SSH Claims Draw Open Source Ire

JDStone writes to tell us eWeek is reporting that claims of OpenSSH not being an 'enterprise-class product' by SSH Communications, the creators of SSH, is being met with a great deal of resistance. Theo de Raadt, of OpenBSD fame and a member of the OpenSSH development team was quoted saying "OpenSSH is built into all Unix and Linux vendor operating systems, and is also built into almost all larger managed network switches, from Cisco through Foundry. It comes on Linksys and D-Link wireless and security routers too."

Comments

Well it makes perfect sense

[Psx29]

I'm sure SSH Communications stands to make more money if they can discredit a free, opensource product.

Re:Well it makes perfect sense

[heelios]

Thank you much, Mr. Obvious!

Re:Well it makes perfect sense

[Psx29]

shhh, I got first post and managed to keep it on topic, I'm happy.

Re:Well it makes perfect sense

[ePhil_One]

I'm sure SSH Communications stands to make more money if they can discredit a free, opensource product.

Unfortunately, Theo de Raadt chose to counter his claims with "installed base" numbers, which do absolutely nothing to discredit their statements. Of course, the article doesn't have any of those statements either.

Re:Well it makes perfect sense

[ePhil_One]

THE PRESS RELEASE FROM http://www.ssh.com/

On May 10, 2005, The New York Times published an article concerning a breach at Cisco System, in which an intruder seized programming instructions for many of the computers that control the flow of Internet traffic. The attention was focused on a 16-year-old in Uppsala, Sweden, who was charged in March with breaking into university computers in his hometown. The crucial element in the attack that provided access at Cisco and elsewhere was the intruder's use of a vulnerable version of Secure Shell software.

Should organizations using Secure Shell become worried? Is this something that could also happen in your network?

SSH1 vs. SSH2
There are two versions of the Secure Shell protocol. The current version, Secure Shell version 2 (SSH2) introduced by SSH Communications Security in 1998 provides several security improvements compared to the original Secure Shell version 1 (SSH1). SSH Communications Security considers SecSh v1 vulnerable and does not recommend its use. The first step in eliminating vulnerabilities in your Secure Shell environment would be to upgrade all SSH1 to SSH2.

Security Maintenance Challenge
But it is not just environments running old SSH1 protocol versions that may be vulnerable against known exploits that can result in similar incidents like the one mentioned in The New York Times article.

For example, several vulnerabilities have been discovered over recent years in the widely used open-source implementation of Secure Shell protocol, OpenSSH.

Keeping OpenSSH environments secure requires constantly updating the environment with latest security patches. However, updating OpenSSH servers involves an extremely laborious and time-consuming process of source-code compilation, testing, installation, and configuration. In large-scale environments this leads to a heavy administrative burden and increased costs. As a result, during the times of constrained IT budgets many organizations have been forced to neglect frequent security patches and software updates making them vulnerable.

Even if organizations are willing to go through the costly process of manually maintaining the software on a regular basis, lack of centralized management can still present a risk. The New York Times writes:

"Government investigators and other computer experts watched helplessly while monitoring the activity, unable to secure some systems as quickly as others were found compromised."

Given the increased use of automation and sophistication of attacks, the window of opportunity for reacting to new security threats is becoming smaller. Therefore, centralized, real-time management of security systems is a critical building block in comprehensive enterprise security.

Solution - SSH Tectia
SSH Communications Security, the original developer of the Secure Shell protocol, provides end-to-end communications security solutions specifically for the enterprise. Its SSH Tectia solution has been developed to overcome the security and manageability issues of large-scale Secure Shell environments.

By standardizing on SSH Tectia throughout heterogeneous enterprise networks, including Windows, Unix, Linux, and IBM mainframes, organizations can cost-effectively implement secure practices for maintaining and using Secure Shell.
The key features and benefits of SSH Tectia for ensuring secure operation include:

Centralized Secure Shell software management enabling real-time updates to a large number of hosts and reducing the window of opportunity for exploits.

Centralized Secure Shell monitoring allowing fast identification of system anomalies.

Enterprise-class support and maintenance services including 24x7 support option enabling fast problem resolution.

FIPS 140-2 certification of cryptographic libraries serving as a proof of reliable implementation of cryptographic functions.

The enterprise-proven Secure Shell code of SSH Tectia is based on the 10 years to in-depth experience of the original development team of secure shell, and based fully on the secure, industry-proven SSH2 protocol.

Re:Well it makes perfect sense

[Anonymous Coward]

Unfortunately, Theo de Raadt chose to counter his claims with "installed base" numbers, which do absolutely nothing to discredit their statements.

They claimed OpenSSH was not "enterprise ready". Pointing out that many, many enterprises not only use it, but build it into their products is a fairly compelling rebuttal.

They are either using their own private definition of "enterprise" that doesn't include organisations like Cisco, or they are lying. Either way, they are discredited.

Re:Well it makes perfect sense

[jellomizer]

And that is pritty good espectilly that you are not a subscriber. So you don't have time to prep for a first post in you copy buffer.

Re:Well it makes perfect sense

[Anonymous Coward]

You know, you're right. He should get an automatic +1 Not Garcia- and a +1 Not Batman- Not Karma Whoring mod.

Re:Well it makes perfect sense

[Anonymous Coward]

However, updating OpenSSH servers involves an extremely laborious and time-consuming process

Yeah, running

apt-get update && apt-get install ssh

is sooo hard.

Re:Well it makes perfect sense

[Takumi2501]

For example, several vulnerabilities have been discovered over recent years in the widely used open-source implementation of Secure Shell protocol, OpenSSH.

Of course you're going to find vulnerabilities more easily in an open source implementaion. If you can't see the source, it's harder to find problems. It doesn't mean they're not there.

