On: Outdated, vulnerable open source components shippe...

[joenathanone]

SSH -V on Windows 11 returns

>OpenSSH_for_Windows_8.1p1, LibreSSL 3.0.2

[1over137 → joenathanone]

That LibreSSL is newer than even the latest macOS 12 Monterey beta: OpenSSH_8.6p1, LibreSSL 2.8.3

[pseudosavant → 1over137]

Yeah, but nobody has fun hating on Mac any more right? Thanks for the context.

[gjsman-1000 → pseudosavant]

Perhaps - but Apple has used very old core utilities for a very long time (licensing issues) but ensures they get security updates. Until recently, they used, what, bash from 2006?

[1over137 → gjsman-1000]

There's no licensing issue with LibreSSL, nor any of the other ancient utilities from FreeBSD or elsewhere that Apple doesn't keep up-to-date.

[_-david-_ → 1over137]

There were issues with utilities that were using GPLv3. That is why they switched to Zsh instead of Bash for example.

[bombcar → 1over137]

If the old version has known security flaws it should be possible to exploit them, correct?

If those exploits don’t work perhaps Apple is playing dolly nuggets with the version number.

[arp242 → bombcar]

Nah, there are all sorts of missing features, some of which were added over a decade ago. With a few small exceptions and modifications much of the Unix base has been quite dead for a long time.

[simonh → arp242]

The suggestion being made is that bugs and vulnerabilities are being fixed without adding new features, in order to provide a safe but very stable feature set.

[eftychis → pseudosavant]

Well people (including me) are bashing Apple for this deviation. Also it has been a constant consideration when linking/shipping binaries in production. So I feel it is fine to bash Microsoft for doing the same thing.

Perhaps Microsoft has an ABI reason for doing so? I can't imagine why else.

[JDW1023 → joenathanone]

According to https://www.libressl.org/releases.html, LibreSSL 3.0.2 was released on October 19th, 2019. So it's exactly two years out of date.

edit: on my windows 10 21H1, the timestamp in COFF/File header for ssh.exe shows '1584509394' (Wed, 18 Mar 2020 05:29:54 UTC).

[neodymiumphish → joenathanone]

Odd, I'm on the Dev insider build (22478.1012) and I see

> OpenSSH_for_Windows_8.6p1, LibreSSL 3.3.3

[tarnith → joenathanone]

Same on Win 10 21H1 19043.1288 ssh -V OpenSSH_for_Windows_8.1p1, LibreSSL 3.0.2

[e12e → joenathanone]

Same for the daemon? (yes, windows comes with (installable) ssh daemon now).

[dachryn → joenathanone]

SSH --V on Windows 10 returns OpenSSH_for_Windows_7.7p1, LibreSSL 2.6.5

[jve → dachryn]

Mine Win10 returns: OpenSSH_for_Windows_8.1p1, LibreSSL 3.0.2

  where.exe ssh.exe
  C:\Windows\System32\OpenSSH\ssh.exe
  systeminfo.exe | sls "OS V"
  OS Version:                10.0.19043 N/A Build 19043

[Semaphor → joenathanone]

Getting the same for win 10 20H2 (Build 19042.1288)