{"slug": "openssh", "name": "OpenSSH", "category": "terminal", "category_name": "Terminal and shell", "description": "", "recommenders": 17, "commenters": 49, "warners": 8, "score": 12.257, "rising": -2.91, "first": "2025-11-11", "latest": "2026-10-06", "why": "OpenSSH authors have spent considerable effort separating concerns, reducing privileges, process isolation", "why_is_quote": true, "has_verdict": false, "sentiment": {"recommend": 17, "neutral": 27, "compare": 1, "warn": 8}, "spark": [3, 1, 3, 1, 2, 0, 1, 1, 3, 2, 0, 0], "listed": true, "loved": [], "caveat": "", "short_quote": "OpenSSH authors have spent considerable effort separating concerns, reducing privileges, process isolation", "kind": "", "icon": true, "domain": "openssh.org", "github_repo": null, "official_url": "https://www.openssh.com", "pricing": "", "aliases": ["OpenSSH"], "verdict": null, "praise": [{"label": "", "summary": "", "quotes": [{"id": 791987461, "item_id": 49499216, "url": "https://news.ycombinator.com/item?id=49499216", "by": "dbmikus", "date": "2026-08-30", "stance": "recommend", "quote": "Just give me OpenSSH with normal SSH key management.", "excerpt": "I haven't paid super close attention to Orbs, but I also build an agent runtime + orchestration layer on top of remote VMs (https://github.com/gofixpoint/amika). I do think it's smart marketing to name the concept. And for coding agents, there's a lot of annoying fiddly stuff you have to do to get the experience to work well: 1. auto-refresh base VM snapshots with latest delta of git commit changes 2. extend the VM l", "context": "", "use_case": "VM access", "switched_from": "", "story": "Orbs"}, {"id": 787676624, "item_id": 49229789, "url": "https://news.ycombinator.com/item?id=49229789", "by": "angry_octet", "date": "2026-08-09", "stance": "recommend", "quote": "OpenSSH authors have spent considerable effort separating concerns, reducing privileges, process isolation", "excerpt": "I can think of better straw men. But if they had approached their task with half the seriousness of the openssh maintainers then they probably wouldn't be failing to check the return value of authentication functions. OpenSSH authors have spent considerable effort separating concerns, reducing privileges, process isolation, etc. So I would say they have been planning for potential bugs. These techniques are very much", "context": "", "use_case": "", "switched_from": "", "story": "Now we have a timeline of the OpenAI accidental attack against Hugging Face"}, {"id": 782700994, "item_id": 48918812, "url": "https://news.ycombinator.com/item?id=48918812", "by": "traceroute66", "date": "2026-07-15", "stance": "recommend", "quote": "In terms of SSH, we use old-school OpenSSH and SSH certificates.", "excerpt": "At $work we use Tailscale mostly because we were running into too many random issues with NAT with our standard DIY Wireguard setup, especially when people were working from hotels and other places with half-ass network setups. But we don't trust Tailscale. Just look at the thousands of unresolved Github issues, many of which are actually quite important/useful but have been ignored for months and years. We very much", "context": "", "use_case": "server SSH access with certificates", "switched_from": "", "story": "TS-2026-009: Insecure argument handling in Tailscale SSH permitted root access"}, {"id": 782290288, "item_id": 48893143, "url": "https://news.ycombinator.com/item?id=48893143", "by": "titularcomment", "date": "2026-07-13", "stance": "recommend", "quote": "OpenSSH is a lifesaver", "excerpt": "Personal laptop use with Ada Lovelace or Ampere family NVIDIA GPUs (did you mean this or CUDA, i couldnt tell), personal desktop use with unusual peripherals, dependency on ports, existence and competition of FreeBSD etc. I love OpenBSD's code philosophy (they were the first to introduce a lot of security techniques[1]) and the programs they produce, OpenSSH is a lifesaver, and I use doas for its low footprint on my ", "context": "", "use_case": "remote access", "switched_from": "", "story": "GhostLock, a stack-UAF that has existed in ALL Linux distributions for 15 years"}, {"id": 774933984, "item_id": 48433374, "url": "https://news.ycombinator.com/item?id=48433374", "by": "MaxBarraclough", "date": "2026-06-07", "stance": "recommend", "quote": "From https://www.openssh.org/pq.html", "excerpt": "This concern doesn't apply if a hybrid approach is used. From https://www.openssh.org/pq.html : > all the post-quantum algorithms implemented by OpenSSH are \"hybrids\" that combine a post-quantum algorithm with a classical algorithm. For example mlkem768x25519-sha256 combines ML-KEM, a post-quantum key agreement scheme, with ECDH/x25519, a classical key agreement algorithm that was formerly OpenSSH's preferred