Hacker Newsnew | past | comments | ask | show | jobs | submitlogin

It's interesting that PSCP has this option:

    -unsafe   allow server-side wildcards (DANGEROUS)
and as explained in the doc (https://www.ssh.com/ssh/putty/putty-manuals/0.68/Chapter5.ht...),

"This is due to a fundamental insecurity in the old-style SCP protocol: the client sends the wildcard string (*.c) to the server, and the server sends back a sequence of file names that match the wildcard pattern. However, there is nothing to stop the server sending back a different pattern and writing over one of your other files"

I haven't used the Linux version much so I assumed it had the same option. PSCP has had this option for as long as I can remember. I guess no one bothered to look at scp, or as one of the other comments here notes, scp is overwhelmingly used with a server one already trusts.



> I guess no one bothered to look at scp, or as one of the other comments here notes, scp is overwhelmingly used with a server one already trusts.

It's the latter for me. It's not just wildcards. You can use any server-side shell code you want to specify the files as if you're writing in a command argument[1]. At least, I find this tremendously useful.

[1] https://news.ycombinator.com/item?id=18912188


I strongly discourage anyone from using PuTTY, not for this reason, but for its weird and nonstandard handling of SSH keys.

The last time I tried to help someone get it set up on a windows PC, totally normal ssh2 rsa 2048 and 4096 bit public/private key pairs created with openssh had to be converted into some other weird format before they could get public/private key auth working.

Why the developers of putty felt they needed to deviate from standard ssh2-rsa pub/privkey formats is a mystery to me.


PuTTY's changelog from 2000 shows that PuTTYgen uses "the same RSA key file format as SSH 1" (the proprietary one, that predates OpenSSH).

Reading and writing OpenSSH-style keys came later (2012).

https://www.chiark.greenend.org.uk/~sgtatham/putty/changes.h...


It's quite easy. There are multiple tutorials on it. When you load up a key into putty the plain old key you're used to is sitting right there in a box in the app. Just copy.




Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: