": "Other software", "description": "", "recommenders": 3, "commenters": 6, "warners": 1, "score": 2.3, "rising": 0.35, "first": "2025-11-23", "latest": "2026-08-14", "why": "I've switched to Dropbear years ago because of how bloated (and vulnerable) OpenSSH was", "why_is_quote": true, "has_verdict": false, "sentiment": {"recommend": 3, "neutral": 2, "compare": 0, "warn": 1}, "spark": [0, 0, 0, 0, 2, 0, 0, 0, 0, 1, 0, 0], "listed": true, "loved": [], "caveat": "", "short_quote": "I've switched to Dropbear years ago because of how bloated (and vulnerable) OpenSSH was", "kind": "", "icon": false, "domain": "asn.au", "github_repo": null, "official_url": "https://matt.ucc.asn.au/dropbear/dropbear.html", "pricing": "", "aliases": ["Dropbear"], "verdict": null, "praise": [{"label": "", "summary": "", "quotes": [{"id": 788745504, "item_id": 49296594, "url": "https://news.ycombinator.com/item?id=49296594", "by": "d3Xt3r", "date": "2026-08-14", "stance": "recommend", "quote": "I've switched to Dropbear years ago because of how bloated (and vulnerable) OpenSSH was", "excerpt": "Nice to finally see a proper Rust SSH server (in the making, I guess). Personally, I've switched to Dropbear years ago because of how bloated (and vulnerable) OpenSSH was (Dropbear is only a couple of hundred KB static binary), but Dropbear is ultimately also written in C, so a Rust-based replacement would be welcome.", "context": "", "use_case": "SSH server", "switched_from": "OpenSSH", "story": "Show HN: OxiSH, a modern, memory-safe SSH server"}, {"id": 756289168, "item_id": 47268073, "url": "https://news.ycombinator.com/item?id=47268073", "by": "bitbasher", "date": "2026-03-05", "stance": "recommend", "quote": "I use dropbear to remote unlock over ssh", "excerpt": "Not sure how relevant it is, but I use dropbear to remote unlock over ssh: https://www.cyberciti.biz/security/how-to-unlock-luks-using-dropbear-ssh-keys-remotely-in-linux/", "context": "", "use_case": "remote LUKS unlock", "switched_from": "", "story": "Remotely unlocking an encrypted hard disk"}, {"id": 755830497, "item_id": 47239406, "url": "https://news.ycombinator.com/item?id=47239406", "by": "chasil", "date": "2026-03-03", "stance": "recommend", "quote": "I will take PuTTY or dropbear in a heartbeat", "excerpt": "Several reasons. -PuTTY pscp allows raw passwords on the command line, or from a file. OpenSSH is unreasonable in refusing to do this. -Scripting can adapt to a .netrc easily; OpenSSH will never do this. -Modern OpenSSH is a nightmare when using legacy crypto, while pscp is fluid. There is nothing wrong with hmac-md5, and no reason to refuse it. I will take PuTTY or dropbear in a heartbeat over these burned bridges a", "context": "", "use_case": "lightweight SSH server", "switched_from": "", "story": "Disable Your SSH access accidentally with scp"}]}], "caveats": [{"label": "", "summary": "", "quotes": [{"id": 762129153, "item_id": 47633072, "url": "https://news.ycombinator.com/item?id=47633072", "by": "AceJohnny2", "date": "2026-04-03", "stance": "warn", "quote": "which does not support certs", "excerpt": "Adding to this: while certs are indeed well-supported by OpenSSH, it's not always the SSH daemon used on alternate or embedded platforms. For example, OpenWRT used Dropbear [1] instead, which does not support certs. Also, Java programs that implement SSH stuff, like Jenkins, may be doing so using Apache Mina [2] which, though the underlying library supports certs, it is buggy [3] and requires the application to add t", "context": "", "use_case": "", "switched_from": "", "story": "SSH certificates: the better SSH experience"}]}], "who": [], "tags": [], "use_cases": ["ssh server", "remote luks unlock", "lightweight ssh server"], "compared": [{"slug": "openssh", "name": "OpenSSH", "co": 3, "switched_from": 1, "switched_to": 0}], "makers": [], "threads": [{"url": "https://news.ycombinator.com/item?id=49287604", "title": "Show HN: OxiSH, a modern, memory-safe SSH server", "mentions": 1}, {"url": "https://news.ycombinator.com/item?id=47791212", "title": "Codex Hacked a Samsung TV", "mentions": 1}, {"url": "https://news.ycombinator.com/item?id=47624811", "title": "SSH certificates: the better SSH experience", "mentions": 1}, {"url": "https://news.ycombinator.com/item?id=47265521", "title": "Remotely unlocking an encrypted hard disk", "mentions": 1}, {"url": "https://news.ycombinator.com/item?id=47190782", "title": "Disable Your SSH access accidentally with scp", "mentions": 1}, {"url": "https://news.ycombinator.com/item?id=46020543", "title": "Unusual circuits in the Intel 