default", "context": "", "use_case": "Post-quantum SSH key exchange", "switched_from": "", "story": "A Post-Quantum Future for Let's Encrypt"}]}], "caveats": [{"label": "", "summary": "", "quotes": [{"id": 796185281, "item_id": 49761580, "url": "https://news.ycombinator.com/item?id=49761580", "by": "judge2020", "date": "2026-09-18", "stance": "warn", "quote": "SSH would reintroduce a single point of failure to this.", "excerpt": "cloudflared is a bit unique in that it makes multiple outbound connections to CF DCs to do the tunneling and fails over if a DC has an issue (or, more likely, when a DC is near-capacity and they need to divert lower-tier traffic away from it[0]). SSH would reintroduce a single point of failure to this. Also, the _main_ use case of `cloudflared` tunneling is using it as a long-term way to host production websites on y", "context": "", "use_case": "Reverse tunnels (ssh -R)", "switched_from": "", "story": "Cloudflare Quick Tunnels"}, {"id": 788929024, "item_id": 49308064, "url": "https://news.ycombinator.com/item?id=49308064", "by": "jauntywundrkind", "date": "2026-08-14", "stance": "warn", "quote": "You would absolutely not use openssh server for this. That's a terrible idea.", "excerpt": "You would absolutely not use openssh server for this. That's a terrible idea. Pick a library. https://github.com/Eugeny/russh", "context": "", "use_case": "", "switched_from": "", "story": "I close SSH port 22 (and what I use instead)"}, {"id": 788745505, "item_id": 49296594, "url": "https://news.ycombinator.com/item?id=49296594", "by": "d3Xt3r", "date": "2026-08-14", "stance": "warn", "quote": "how bloated (and vulnerable) OpenSSH was", "excerpt": "Nice to finally see a proper Rust SSH server (in the making, I guess). Personally, I've switched to Dropbear years ago because of how bloated (and vulnerable) OpenSSH was (Dropbear is only a couple of hundred KB static binary), but Dropbear is ultimately also written in C, so a Rust-based replacement would be welcome.", "context": "", "use_case": "SSH server", "switched_from": "", "story": "Show HN: OxiSH, a modern, memory-safe SSH server"}, {"id": 768999184, "item_id": 48062449, "url": "https://news.ycombinator.com/item?id=48062449", "by": "jmclnx", "date": "2026-05-08", "stance": "warn", "quote": "the real issue was patching OpenSSH", "excerpt": ">Did the OpenSSH folks know (or care) that ifunc was a thing? It's certainly not a thing on OpenBSD. I do not know why you were down-voted, maybe you deserved no up-votes, but down-votes to me were a bit extreme :) But that quote tends to indicate to me the author put a little blame on OpenSSH Developers. Maybe the author did not intend it to be read in the way I read it. OpenSSH developers should not need to know wh", "context": "", "use_case": "", "switched_from": "", "story": "GNU IFUNC is the real culprit behind CVE-2024-3094"}]}], "who": [{"by": "ghshephard", "context": "manages ~250k hosts in 42 datacenters", "url": "https://news.ycombinator.com/item?id=49338384", "date": "2026-08-17"}, {"by": "bobo56539", "context": "manages hosts, uses YubiKeys as SSH CAs", "url": "https://news.ycombinator.com/item?id=47627476", "date": "2026-04-03"}], "tags": [], "use_cases": ["ssh server", "remote shell access", "reverse tunnels (ssh -r)", "vm access", "connecting to hosts", "server ssh access with certificates"], "compared": [{"slug": "dropbear", "name": "Dropbear", "co": 3, "switched_from": 0, "switched_to": 1}, {"slug": "rsync", "name": "rsync", "co": 2, "switched_from": 0, "switched_to": 0}, {"slug": "openbsd", "name": "OpenBSD", "co": 2, "switched_from": 0, "switched_to": 0}, {"slug": "linux", "name": "Linux", "co": 2, "switched_from": 0, "switched_to": 0}, {"slug": "hpn-ssh", "name": "HPN-SSH", "co": 2, "switched_from": 0, "switched_to": 0}, {"slug": "systemd", "name": "systemd", "co": 2, "switched_from": 0, "switched_to": 0}, {"slug": "doas", "name": "doas", "co": 2, "switched_from": 0, "switched_to": 0}], "makers": [{"id": 800491008, "item_id": 50030688, "url": "https://news.ycombinator.com/item?id=50030688", "by": "daztucker", "date": "2026-10-10", "stance": "neutral", "quote": "The majority of work in both is currently done by Damien and myself", "excerpt": "Mostly correct. The majority of work in both is currently done by Damien and myself, who work on both. There are a couple of people who have done significant work on OpenBSD's ssh (eg Markus, Theo) and various OpenBSD folks who add a feature or fix a bug and move on. There is one person who currently works exclusively on -Portable (Tim Rice, who is still around although not very active these days) and at least one ot", "context": "OpenSSH developer", "use_case": "", "switched_from": "", "story": "OpenSSH 10.6"}], "threads": [{"url": "https://news.ycombinator.com/item?id=47318797", "title": "SSH