That being said, I can understand how the frequent patches can present a problem in a large-scale network. I'm just not a fan of security through obscurity.

Re:Well it makes perfect sense

[Atrus5]

"Keeping OpenSSH environments secure requires constantly updating the environment with latest security patches."
This is the only mention of the frequency of patches. They never claim that you have to patch their version less often.

However, updating OpenSSH servers involves an extremely laborious and time-consuming process of source-code compilation, testing, installation, and configuration.
This is the statement that upsets me the most. Distributions usually provide binaries. How are are these binaries different from recieving a binary from anywhere else? How does recieving a binary remove the need for testing? The only case I see the proprietary solution is when you have the same environment that the binary was tested in.

The remainder of that paragraph just claims that exorbitant costs ensue when you test updates. The obvious thing to do is, in some way, compare the values for each product:
(number of releases) * (cost of testing each release) + (probability of threat between releases) * (cost of compromise)

Re:Well it makes perfect sense

[EddyPearson]

I'm interested in what these "revolutionary" improvements that SSH have made, actaully are?
I mean, SSH = Secure Shell. OpenSSH is A)Secure and B)A Shell.
Clearly i need an accountant to tell me all about these new features. Exiting new features like: Maybe, just maybe, SSH will still have a imaginary market share when this is all over.
I feel the best way to express the article is as and IRC chat log (stay with me...)

SSH invites OpenSSH to #WeNeedABigLoan
SSH: We're better than you.
OpenSSH: Not too sure about that...
SSH: We are! Because bigger businesses like us!
OpenSSH: Hmm, the figures say no.
SSH: Well...They're wrong too!
OpenSSH: Ok, so why are you better?
SSH: Well, we're closed source, thats gotta count for somthing right?
OpenSSH: Well, yes, it means you're probably using our code...
SSH: Oh yeah!! Well whats so great about OpenSSH?
OpenSSH was kicked by Q (SPAM. No more that 10 lines to the chan consecutivly)

Re:Well it makes perfect sense

[bobs666]

They claimed OpenSSH was not "enterprise ready". Pointing out that many, many enterprises not only use it, but build it into their products is a fairly compelling rebuttal.

Not to mention that SSH Communications Security Corp.'s version is not compatable with the OpenSSH that is allready fielded at many enterprise sights.

Are they implyinng the DOD isn't an Enterprise class network?

Yep, Large parts of the Army (AMC) have been told to run OpenSSH. I don't know about the rest of the DoD.

Re:Well it makes perfect sense

[Anonymous Coward]

They claimed OpenSSH was not "enterprise ready". Pointing out that many, many enterprises not only use it, but build it into their products is a fairly compelling rebuttal.

No, that makes it the de facto standard, not enterprise ready. It means that fact that SSH Communications Security Corp.'s version is not compatable with the OpenSSH makes it not "enterprise ready" (do they think I can upgrade the SSH server in my router?). Many Many companies use Spybot S&D, but its far from enterprise ready. Of course, there is no definition for "enterprise ready", but I know any system that requires me to visit every machine isn't it.

Re:Well it makes perfect sense

[linuxfanatic1024]

Keeping OpenSSH environments secure requires constantly updating the environment with latest security patches. However, updating OpenSSH servers involves an extremely laborious and time-consuming process of source-code compilation, testing, installation, and configuration. In large-scale environments this leads to a heavy administrative burden and increased costs. As a result, during the times of constrained IT budgets many organizations have been forced to neglect frequent security patches and software updates making them vulnerable.

Don't most Linux/Unix distributions that include OpenSSH provide binary packages that can be easily updated?

Re:Well it makes perfect sense

[Anonymous Coward]

No, that makes it the de facto standard, not enterprise ready.

Okay, I give up, you are obviously speaking the language of PHBs.

If enterprises rely on it, then it is - by definition - enterprise-ready.

so....

[ace_brickman]

This means that paying for a product is going to make it better?

What else would SSH Communications say?

[CSHARP123]

Byron Rashed, senior marketing communications manager of SSH Communications Security, claimed that SSH's product is better suited for enterprise-scale business applications than a similar open-source product from OpenSSH.

They are selling a product and they will say that to sell their product. Come on what else would you expect. This is like MS saying Windows is more Secure than Linux even though everybody knows the truth.

Re:What else would SSH Communications say?

[Anonymous Coward]

hmmm dam it, someone has to say it..

M$ is like sooo trying to take your money..don't you see it? Microsoft pays this SSH guy to discredit OpenSSH and then everyone goes and say "OpenSSH is not secure".

Re:What else would SSH Communications say?

[Anonymous Coward]

Yep we know that windows is more secure.
Linux's so said "perfect" security record is a pipedream which was dreamed up by linuz zealots.

Re:What else would SSH Communications say?

[Husgaard]

They are selling a product and they will say that to sell their product. Come on what else would you expect.

We no longer just accept that corporations tell lies to the public. Now we also expect it...

Doesn't truth matter anymore?

Re:What else would SSH Communications say?

[Nazadus]

I disagree, Linux is usually more secure. However the problem is that people say Linux is secure. Their is a difference between being secure and "more secure than another operating system". One implies a false sense of security.

We chose Microsoft at my emplyoers place. Why? Becuase anyone can do it. For a small business, they can't afford a highly trained professional just to add a stinking user or make minor changes. Yeah, ideally you want a highly trained professional -- but unless the Linux Zealots are willing to work *for free* then the prhase of "put up and shut up" comes to mind... sadly, they don't shut up.

I've come to the following conclusion: If you can afford to take the time configuring Linux *and* have someone always around *and* a backup to that person, then Linux *might* be the way to go.