386's standard cell logic", "mentions": 1}], "sentiment_by_month": {"2025-11": {"neutral": 1}, "2025-12": {}, "2026-01": {}, "2026-02": {}, "2026-03": {"recommend": 2}, "2026-04": {"warn": 1, "neutral": 1}, "2026-05": {}, "2026-06": {}, "2026-07": {}, "2026-08": {"recommend": 1}, "2026-09": {}, "2026-10": {}}, "quotes": [{"id": 788745504, "item_id": 49296594, "url": "https://news.ycombinator.com/item?id=49296594", "by": "d3Xt3r", "date": "2026-08-14", "stance": "recommend", "quote": "I've switched to Dropbear years ago because of how bloated (and vulnerable) OpenSSH was", "excerpt": "Nice to finally see a proper Rust SSH server (in the making, I guess). Personally, I've switched to Dropbear years ago because of how bloated (and vulnerable) OpenSSH was (Dropbear is only a couple of hundred KB static binary), but Dropbear is ultimately also written in C, so a Rust-based replacement would be welcome.", "context": "", "use_case": "SSH server", "switched_from": "OpenSSH", "story": "Show HN: OxiSH, a modern, memory-safe SSH server"}, {"id": 764672816, "item_id": 47792051, "url": "https://news.ycombinator.com/item?id=47792051", "by": "ropbear", "date": "2026-04-16", "stance": "neutral", "quote": "dropbear allows port forwarding with admin creds", "excerpt": "Many eons ago I wrote a Python version of tmpcli for this exact reason. Made some minor improvements a few years ago but haven\u2019t touched it since. Curious what methodology Codex came up with, I haven\u2019t revisited it since models got really good. The idea is that tmpServer listens on localhost, but dropbear allows port forwarding with admin creds (you\u2019ll need to specify -N). That program has full device access and is t", "context": "", "use_case": "", "switched_from": "", "story": "Codex Hacked a Samsung TV"}, {"id": 762129153, "item_id": 47633072, "url": "https://news.ycombinator.com/item?id=47633072", "by": "AceJohnny2", "date": "2026-04-03", "stance": "warn", "quote": "which does not support certs", "excerpt": "Adding to this: while certs are indeed well-supported by OpenSSH, it's not always the SSH daemon used on alternate or embedded platforms. For example, OpenWRT used Dropbear [1] instead, which does not support certs. Also, Java programs that implement SSH stuff, like Jenkins, may be doing so using Apache Mina [2] which, though the underlying library supports certs, it is buggy [3] and requires the application to add t", "context": "", "use_case": "", "switched_from": "", "story": "SSH certificates: the better SSH experience"}, {"id": 756289168, "item_id": 47268073, "url": "https://news.ycombinator.com/item?id=47268073", "by": "bitbasher", "date": "2026-03-05", "stance": "recommend", "quote": "I use dropbear to remote unlock over ssh", "excerpt": "Not sure how relevant it is, but I use dropbear to remote unlock over ssh: https://www.cyberciti.biz/security/how-to-unlock-luks-using-dropbear-ssh-keys-remotely-in-linux/", "context": "", "use_case": "remote LUKS unlock", "switched_from": "", "story": "Remotely unlocking an encrypted hard disk"}, {"id": 755830497, "item_id": 47239406, "url": "https://news.ycombinator.com/item?id=47239406", "by": "chasil", "date": "2026-03-03", "stance": "recommend", "quote": "I will take PuTTY or dropbear in a heartbeat", "excerpt": "Several reasons. -PuTTY pscp allows raw passwords on the command line, or from a file. OpenSSH is unreasonable in refusing to do this. -Scripting can adapt to a .netrc easily; OpenSSH will never do this. -Modern OpenSSH is a nightmare when using legacy crypto, while pscp is fluid. There is nothing wrong with hmac-md5, and no reason to refuse it. I will take PuTTY or dropbear in a heartbeat over these burned bridges a", "context": "", "use_case": "lightweight SSH server", "switched_from": "", "story": "Disable Your SSH access accidentally with scp"}, {"id": 736353873, "item_id": 46022117, "url": "https://news.ycombinator.com/item?id=46022117", "by": "anthk", "date": "2025-11-23", "stance": "neutral", "quote": "you can use dropbear/bearssl", "excerpt": "A 386 was a beast against a 286, a 16 bit CPU. It was the minimum to run Linux with 4MB of RAM, but a 486 with and FPU destroyed it and not just in FP performance. Bear in mind that with an 386 you can barely decode an MP2 file, while with a 486 DX you can play most MP3 files at least in mono audio and maybe run Quake at the lowest settings if you own a 100 MHZ one. A 166MHZ Pentium can at least multitask a little wh", "context": "", "use_case": "", "switched_from": "", "story": "Unusual circuits in the Intel 386's standard cell logic"}]}