Secret Menu", "mentions": 5}, {"url": "https://news.ycombinator.com/item?id=46227641", "title": "High Performance SSH/SCP", "mentions": 3}, {"url": "https://news.ycombinator.com/item?id=49983791", "title": "OpenSSH 10.6", "mentions": 2}, {"url": "https://news.ycombinator.com/item?id=49261895", "title": "OpenSSH 10.5 released, AI fixes now welcome", "mentions": 2}, {"url": "https://news.ycombinator.com/item?id=49248388", "title": "I close SSH port 22 (and what I use instead)", "mentions": 2}, {"url": "https://news.ycombinator.com/item?id=49149805", "title": "Show HN: ssh ssh.place", "mentions": 2}], "sentiment_by_month": {"2025-11": {"recommend": 3, "warn": 1, "neutral": 2}, "2025-12": {"warn": 1, "recommend": 1, "neutral": 5}, "2026-01": {"warn": 1, "recommend": 3}, "2026-02": {"neutral": 3, "recommend": 1}, "2026-03": {"warn": 1, "recommend": 2, "neutral": 5, "compare": 1}, "2026-04": {"neutral": 3}, "2026-05": {"warn": 1, "recommend": 1}, "2026-06": {"neutral": 1, "recommend": 1}, "2026-07": {"recommend": 3}, "2026-08": {"neutral": 6, "recommend": 2, "warn": 2}, "2026-09": {"warn": 1, "neutral": 1}, "2026-10": {"neutral": 1}}, "quotes": [{"id": 799763280, "item_id": 49985205, "url": "https://news.ycombinator.com/item?id=49985205", "by": "mrpippy", "date": "2026-10-06", "stance": "neutral", "quote": "I look forward to seeing if Apple makes any changes in the fork they ship with the OS", "excerpt": "I look forward to seeing if Apple makes any changes in the fork they ship with the OS: https://github.com/apple-oss-distributions/OpenSSH. \"Updated sandbox for privilege-separated pre-authorization sshd process\" is listed as a modification to the open-source project, but I suspect this is out-of-date.", "context": "", "use_case": "", "switched_from": "", "story": "OpenSSH 10.6"}, {"id": 796789601, "item_id": 49799350, "url": "https://news.ycombinator.com/item?id=49799350", "by": "TacticalCoder", "date": "2026-09-22", "stance": "neutral", "quote": "OpenSSH who uses an hybrid scheme", "excerpt": "So Git, in version 3.0, is moving to SHA-256 by default for SHA-1 ain't considered that strong anymore but... What about future attacks by quantum computers? Is Git safe from quantum computers for it's all hashes only? Or shall there be issues with quantum attacks? I'm asking for there are several projects that are already moving to quantum-resistant schemes (like OpenSSH who uses an hybrid scheme [1]). [1] https://w", "context": "", "use_case": "", "switched_from": "", "story": "Looking forward to Git 2.56 \u2013 and 3.0"}, {"id": 796185281, "item_id": 49761580, "url": "https://news.ycombinator.com/item?id=49761580", "by": "judge2020", "date": "2026-09-18", "stance": "warn", "quote": "SSH would reintroduce a single point of failure to this.", "excerpt": "cloudflared is a bit unique in that it makes multiple outbound connections to CF DCs to do the tunneling and fails over if a DC has an issue (or, more likely, when a DC is near-capacity and they need to divert lower-tier traffic away from it[0]). SSH would reintroduce a single point of failure to this. Also, the _main_ use case of `cloudflared` tunneling is using it as a long-term way to host production websites on y", "context": "", "use_case": "Reverse tunnels (ssh -R)", "switched_from": "", "story": "Cloudflare Quick Tunnels"}, {"id": 791987461, "item_id": 49499216, "url": "https://news.ycombinator.com/item?id=49499216", "by": "dbmikus", "date": "2026-08-30", "stance": "recommend", "quote": "Just give me OpenSSH with normal SSH key management.", "excerpt": "I haven't paid super close attention to Orbs, but I also build an agent runtime + orchestration layer on top of remote VMs (https://github.com/gofixpoint/amika). I do think it's smart marketing to name the concept. And for coding agents, there's a lot of annoying fiddly stuff you have to do to get the experience to work well: 1. auto-refresh base VM snapshots with latest delta of git commit changes 2. extend the VM l", "context": "", "use_case": "VM access", "switched_from": "", "story": "Orbs"}, {"id": 789414145, "item_id": 49338384, "url": "https://news.ycombinator.com/item?id=49338384", "by": "ghshephard", "date": "2026-08-17", "stance": "neutral", "quote": "Being able to ask ssh just to print it out - would be awesome.", "excerpt": "So, I have this which I use about once a day: vis () { vim ~/.ssh/config } But - we have around 250k hosts in about 42 datacenters, some of them going back 8+ years, built by different teams - not everything has been standardized - and : $ wc -l ~/.ssh/config 268 /home/shephard/.ssh/config has lots and lots of weird IP mappings to ssh-keys that is just gross, and not something I would want to expose others to (mostly", "context": "manages ~250k hosts in 42 datacenters", "use_case": "connecting to hosts", "switched_from": "", "story": "OpenSSH 10.5 released, AI fixes now welcome"}, {"id": 788929024, "item_id": 49308064, "url": "https://news.ycombinator.com/item?id=49308064", "by": "jauntywundrkind", "date": "2026-08-14", "stance": "warn", "quote": "You would absolutely not use openssh server for this. That's a terrible idea.", "excerpt": "You would absolutely not use openssh server for this. That's a terrible idea. Pick a library. https://github.com/Eugeny/russh", "context": "", "use_case": "", "switched_from": "", "story": "I close SSH port 22 (and what I use instead)"}, {"id": 788926482, "item_id": 49307905, "url": "https://news.ycombinator.com/item?id=49307905", "by": "mmh0000", "date": "2026-08-14", "stance": "neutral", "quote": "It's still an OpenSSH server with key-auth only.", "excerpt": "I've been using nftables for port knocking for a while now. I run an SSH tunnel server that needs to be globally accessible. But I don't want it getting hammered by bots nonstop. So, I have this nft script which works alongside Firewalld: $ systemctl enable --now nftables $ cat /etc/nftables/portknock.nft table ip portknock {} delete table ip portknock table ip portknock { set knocked { type ipv4_addr flags timeout t", "context": "", "use_case": "SSH server", "switched_from": "", "story": "I close SSH port 22 (and what I use instead)"}, {"id": 788745505, "item_id": 49296594, "url": "https://news.ycombinator.com/item?id=49296594", "by": "d3Xt3r", "date": "2026-08-14", "stance": "warn", "quote": "how bloated (and vulnerable) OpenSSH was", "excerpt": "Nice to finally see a proper Rust SSH server (in the making, I guess). Personally, I've switched to Dropbear years ago because of how bloated (and vulnerable) OpenSSH was (Dropbear is only a couple of hundred KB static binary), but Dropbear is ultimately also written in C, so a Rust-based replacement would be welcome.", "context": "", "use_case": "SSH server", "switched_from": "", "story": "Show HN: OxiSH, a modern, memory-safe SSH server"}, {"id": 788238608, "item_id": 49264913, "url": "https://news.ycombinator.com/item?id=49264913", "by": "throw0101a", "date": "2026-08-11", "stance": "neutral", "quote": "", "excerpt": "> Darn, still no host headers so we can reverse proxy on a single ip How would this be done? After the \"SSH-2.0\" banner, the first packet is SSH_MSG_KEXINIT and there's no space in that for a \"Host\" header: * https://datatracker.ietf.org/doc/html/rfc4253#section-7.1", "context": "", "use_case": "", "switched_from": "", "story": "OpenSSH 10.5 released, AI fixes now welcome"}, {"id": 787676624, "item_id": 49229789, "url": "https://news.ycombinator.com/item?id=49229789", "by": "angry_octet", "date": "2026-08-09", "stance": "recommend", "quote": "OpenSSH authors have spent considerable effort separating concerns, reducing privileges, process isolation", "excerpt": "I can think of better straw men. But if they had approached their task with half the seriousness of the openssh maintainers then they probably wouldn't be failing to check the return value of authentication functions. OpenSSH authors have spent considerable effort separating concerns, reducing privileges, process isolation, etc. So I would say they have been planning for potential bugs. These techniques are very much", "context": "", "use_case": "", "switched_from": "", "story": "Now we have a timeline of the OpenAI accidental attack against Hugging Face"}, {"id": 786474480, "item_id": 49154655, "url": "https://news.ycombinator.com/item?id=49154655", "by": "soblemprolver", "date": "2026-08-03", "stance": "neutral", "quote": "", "excerpt": "I believe the recent cve-2026-55200 in libssh2 (client-side library) was allowing exactly this. https://nvd.nist.gov/vuln/detail/cve-2026-55200 (\"Remote attackers can send crafted SSH packets with excessively large packet_length values to corrupt heap memory and achieve remote code execution.\") Of course the other abouts that you whatted (such as random curl install scripts, binaries, etc.) are still more dangerous.", "context": "", "use_case": "", "switched_from": "", "story": "Show HN: ssh ssh.place"}, {"id": 786445312, "item_id": 49152832, "url": "https://news.ycombinator.com/item?id=49152832", "by": "FooBarWidget", "date": "2026-08-03", "stance": "neutral", "quote": "", "excerpt": "Malicious servers can send malicious terminal escape codes. For example https://www.sentinelone.com/vulnerability-database/cve-2026-41253/", "context": "", "use_case": "", "switched_from": "", "story": "Show HN: ssh ssh.place"}, {"id": 786398688, "item_id": 49149918, "url": "https://news.ycombinator.com/item?id=49149918", "by": "wahern", "date": "2026-08-02", "stance": "neutral", "quote": "OpenSSH only injects delays and