I like OpenBSD... it's becoming more and more pracitcal everyday without the fear of infections.

Oh, and Chevy is better. ;-)

But seriously, everyone should remember: Your operating system is a TOOL, not a religion. When you die, it doesn't go with you. It can only make your life better or worse. Everyone has a different need (otherwise, why be human? just be a drone? and we all just love drones, don't we?).

I'll be modded to hell for this blasphemous post.

Re:What else would SSH Communications say?

[Rodness]

Of course, "enterprise-scale" is a buzzword used by cathedral-style development houses who want to sell their products to "enterprise-scale" pointy-haired middle managers who have absolutely no idea how to parse buzzwords and hype with any degree of skepticism.

In my "enterprise", we prefer the open-source far-more-used-and-debugged combination of OpenSSH and PuTTY. SSH Communications is probably going to attack PuTTY next, spouting about how it's not as good as their shitty windows terminal either.

Re:What else would SSH Communications say?

[killjoe]

Not to corporations. Corporations are psychotic entities. If they were human beings they would be rapists, mass murderers, thieves, and all around criminals.

recently somebody did a study of mass murderers and found out that virtually every single one of them could not perform a simple test that measured impulse control. It seems like inability to control impulses is a necessary trait (although not sufficient) for mass murderers. Corporations also can not control their impulses. They have no concept of delayed gratification or long range planning. They live for the moment and need instant gratification. Corporations also lack empathy just like mass murders.

I suppose that's all to be expected from soul-less creatures like corporations. When you summon a soul-less immortal being into existance you should brace for the worst right?

Re:What else would SSH Communications say?

[Hosiah]

Doesn't truth matter anymore?

Depends. Are we talking more or less than money? Because this morning, truth lost 15 points on the Dow Jones, accompanied by plunges in honor, character, dignity, and responsibility. Greed's arrow still has the pointy part at the top, and is still green. Hey, if you love a Capitalist system, yah gotta love all of it!

Re:What else would SSH Communications say?

[Z4rd0Z]

What does being psychotic have to do with being a rapist, murderer, or any type of criminal whatsoever? Maybe you mean psychopathic?
</nerd>

Re:What else would SSH Communications say?

[Spit]

Doesn't truth matter anymore?

Yes. *snigger*

Re:What else would SSH Communications say?

[indigoid]

tripe.

corporations, public ones at least, have the sole aim of filling their shareholders' pockets. they are required to do the best they legally can for their shareholders; this must always be the first consideration when they hand down orders to the little peons in the corporate machine rooms.

with the above in mind it makes perfect sense for them to talk themselves up and the competition down.

as for long range planning... have you ever chatted with a director or CEO of a decently sized corporation? you'd be surprised...

Re:What else would SSH Communications say?

[ChadN]

recently somebody did a study of mass murderers

Uh huh... Could you, perhaps, give us the name of "somebody" or provide a reference to the study? I'd be curious as to how "somebody" got access to all these "mass murderers", how many they tested, how they recruited them, etc:

Dear Mass Murderer,

      While you wait on Death Row, I wonder if you would interested in participating in a study. You will receive $15 per hour....

Re:What else would SSH Communications say?

[dgatwood]

This is like MS saying Windows is more Secure than Linux even though everybody knows the truth.

Nope. This is more like saying Mac OS X is more secure when used by an average desktop user than Linux. While it isn't always true, it isn't always false. It depends on the Linux variant. Similarly, the issue of enterprise readiness depends on what mechanism was used to install OpenSSH.

This software (assuming I read their ad copy correctly) provides built-in support for enterprise-wide deployment and detection of attempts to access the system by old, vulnerable versions. This means that the IT department can prevent security vulnerabilities from remaining unpatched much more easily than with software that doesn't have such features. All software should have a built-in automatic update mechanism, at least for security vulnerabilities. The lack thereof DOES make OpenSSH a poor choice for enterprise-scale deployment outside of the tech sector.

Don't get me wrong, OpenSSH and OpenSSL are cool, but the ONLY reason that enterprises use them in their products is that those enterprises have already build their own auto-update mechanisms for keeping things up-to-date, and thus, they don't need a separate mechanism for OpenSSH. While that works for an OS vendor like Cisco or a hardware vendor like Netgear, it doesn't work too well for a 500 person company in the financial sector, for example.

By itself, without the support of an OS vendor, OpenSSH is NOT enterprise-ready, and anyone who says otherwise is kidding him/herself.

Re:What else would SSH Communications say?

[Anonymous Coward]

What you just wrote is nonsense. Openssh comes with the OS so it is as easy to update as any other package on the box is. For instance if you are using RHEL you would update openssh using up2date or yum. It doesn't get any easier than that.

Re:What else would SSH Communications say?

[dgatwood]

Nonsense? Here's a list of a few things wrong with your opinion on this subject, just to get you started:

1. NOT EVERY OS comes with OpenSSH. Linux distros... probably. Windows... no.
2. Those mechanisms you describe for RedHat Linux require manual execution of a command on every system. Do that on 500 desktops around a company and yes, it DOES get easier than that.
3. The entire point of my post was that if you have an auto-update mechanism already, it's a non-issue, but that not everyone does. You immediately counter that with a straw-man argument, claiming that everyone has an auto-update mechanism, missing the entire point of my post, which was that this is not the case.

It's this sort of ego problem that really hurts acceptance of open source in the corporate world. It's also the most serious threat to security that I can think of. It's the reason that MSIE is such a big-ridden nightmare. Everyone thinks that they know better and don't bother listening to anyone else's opinion. It frequently comes back to bite them in the backside.

Re:What else would SSH Communications say?

[willpall]

We no longer just accept that corporations tell lies to the public. Now we also expect it...

