<html><body><div style="color:#000; background-color:#fff; font-family:times new roman, new york, times, serif;font-size:12pt"><div>Hello,</div><div><br></div><div>Some BSD users sent me a link about mosh (The ``OpenSSH killer").</div><div><br></div><div>It has some nice features: better response time & (local character echo-ing).</div><div><br></div><div>The latter is a pretty weird idea. local character echoing should be integrated into a shell,</div><div>but they chose otherwise.</div><div><br></div><div>It also does not require any privileges (binding to port 22 runs as root !?).</div><div><br></div><div>I was initially impressed by some of their design ideas. However, when I had a quick look</div><div>at the code, I couldn't help but notice questionable practices (getenv(), threads, etc..) which are susceptible</div><div>to timing attacks.</div><div><br></div><div>Also, they claim do to fix bugs that OpenSSH doesn't fix (UTF-8). Those issues
were present in older versions</div><div>of OpenSSH released around 2006.</div><div><br></div><div>Last but not least, I see that they used GPLv3 and asked Richard Stallman for technical expertise. No comments about</div><div>a 10-page license and RMS's security expertise :-)</div><div><br></div><div>I'm not bashing mosh because I contribute to OpenSSH, but I think it still has a long way to go before it can be considered </div><div>a comparable replacement :-)</div><div><br></div><div><br></div></div></body></html>