chaff when you're actively typing", "excerpt": "If I understand the code correctly, OpenSSH only injects delays and chaff when you're actively typing data through an interactive session directly to the ssh client itself (i.e. it's reading your key strokes from the TTY, as opposed to keystrokes being sent as opaque data over the X11 channel). There would be no disruption to X11 forwarding while you're not actively typing, and even then there's no delay if it can bu", "context": "", "use_case": "", "switched_from": "", "story": "Sharing an X11 Server Across Hosts with FamilyWild"}, {"id": 782700994, "item_id": 48918812, "url": "https://news.ycombinator.com/item?id=48918812", "by": "traceroute66", "date": "2026-07-15", "stance": "recommend", "quote": "In terms of SSH, we use old-school OpenSSH and SSH certificates.", "excerpt": "At $work we use Tailscale mostly because we were running into too many random issues with NAT with our standard DIY Wireguard setup, especially when people were working from hotels and other places with half-ass network setups. But we don't trust Tailscale. Just look at the thousands of unresolved Github issues, many of which are actually quite important/useful but have been ignored for months and years. We very much", "context": "", "use_case": "server SSH access with certificates", "switched_from": "", "story": "TS-2026-009: Insecure argument handling in Tailscale SSH permitted root access"}, {"id": 782290288, "item_id": 48893143, "url": "https://news.ycombinator.com/item?id=48893143", "by": "titularcomment", "date": "2026-07-13", "stance": "recommend", "quote": "OpenSSH is a lifesaver", "excerpt": "Personal laptop use with Ada Lovelace or Ampere family NVIDIA GPUs (did you mean this or CUDA, i couldnt tell), personal desktop use with unusual peripherals, dependency on ports, existence and competition of FreeBSD etc. I love OpenBSD's code philosophy (they were the first to introduce a lot of security techniques[1]) and the programs they produce, OpenSSH is a lifesaver, and I use doas for its low footprint on my ", "context": "", "use_case": "remote access", "switched_from": "", "story": "GhostLock, a stack-UAF that has existed in ALL Linux distributions for 15 years"}, {"id": 780999808, "item_id": 48812488, "url": "https://news.ycombinator.com/item?id=48812488", "by": "throw0101a", "date": "2026-07-06", "stance": "recommend", "quote": "", "excerpt": "> Among other changes 10.4 adds post-quantum keys (composite ML-DSA 44 and Ed25519), not enabled by default. The draft was only published a few months ago: * https://datatracker.ietf.org/doc/draft-miller-sshm-mldsa44-ed25519-composite-sigs/ The draft is a 'personal document', so not associated with the IETF/WG.", "context": "", "use_case": "SSH remote access", "switched_from": "", "story": "OpenSSH 10.4/10.4p1 Released"}, {"id": 774933984, "item_id": 48433374, "url": "https://news.ycombinator.com/item?id=48433374", "by": "MaxBarraclough", "date": "2026-06-07", "stance": "recommend", "quote": "From https://www.openssh.org/pq.html", "excerpt": "This concern doesn't apply if a hybrid approach is used. From https://www.openssh.org/pq.html : > all the post-quantum algorithms implemented by OpenSSH are \"hybrids\" that combine a post-quantum algorithm with a classical algorithm. For example mlkem768x25519-sha256 combines ML-KEM, a post-quantum key agreement scheme, with ECDH/x25519, a classical key agreement algorithm that was formerly OpenSSH's preferred default", "context": "", "use_case": "Post-quantum SSH key exchange", "switched_from": "", "story": "A Post-Quantum Future for Let's Encrypt"}, {"id": 774214816, "item_id": 48388426, "url": "https://news.ycombinator.com/item?id=48388426", "by": "some_furry", "date": "2026-06-03", "stance": "neutral", "quote": "There's an IETF RFC draft for mldsa-44 keys for OpenSSH.", "excerpt": "There's an IETF RFC draft for mldsa-44 keys for OpenSSH. https://datatracker.ietf.org/doc/draft-rpe-ssh-mldsa I'm not aware if it has any real traction, but that's what I found with a quick search.", "context": "", "use_case": "", "switched_from": "", "story": "A Post-Quantum Future for Let's Encrypt"}, {"id": 769463808, "item_id": 48091488, "url": "https://news.ycombinator.com/item?id=48091488", "by": "Borealid", "date": "2026-05-10", "stance": "recommend", "quote": "but it provides value regardless.", "excerpt": "I recommend reading the description of the option `VerifyHostKeyDns` in the `ssh_config` man page. If set to `yes`, you get automatic trust-on-first-use (no user prompt) if you use DNSSec, and you get the current asking-the-user behavior if your DNSSec is broken or you are under attack. Obviously it's more secure if you use DNSSec, because that way you can reflexively deny any request to manually verify a host