I don't know of a time when it was any other way. In the 30s ~ 60s, the cigarette companies extolled the health virtues of their product. Every car company since the invention of the automobile has found a way to state that their brand was the most reliable (there's always a survey or study that will support whatever claim you want to make. One company might use JD Power short-term quality, another might use the long term numbers, still another will use the percentage of vehicles sold that are still registered today, still another will use their lame in-house surveys. In the end, they're all telling the "truth")

It's better that we expect it today, that simply means that the consumer is more aware and appropriately cynical. In any case, there was never a time when companies--or to use its evil counterpart--corporations were as straight as they could be with the public. I'm sure there's been exceptions, but for the most part, marketing is made of this stuff.

It's not new.

Re:What else would SSH Communications say?

[Anonymous Coward]

Of course, "cathedral-style" is a buzzword used by dorky OSS hobbyists who want to be accepted by other dorky OSS hobbyists who have absolutely no idea how to parse buzzwords and group-think with any degree of skepticism.

Hypocrite.

Re:What else would SSH Communications say?

[killjoe]

"corporations, public ones at least, have the sole aim of filling their shareholders' pockets. they are required to do the best they legally can for their shareholders; this must always be the first consideration when they hand down orders to the little peons in the corporate machine rooms."

I agree with you. With a sociopath their impulse is to kill or rape somebody and they can't help but act on that impulse. Their higher thinking centers don't kick in and their lack of empathy makes it easy for them to take lives and to rape people.

COrporations are exactly the same. Their impulse is to make money and they can't help but act on it and their lack of empathy makes it easy for them to act in savage and inhumane manner.

Re:What else would SSH Communications say?

[hhw]

1. But the OSes that actually USE OpenSSH DO include it, which is the point. Lack of builtin features to update installed apps is the fault of the operating system, not the individual app. 2. You seem to not recognize that OpenSSH would be updated alongside with the rest of the system on RedHat or other operating systems that include it, and the admin would not need to spend any time on OpenSSH specifically. Not to mention, any admin that needs to update a typical app on 500 desktops by hand is completely worthless anyway, and you would have a lot more security problems than what implementation of SSH you are running. 3. Auto-update mechanisms can introduce vulnerabilities as well. So, it's not a given that an auto-update mechanism is a good idea. The cons could very well outweigh the pros. MSIE is a bug-ridden nightmare for a slew of problems, beyond just ego. Sure, ego can be a problem with open source. OpenSSH, however, was a poor example for you to make this point. Not to say that certain developers on the OpenSSH team are without egos, but the security of their software has not suffered because of it. "Everyone thinks that they know better and don't bother listening to anyone else's opinion. It frequently comes back to bite them in the backside." You should heed your own advice.

Re:What else would SSH Communications say?

[slavemowgli]

That's not true. "cathedral-style" may be a somewhat loaded term, but it does refer to a clear, well-defined difference of the underlying model of a piece of software - the development model, in most cases, but it can also be applied to others. Call it "top-down" if you want to, or contrast it with terms like "grassroots" etc.

"enterprise-scale", on the other hand, isn't - rather, that's an ephemeral quality that your own products always possess, but never those of your competitors.

I think the real point here is that SSH Communications are trying to sell a product, so it's only natural that they're trying to show their competitors in the worst possible light, especially when those competitors have around 90% market share (see http://openssh.com/usage/graphs.html). OpenSSH, on the other hand, is not trying to sell you anything - like most open-source projects, their primary concern is to produce the best possible software. If you use it, good; if not, it's your loss, not theirs.

Re:What else would SSH Communications say?

[Jesus_666]

It's not as if mass murderers would get killed in less than ten years (USA) or at all (pretty much the rest of the Western world). If you have a decade of spare time or two, you might participate in a study simply because there isn't much else to do. And it's not like mass murderers would be locked away in ultra-high security bunkers which no one may ever enter, especially not the mailman. You ask the right people for permission and you can get in touch with someone who's on Death Row.

Re:What else would SSH Communications say?

[bnjf]

So when will PuTTY have a "start file transfer here" option?

Oh right, when I write it!!

Re:What else would SSH Communications say?

[dgatwood]

1. But the OSes that actually USE OpenSSH DO include it, which is the point. Lack of builtin features to update installed apps is the fault of the operating system, not the individual app.

Not all of them. And recall that the product in question is predominantly for Windows deployment, which makes these Windows side ports the only thing worth considering as far as this subject is concerned.

I totally disagree that application update is the responsibility of the OS. Updating the OS and its components is the responsibility of the OS. Updating applications is the responsibility of the application. Only the application knows its own quirks---how to update its own configuration files when needed, etc. Blaming the OS for lack of update functionality in an app is ludicrous, particularly in an application whose entire purpose is security.

Not to mention, any admin that needs to update a typical app on 500 desktops by hand is completely worthless anyway, and you would have a lot more security problems than what implementation of SSH you are running.

Care to elaborate on that? I know how to automatically update Mac OS X in bulk using the built-in admin apps. I haven't seen such functionality for Linux without writing custom scripts. About the closest thing I've seen is groupvte, which might work for half a dozen machines, but at the 500 machine level... no prayer. Yes, somebody could write custom scripts to do it, but no matter how you do it, you're still talking about a script ssh'ing to each individual machine, running an update program, and trying to parse the results (to avoid you having to read through 10 pages of spew for each of 500 machines). It isn't an easy problem, and I have yet to see an adequate solution.

Auto-update mechanisms can introduce vulnerabilities as well. So, it's not a given that an auto-update mechanism is a good idea. The cons could very well outweigh the pros.

Doing any update could introduce new vulnerabilities. That's the nature of any update that changes code. That said, there's a 100% chance it will fix a vulnerability and only a small chance it will introduce a new one. It's not hard to weigh those odds.

Unless, of course, you mean that the update mechanism itself could be insecure. That's what package signing is for....

Re:What else would SSH Communications say?

[hansonc]

way to get suckered in by a troll. Nice work

Re:What else would SSH Communications say?

[kernelfoobar]

0 0 * * * /usr/bin/yum -y update

or apt-get, up2date, emerge, make update, etc... There's your auto update.

Re:What else would SSH Communications say?

[Anonymous Coward]

YHBT YHL HAND

Er...

[Sanjuro]

Are they implyinng the DOD isn't an Enterprise class network?

Re:Er...

[Anonymous Coward]

I don't think it even qualifies as a Constitution class network.

*cue groaning*

Re:Er...

[Anonymous Coward]

having worked there, there is nothing to imply lol. DOD is a mess.

Re:Er...

[Kjella]

Well, depends on how you look at it. A really huge enterprise using a piece of software can also mean "We're so big that we found it cost-efficient to design the enterprise features we need to work with this application". SELinux is a good example. Other enterprises can have a policy of only using software from external vendors, because it's not "core business", in which case it might fall short.

Kjella

Re:Er...

[ImaLamer]

The Department of Defense an "enterprise"?

Not in America! Never!

Four hundred and one billion dollar budget, I'd say they are an enterprise. Soon, a new American corporation.

Enterprise Product?

[emandres]

They claim that it's an enterprise product, another class of software than OpenSSH. They don't seem to have much of an argument for why it's so much different. The only comparison they manage to draw is that OpenSSH doesn't have very good SFTP, which they neglect to back by any comparison to their own. Straw man at best it seems. Anyway, what is so 'enterprise' about it that OpenSSH doesn't have? Seems to me that every 'enterprise' server running a *nix has it, so doesn't that make it enterprise enough?

Re:Enterprise Product?

[abirdman]

My experience is that the word "Enterprise" placed on any product means that the price gets multiplied by 10 or so. Sometimes they add some glitzy splash screen or GUI checkboxes so the "enterprise" admin can show off the shiny new software to the PHB's. But believe me, if it says "Product XYZ, Enterprise Edition" it means they figgered how to add another zero or two to the price of XYZ, without adding any other functionality.

Of course, I haven't RTFA yet, so I could be completely wrong about this.

Re:Enterprise Product?

[Anonymous Coward]

Uhm, I can think of three things that OpenSSH doesn't have: FIPS certified libraries, indemnity protection and dedicated commercial support.

These things are quite important in the enterprise market.

Re:Enterprise Product?

[CupBeEmpty]

I give you enormous credit for using the term "straw man." It is far and away my favorite rhetorical device and aptly used here. (For those that dont know: rhetorical use)

Re:Enterprise Product?

[Hydrogenoid]

So we should all pay 10x the original price for openSSH and be done with the controversy!

Re:Enterprise Product?

[Krach42]

It's like an extended warranty for your software. It promises that they'll give you Enterprise-level service if you ever have any problems.

Now, I know it's pretty common to have software problems at some point, unlike TVs breaking, or needing a reason for an Extended Warranty, but I'd be surprised if your IT department should ever really need deep Enterprise-level service for their software, unless you just don't have any IT personnel that actually need deep understanding of software to do their jobs.

Now, the problem with this is in OSes, where you can end up with a system that is so integrated that you *do* need enterprise-level service, because if something breaks, you don't want to sit on your bum, because your techs can't fix it.

Re:Enterprise Product?

[Anonymous Coward]

you mean like MSSQL and Server 2003 "enterprise" that simply have a limitation for memory and processors turned off?

the fun part is that I found a patch to enable the >4Gb ram and >4processor limit arbitrarily installed in both those products. all to run on my lowly 8 processor 8gb dell server that has little old P-IIII processors in it I got for a song on ebay.

Enterprise = we rape you without lube for something that should have been in there to begin with.

Re:Enterprise Product?

[UnapprovedThought]

Anyway, what is so 'enterprise' about it that OpenSSH doesn't have?

Good question. It seems very enterprising to claim that a closed software product is "in a different class by itself" -- tantamount to saying it is more secure than an open source product.

The crucial difference for me is whether I can check the source code for gaping security holes. With open source software, it is relatively easy. At least you can get a third party to vouch for the lack of obvious security holes in an open source product. With a closed product, you get only the vendor's assurance. Maybe the vendor could leave some secret exploits in there to convince people that they need to upgrade every so often? You would have no choice but to pay up, after all, your "enterprise" depends on it now.

But does closed software retain some security through obscurity? Can blackhat hackers reverse engineer a closed software product anyway? Yes, they can, and I wonder if it is a coincidence if this happens close to a product upgrade cycle.

IMHO, they are using the enterprise buzzword to try to evoke images of an "Enterprise class" warship, bristling with weapons and rotating radars and the latest bleeping control center screens, roaming your coastline defending you against any possible attack. The only trouble is you are not allowed to inspect the ship to see if it has a leak, and if the ship sinks, they'd rather you didn't tell anyone because they might not meet their sales target for that quarter.... :)

Re:Enterprise Product?

[strabo]

So we should all pay 10x the original price for openSSH and be done with the controversy!

Well, considering that 10 times nothin' is nothin'....

Re:Enterprise Product?

[ckd]

My experience is that the word "Enterprise" placed on any product means that the price gets multiplied by 10 or so.

Either that, or it's complicated enough that only Scotty or Geordi can keep it from undergoing a warp core breach once a week.

Re:Enterprise Product?

[Kalzus]

The "Enterprise" part is, evidently, that SSH.com will stick its neck out if it's caught out that one of their clients wasn't HIPPA or Sarbannes-Oxley compliant due to a problem with the SSH software installed, if it's SSH.com's software.