key, b", "context": "", "use_case": "SSH host key verification", "switched_from": "", "story": "Stop MitM on the first SSH connection, on any VPS or cloud provider"}, {"id": 768999184, "item_id": 48062449, "url": "https://news.ycombinator.com/item?id=48062449", "by": "jmclnx", "date": "2026-05-08", "stance": "warn", "quote": "the real issue was patching OpenSSH", "excerpt": ">Did the OpenSSH folks know (or care) that ifunc was a thing? It's certainly not a thing on OpenBSD. I do not know why you were down-voted, maybe you deserved no up-votes, but down-votes to me were a bit extreme :) But that quote tends to indicate to me the author put a little blame on OpenSSH Developers. Maybe the author did not intend it to be read in the way I read it. OpenSSH developers should not need to know wh", "context": "", "use_case": "", "switched_from": "", "story": "GNU IFUNC is the real culprit behind CVE-2024-3094"}, {"id": 767403184, "item_id": 47962699, "url": "https://news.ycombinator.com/item?id=47962699", "by": "BoppreH", "date": "2026-04-30", "stance": "neutral", "quote": "", "excerpt": "There are also scanners that you can deploy to identify vulnerable servers, like https://sshcheck.com/ . Clients are harder to check, but you can always observe your logs.", "context": "", "use_case": "", "switched_from": "", "story": "Scott Aaronson on quantum: \"Will you heed my warnings NOW?\""}, {"id": 762129152, "item_id": 47633072, "url": "https://news.ycombinator.com/item?id=47633072", "by": "AceJohnny2", "date": "2026-04-03", "stance": "neutral", "quote": "certs are indeed well-supported by OpenSSH", "excerpt": "Adding to this: while certs are indeed well-supported by OpenSSH, it's not always the SSH daemon used on alternate or embedded platforms. For example, OpenWRT used Dropbear [1] instead, which does not support certs. Also, Java programs that implement SSH stuff, like Jenkins, may be doing so using Apache Mina [2] which, though the underlying library supports certs, it is buggy [3] and requires the application to add t", "context": "", "use_case": "", "switched_from": "", "story": "SSH certificates: the better SSH experience"}, {"id": 762039616, "item_id": 47627476, "url": "https://news.ycombinator.com/item?id=47627476", "by": "bobo56539", "date": "2026-04-03", "stance": "neutral", "quote": "I could not find an easy way to limit maximum certificate lifetime in openssh", "excerpt": "With the recent wave of npm hacks stealing private keys, I wanted to limit key's lifetimes. I've set up a couple of yubikeys as SSH CAs on hosts I manage. I use them to create short lived certs (say 24h) at the start of the day. This way i only have to enter the yubikey pin once a day. I could not find an easy way to limit maximum certificate lifetime in openssh, except for using the AuthorizedPrincipalCommand, which", "context": "manages hosts, uses YubiKeys as SSH CAs", "use_case": "SSH certificate authority for hosts", "switched_from": "", "story": "SSH certificates: the better SSH experience"}, {"id": 760273408, "item_id": 47517088, "url": "https://news.ycombinator.com/item?id=47517088", "by": "bpt3", "date": "2026-03-25", "stance": "compare", "quote": "", "excerpt": "https://www.ibm.com/opensource/community-involvement/ https://arstechnica.com/information-technology/2014/04/tech-giants-chastened-by-heartbleed-finally-agree-to-fund-openssl/", "context": "", "use_case": "", "switched_from": "", "story": "Open source isn't a tip jar \u2013 it's time to charge for access"}, {"id": 758765600, "item_id": 47422850, "url": "https://news.ycombinator.com/item?id=47422850", "by": "thomashabets2", "date": "2026-03-18", "stance": "recommend", "quote": "I'd just use SSH ProxyCommand like I did in https://github.com/ThomasHabets/huproxy", "excerpt": "While not transparent to users, I'd just use SSH ProxyCommand like I did in https://github.com/ThomasHabets/huproxy Not exactly what i built in for, but it'll do the job here too, and able to connect to private addresses on the server side.", "context": "", "use_case": "", "switched_from": "", "story": "SSH has no Host header"}, {"id": 757832641, "item_id": 47364540, "url": "https://news.ycombinator.com/item?id=47364540", "by": "zimpenfish", "date": "2026-03-13", "stance": "neutral", "quote": "", "excerpt": "That is a neat trick. Added to the list. (Ultimately unhelpful though because I use mosh everywhere these days and that doesn't appear to have anything fancy like this.)", "context": "", "use_case": "SSH port forwarding", "switched_from": "", "story": "TUI Studio \u2013 visual terminal UI design tool"}, {"id": 757432960, "item_id": 47339560, "url": "https://news.ycombinator.com/item?id=47339560", "by": "Kim_Bruning", "date": "2026-03-11", "stance": "neutral", "quote": "Used ssh for years", "excerpt": "consider