In a practical sense, this is likely bullshit. But so is any kind of computer liability insurance.

Re:Enterprise Product?

[glitch23]

With the Enterprise edition of many apps it is possible to add zeros without adding any other functionality simply by the company charging more because you happen to have 4 CPUs in your server instead of 1 and if you have dual cores in each then watch out. No bonuses this year. Veritas does this with their NetBackup Datacenter product and I'm sure they make a killing on it.

Re:Enterprise Product?

[syncomm]

That 10x price increase is there for a reason, if you support any enterprise you _will_ need to offer 24x7 support 365 days a week, probably install everything yourself by flying out to them, and maybe even hand hold them through every upgrade and security patch. It takes a good deal of work to support an enterprise customer and not all businesses are up to task.

Re:Enterprise Product?

[typical]

That 10x price increase is there for a reason, if you support any enterprise you _will_ need to offer 24x7 support 365 days a week, probably install everything yourself by flying out to them, and maybe even hand hold them through every upgrade and security patch. It takes a good deal of work to support an enterprise customer and not all businesses are up to task.

So what you're trying to say here is that Windows is not enterprise class?

Re:Enterprise Product?

[Anonymous Coward]

> the fun part is that I found a patch to enable the
> 4Gb ram and 4 processor limit arbitrarily installed in both those products.
> all to run on my lowly 8 processor 8gb dell server that has little old
> P-IIII processors in it I got for a song on ebay

care to share the location of said patches?

Re:Enterprise Product?

[Anonymous Coward]

A good example of product differentiation between Enterprise editions and non-enterprise editions is SQL Server 2000 from Microsoft. The standard editions allows you do a lot of cool things, but enterprise edition comes with support for things like on the fly replication and backups, so you don't have to down the server to get things stored safely. Then theres extra features like cube analysis and all that kind of stuff, things that large corporate marketing departments *love* so much.

There's no splash screen though, so maybe we got screwed after all :)

Re:Enterprise Product?

[Anonymous Coward]

What the hell is 10 x Free ? I am sure that is NaN. heh.

tubers

Re:Enterprise Product?

[zootm]

I believe their main argument was that OpenSSH was just an SSH system, whereas they had integrated tools for upgrading and so on the clients/servers on loads of different systems (running different OSs) at once, rather than any serious security concern. Obviously package managers destroy a lot of their argument, but integrating everything when you're using multiple platforms has at least some validity.

Re:Enterprise Product?

[Anonymous Coward]

My experience is that the word "Enterprise" placed on any product means that the price gets multiplied by 10 or so.

Heh, mine is exactly the opposite. When we add "enterprise" to a product it means it is a scaled down version for enterprise businesses, not ISPs, telcomms, etc. Of course we incorporate OpenSSH in both versions.

Re:Enterprise Product?

[Anonymous Coward]

it's only PR, but i think what they mean by "Enterprise" is that their ssh servers come with a (GUI?) tool to manage (all of) them.
it's a common loosy argument against large scale use of open source: there's no software suite bundled to easily manage all deployed software, what you need is some *knowledge*...

. But how do you manage those servers ?
. I got some powerfull scripts...
. No, i mean where's the configuration wizard, the auto-update icon, the outlook-alert plug-in, etc... !
. Don't need those...
. But I do !

Re:Enterprise Product?

[syncomm]

Actually, that is one of the things Microsoft is really good at! Outside of managed service businesses (IBM, HP, EDS), Microsoft is certainly a top teir player at providing support to large customers. There are some here who will flame or contend this, however I've happily worked directly with excellent Microsoft resources when architecting and implimenting solutions for large customers. Microsoft, like some big UNIX vendors, will even provide an on-site for enterprise customers with the weight and money. There are a lot of things to knock them for, but enterprise class service isn't one of them. ;)

Re:Enterprise Product?

[Anonymous Coward]

what is so 'enterprise' about it that OpenSSH doesn't have?

The crucial difference for me is whether I can check the source code for gaping security holes.

Your post is labouring under a false assumption.

You might be surprised to discover that the source code for SSH.com's SSH server and client software is available to anyone who wants to examine it (it's also free-as-in-beer if you're running it on Linux, FreeBSD, NetBSD, or OpenBSD, or are a 'non-commercial' user.)

Re:Enterprise Product?

[Grishnakh]

Their argument isn't very valid at all as far as I'm concerned. SSH is only one in a long list of applications on a computer system: the OS kernel itself, the X window system, various drivers, VNC, sendmail/postfix, bind, and on and on. Everything connected to the network has to worry about security vulnerabilities, not just SSH. There's nothing special about SSH; it's just another way to connect to other systems.

So why should anyone have a process for keeping SSH up-to-date that's completely separate from every other piece of software on their system? This is an OS distribution problem.

If I use SUSE or Redhat on my enterprise systems, I want it to be easy to keep all those systems up-to-date. That means I use SUSE/RH's online update service. When a vulnerability is found in OpenSSH, the distro company gets the new fixed version and makes it available ASAP using their online update service (YOU in the case of SUSE). Then, in one easy operation, I can apply this fix, along with fixes for all other software on my systems, with a few mouse clicks.

Why would I want to go back to the bad old days of having to check separately for updates for every single software application I have, when I can do them all with SUSE/RH's online update service? This is just stupid.

This is one of the big benefits of Free/Open-source software: by making it free to distribute, the distribution vendors can include it in their distributions, making it easy to install a full system full of software in one operation, and they can also keep up with updates, making it easy to keep all that software updated from one source. Then you only have to worry about any special, proprietary apps you may have, which usually tend to not involve networking and not be security risks in the first place (such as games, EDA software, etc.)

Re:Enterprise Product?

[zootm]

Why would I want to go back to the bad old days of having to check separately for updates for every single software application I have, when I can do them all with SUSE/RH's online update service? This is just stupid.

I think the idea was that even if you have to, it can be done automatically with this software suite. The difference between SSH and other packages, clearly, is that it's specifically for security, so probably needs to (or at least should) be updated more frequently. The idea here being that over multiple platforms one can assure, with their system, that all of the systems on all of the platforms have the same, up-to-date version of the SSH system. As you point out (and as I mentioned in my post) package managers typically take on this role in Linux distributions, but there's more to the world than that, unfortunately.

To be clear though, I was just trying to clarify their argument, not advocate it.

This is my surprised face.

[mosch]

In other news, Axe body spray doesn't get you laid, and Red Bull doesn't give you wings.

Re:This is my surprised face.

[Jherek Carnelian]

In other news, Axe body spray doesn't get you laid, and Red Bull doesn't give you wings.

But Herbal Esssence Shampoo does give hot chicks a totally organic experience!

Re:This is my surprised face.

[Surye]

Know this as fact? I suppose everything is relitive. Much like ramen is gourmet compared to nothing at all.

Re:This is my surprised face.

[Comatose51]

Axe body spray doesn't get you laid

Damn. There goes Plan A.

Re:This is my surprised face.

[doubledoh]

^^^^^^ poster above me couldn't joke his way out of a paper bag. so so sad.

Re:This is my surprised face.

[Surye]

*tear*

Re:This is my surprised face.

[doubledoh]

Ok, you've been upgraded to plastic bag. A for effort :)

Re:This is my surprised face.

[heavy snowfall]

Well, axe (called lynx in the UK btw) specifically won't get you laid, but your chances are greater if you at least use some kind of deo... Won't matter how hot you are if you smell like doritos... :) (mmm.... blue doritos... must... buy...)

--
Use your bluetooth phone as a modem for Linux

Re:This is my surprised face.

[Fulcrum of Evil]

Axe body spray doesn't get you laid

So, what you're saying is that I should take a shower after butchering my victims if I want to go hit the clubs tonight, right?

Re:This is my surprised face.

[Minwee]

"Red Bull doesn't give you wings."

It doesn't? How am I supposed to get red wings then?

Re:This is my surprised face.

[mrselfdestrukt]

Hmmm. Yes Blue Doritos... Hmm. Must also buy.
Swwwwweeeeeeeeet Chilli... *drool*
It used to be called Ego in South Africa, but they renamed it to AXE a couple of months back. The TV ads are brilliant though.

Re:This is my surprised face.

[MonoSynth]

You mean A.J.'s *not* using Axe? What's Miranda smoking then?

Re:This is my surprised face.

[Grab]

No problems at all.

http://www.mobydisk.com/mobydisk/hanggliding/big/h ang_glider.jpg

More fun than should be legal! ;-)

but what about enterprise administration?

[louzerr]

Hey, I'm all for OpenSSH - use it every day on almost any PC I touch, but "ready for enterprise" can have more meanings than just how secure/usable a product is.

What may be missing from OpenSSH (and I'm not claiming to be an expert - just a user) is an enterprise manager ... which it sounds like the Commercial SSH version may offer.

I'm sure there's a way to enterprise-manage ssh other than passing keys around. But it doesn't seem to come out-of-the-box with OpenSSH just yet.

Re:but what about enterprise administration?

[Asgard]

CFEngine is an excellent tool for managing OpenSSH or any other system tool configuration.

Re:but what about enterprise administration?

[fimbulvetr]

That's the whole thing about Linux/Unix. SSH isn't meant to have those types of tools. Just like grep shouldn't have a field separator (awk) or a line counter (though it now does:)). My configs are handled by rdist, rsync or cfengine.
Having all this crap built into one thing needlessly complicates things (Optional knee jerk for those who think the additional commands are the complications), and makes things a nightmare later on. Think Microsoft GUIs and the absolutely terrible configuration options when you think about how bad this can become.

Re:but what about enterprise administration?

[lilmouse]

Oooo, ooo! Someone who has dealt with administering large numbers of machines at once!

Mod him up, mod him up!

--LWM

Re:but what about enterprise administration?

[fireboy1919]

A meta-configuration tool? No...that's just spin. This is just a (almost isn't) package manager that includes a scheduler and a template engine.

It doesn't look like it does anything you can't do with cron, rsync, your package manager and the scripting language of your choice easier (because you can get more features and support from the combination). Why would anyone actually need this?

Silly indeed. If you're looking to actually manage OpenSSH and most of the actual system tools without actually having to write that configuration tool (and you want to do it through a GUI), then you want something that can read and write configuration files.

For that there's the old linuxconf or webmin. Of course a lot of distros feel inclined to make their own stuff.

Re:but what about enterprise administration?

[Zak3056]

Think Microsoft GUIs and the absolutely terrible configuration options when you think about how bad this can become.

While, personally, I'm alot more comfortable doing things the *nix way (for example, I find httpd.conf to be a much better administrative interface than MS's IIS Manager) Microsoft's MMC based tools are pretty good these days--they cover about 95% of everything your average admin is going to do in the lifetime of the application. They're "good enough" to get the job done, and I think that most people who say otherwise probably haven't used them recently... or are simply more comfortable using different tools to do the job and just aren't willing to sit down and learn the MS way of doing things.

Re:but what about enterprise administration?

[Kalzus]

MMC is pretty damn good.

What scares the piss out of me is not that MMC manages to present a bunch of the options that are available in a pretty manner, but that some of the options I see are available AT ALL.