me one of the lucky 10000 . Used ssh for years, didn't know this! https://xkcd.com/1053/", "context": "", "use_case": "", "switched_from": "", "story": "SSH Secret Menu"}, {"id": 757346592, "item_id": 47334162, "url": "https://news.ycombinator.com/item?id=47334162", "by": "nh2", "date": "2026-03-11", "stance": "neutral", "quote": "The reason that is disabled in current OpenSSH by default is OpenBSD `pledge` support", "excerpt": "`EnableEscapeCommandline` only controls the <Enter>~C commandline. The reason that is disabled in current OpenSSH by default is OpenBSD `pledge` support: https://security.stackexchange.com/questions/280793/what-attack-vectors-are-enabled-on-ssh-with-the-usage-of-enableescapecommandline On my Linux, cat<Enter>~. closes the connection as expected, and no ~ is shown in the terminal.", "context": "", "use_case": "Remote shell access", "switched_from": "", "story": "SSH Secret Menu"}, {"id": 757332752, "item_id": 47333297, "url": "https://news.ycombinator.com/item?id=47333297", "by": "m132", "date": "2026-03-11", "stance": "neutral", "quote": "", "excerpt": "You can get a lot more out of ProxyCommand. For example, you can run SSH over non-IP protocols, such as serial, Bluetooth RFCOMM for embedded boards, or vsock for virtual machines without networking set up at all. The latter is built into and setup up automatically by systemd: https://www.freedesktop.org/software/systemd/man/257/systemd-ssh-proxy.html", "context": "", "use_case": "", "switched_from": "", "story": "SSH Secret Menu"}, {"id": 757307360, "item_id": 47331710, "url": "https://news.ycombinator.com/item?id=47331710", "by": "alwillis", "date": "2026-03-10", "stance": "neutral", "quote": "It's not hidden or undocumented; it's in the man page.", "excerpt": "It's not hidden or undocumented; it's in the man page. Here's 15-year old HN link about it: http://grack.com/blog/2011/02/23/ssh-escape-sequences-or-dont-kill-9-that-process/", "context": "", "use_case": "", "switched_from": "", "story": "SSH Secret Menu"}, {"id": 757289920, "item_id": 47330620, "url": "https://news.ycombinator.com/item?id=47330620", "by": "MayeulC", "date": "2026-03-10", "stance": "recommend", "quote": "I use another little-known feature", "excerpt": "I typically just create a \"new\" connection in a separate tab when I want to add tunneling. I put new in quotes because I use another little-known feature, \"ControlMaster\". Multiplexes multiple connections into one, it makes making \" new\" sessions instant (can also be configured to persist a bit after disconnecting). Also useful for tab-completing remote paths. It does not prompt for authentication again, though. And ", "context": "", "use_case": "Remote shell and tunnels", "switched_from": "", "story": "SSH Secret Menu"}, {"id": 755830498, "item_id": 47239406, "url": "https://news.ycombinator.com/item?id=47239406", "by": "chasil", "date": "2026-03-03", "stance": "warn", "quote": "Modern OpenSSH is a nightmare when using legacy crypto", "excerpt": "Several reasons. -PuTTY pscp allows raw passwords on the command line, or from a file. OpenSSH is unreasonable in refusing to do this. -Scripting can adapt to a .netrc easily; OpenSSH will never do this. -Modern OpenSSH is a nightmare when using legacy crypto, while pscp is fluid. There is nothing wrong with hmac-md5, and no reason to refuse it. I will take PuTTY or dropbear in a heartbeat over these burned bridges a", "context": "", "use_case": "", "switched_from": "", "story": "Disable Your SSH access accidentally with scp"}, {"id": 755786049, "item_id": 47236628, "url": "https://news.ycombinator.com/item?id=47236628", "by": "chasil", "date": "2026-03-03", "stance": "warn", "quote": "Their pscp implementation is a better drop-in replacement than the OpenSSH solutions.", "excerpt": "I have a few observations about this article. Generally, try not to use SCP. It has been a crufty old program from the Berkeley R-Utilities, but newer OpenSSH releases have rewritten it to use the sftp-server server instead. There will be wildly different behavior between these implementations. The backend SCP changes are documented here: https://lwn.net/Articles/835962/ If you need something that SFTP cannot do, the", "context": "", "use_case": "", "switched_from": "", "story": "Disable Your SSH access accidentally with scp"}, {"id": 754724178, "item_id": 47170261, "url": "https://news.ycombinator.com/item?id=47170261", "by": "amiga386", "date": "2026-02-26", "stance": "neutral", "quote": "OpenSSH does not use liblzma (xz) at all.", "excerpt": "systemd was the key to the whole backdoor. OpenSSH is maintained by the OpenBSD developers. OpenSSH does not use liblzma (xz) at all. Linux distros which chose to switch to systemd also chose to patch OpenSSH to call systemd's sd_notify() function, to inform systemd when sshd is fully started. This sd_notify() function is in the huge, sprawling kitchen sink of a library called libsystemd. sd_notify() is only a few li", "context": "", "use_case": "", "switched_from": "", "story": "Story of XZ Backdoor [video]"}, {"id": 751819792, "item_id": 46988737, "url": "https://news.ycombinator.com/item?id=46988737", "by": "Bender", "date": "2026-02-12", "stance": "recommend", "quote": "In sshd_config there are some directives that can close unused connections.", "excerpt": "This seems like a complex solution to a simple problem. In sshd_config there are some directives that can close unused connections. [1][2] as of OpenSSH 9.2 Another solution is to set a read-only shell timeout on servers and managed clients. This can annoy people causing them to do silly work-arounds so coordinate with your teams before applying this everywhere. Find an agreed upon and reasonable timeout that does no", "context": "", "use_case": "Closing idle SSH connections", "switched_from": "", "story": "Show HN: Crank \u2013 The SSH Terminal Manager for Engineers Who Refuse to Close Tabs"}, {"id": 751511312, "item_id": 46969457, "url": "https://news.ycombinator.com/item?id=46969457", "by": "accrual", "date": "2026-02-10", "stance": "neutral", "quote": "One can disable root login via SSH in /etc/ssh/sshd_config.", "excerpt": "> ssh needs a capability to let root logins One can disable root login via SSH in /etc/ssh/sshd_config. sshd also drops root priviledges once it's running IIRC. I use use sudo or doas as a regular user once logged in.", "context": "", "use_case": "Remote shell access", "switched_from": "", "story": "The Day the Telnet Died"}, {"id": 749762354, "item_id": 46860147, "url": "https://news.ycombinator.com/item?id=46860147", "by": "nh2", "date": "2026-02-02", "stance": "neutral", "quote": "OpenSSH seems to generally implement that", "excerpt": "> has a hardcoded maximum receive buffer of 2MiB For completeness, I want to add: The 2MiB are per SSH \"channel\" -- the SSH protocol multiplexes multiple independent transmission channels over TCP [1], and each one has its own window size. rsync and `cat | ssh | cat` only use a single channel, so if their counterparty is an OpenSSH sshd server, their throughput is limited by the 2MiB window limit. rclone seems to be ", "context": "", "use_case": "", "switched_from": "", "story": "4x faster network file sync with rclone (vs rsync) (2025)"}, {"id": 747598273, "item_id": 46724892, "url": "https://news.ycombinator.com/item?id=46724892", "by": "gucci-on-fleek", "date": "2026-01-22", "stance": "recommend", "quote": "I suspect that OpenSSH is fairly well tested on crappy computers/networks.", "excerpt": "I agree with your general point that most companies/projects do a terrible job optimizing for slow computers/networks, but OpenSSH is from the OpenBSD people, who are well-known for supporting ancient hardware [0]. Picking a random architecture, they fully support a system with only 64MB of memory [1], and the base install includes SSH. So I suspect that OpenSSH is fairly well tested on crappy computers/networks. [0]", "context": "", "use_case": "", "switched_from": "", "story": "Why does SSH send 100 packets per keystroke?"}, {"id": 746527009, "item_id": 46657938, "url": "https://news.ycombinator.com/item?id=46657938", "by": "opan", "date": "2026-01-17", "stance": "recommend", "quote": "OpenSSH in the default install", "excerpt": ">the argument used to be you used Windows instead of Linux because on Linux you might occasionally have to use the scary terminal to fix an issue This always annoys me because you're really handicapping yourself by ignoring the CLI on any OS. Sure I use it more heavily on GNU/Linux than I did on Windows as a kid, but that's because it's so good. If I'm ever in front of a Windows machine now I still like to have a ter", "context": "", "use_case": "", "switched_from": "", "story": "PCs refuse to shut down after Microsoft patch"}, {"id": 744319009, "item_id": 46519938, "url": "https://news.ycombinator.com/item?id=46519938", "by": "wolfgang000", "date": "2026-01-06", "stance": "recommend", "quote": "I ssh into my PC, and everything just works.", "excerpt": "Same setup as mine, I have an OpenVPN server running in my router, and my main PC has wake-on-lan and a KVM as a backup to turn it on and off. I have an old used Dell Latitude that I use as a pseudo thin client. I ssh into my PC, and everything just works. I really like this setup because I only have one environment, so everything is there, and I don't have to install anything in the laptop", "context": "", "use_case": "Remote terminal access", "switched_from": "", "story": "Stop Doom Scrolling, Start Doom Coding: Build via the terminal from your phone"}]}