What's the dealio behind GPEDIT.MSC:"User Configuration"|"Administrative Templates"|"Network"|"Offline Files" ?

Why the did the shell programmer waste his time fooling with this crap when he could have been ripping all the damn "APICallA()"/"APICallW()" bullcrap out of important parts of the code, like win32k.sys?

WHY is the Universal Plug-N-Play service available on a "server version" of their operating system? Who sets up a server that expects to have to UPNP its way out of the router that is its next hop on the network?

Yeah yeah, Off-Topic, but the Microsoft Mentality is scary because it makes stupidity easy in places stupidity shouldn't be easy.

Re:but what about enterprise administration?

[Anonymous Coward]

http://www.thefreedictionary.com/alot
http://www.thefreedictionary.com/a lot

Re:but what about enterprise administration?

[ckaminski]

You do know that almost all of the APICallA()'s are just stubs to to the W() versions, right? So that every application in the world wouldn't be forced to use Unicode? It was a deliberate design choice nearly 12 years ago, and it would be silly to undo it now. In fact, it's probably impossible, since the number of non-Unicode apps DWARFS the number of Unicode apps.

Yea, I don't want a developer mucking around with that, thank you very much.

As to their choices of what to run, you have to remember that Server is aimed at the lowest common denominator: the SOHO office. There, UPNP *COULD* be useful with Printer discovery and the like. Why that, and Remote Registry aren't off by default, I can't say. :-)

Re:but what about enterprise administration?

[CFrankBernard]

Because the LCD of a SOHO wouldn't know or know how to turn them on?

Anyone in business knows..

[svvampy]

that "Enterprise class" is management-speak for pay-through-the-nose. There has and always will be a deep suspicion against low-cost or free(as in beer) products. There's plenty of stuff on the market that people can't give away that is sold to schmucks everywhere.

Re:Anyone in business knows..

[defile]

No, that's not what it means.

"Enterprise class" means that the vendor invested lots of money in unsexy things that allow corporate bigwigs to check off boxes on their requirements lists that satisfy their accountants, shareholders, insurers, and regulators. It has nearly nothing to do with how the tool itself operates.

Example: the average user rightly doesn't give a fuck about whether OpenSSH has been SOX compliant certified.

Google-monkeys love Klingon

[Anonymous Coward]

http://www.google.com/intl/xx-klingon/

Enterprise - the key word of marketing BS

[sien]

Whenever you hear enterprise you can be assured someone in marketing is trying to BS you. It's really a keyword to denote that there is no good reason why something is better or bigger, merely that someone is trying to con you. It's almost as bad as synergy.

This appears to be no different. They are obviously trying to come up with a reason why you shouldn't compare the two products as theirs will fair so badly.

Re:Enterprise - the key word of marketing BS

[Anonymous Coward]

Red Hat Linux Enterprise Edition? :)

Re:Enterprise - the key word of marketing BS

[techno-vampire]

Marketdroids call things "Enterprise class" to appeal to PhB's who grew up with Star Trek.

Re:Enterprise - the key word of marketing BS

[birge]

You're probably joking, but I think there's more truth to that than we'd all like to admit. The way a word sounds, and the connotations given that word by popular media, probably have more importance than we know. Why don't they call it "business class" or "corporate class"? Certainly nobody ever says they work for an "enterprise" or are communiting to their "enterprise"? But "enterprise class" sounds cooler, probably because of Star Trek and NASA.

I think this kind of thing is pretty symptomatic of our times.

Re:Enterprise - the key word of marketing BS

[gujo-odori]

While that is often true, "enterprise" can indeed have a legit meaning. I work for a company that targets (largely, but not exclusively; we have some pretty small customers, too) the enterprise market.

Enterprise, in this sense, means large clients who need systems that gracefully scale to large numbers of users. You have 150,000 seats and need a five nines of uptime SLA? No problem. We can do that (and have been exceeding five nines of uptime for seven years).

I haven't RTFAd, but that may be what SSH is talking about. Or it could be just marketing droid speak. Like I said, I didn't RTFA. But, "enterprise" can be a legitimately used term.

Re:Enterprise - the key word of marketing BS

[kerohazel]

Silly marketdroids - there never WAS an Enterprise class. They'd get more money if they called it "Constitution class" or "Galaxy class".

Re:Enterprise - the key word of marketing BS

[typical]

I think this kind of thing is pretty symptomatic of our times.

Socrates had the same problem with the rhetoricians of his time, thousands of years ago. I think it's more of a general problem with the way the human mind works -- we like things that trigger more "good" neuronal responses, so people figure out how to take advantage of this quirk.

Re:Enterprise - the key word of marketing BS

[typical]

I haven't RTFAd, but that may be what SSH is talking about. Or it could be just marketing droid speak. Like I said, I didn't RTFA. But, "enterprise" can be a legitimately used term.

The problem is that it sounds good and saying that something is "enterprise class" makes no material claims about its capabilites. It's pretty obvious that jamming "enterprise" in lots of places is going to happen.

Frankly, I don't see why open source needs to earn market respect. Frankly, I've found that good open source software technically beats the pants off its closed source brethren, and I wonder with each *closed source* product whether it will measure up to the standard set by the similar open source one. I'd expect SSH to suck more than I'd expect OpenSSH to suck.

OTOH, I do agree that the SSH people had a pretty reasonable argument a while back that "OpenSSH is confusing and infringes on our trademark."

If Microsoft made a release of Windows with some extra CLI utilities bundled in and called it Microsoft EnterpriseLinux, we'd probably be quite pissy about trademark infringement, but that's essentially what the OpenSSH people did.

Re:Enterprise - the key word of marketing BS

[gujo-odori]

If Microsoft made a release of Windows with some extra CLI utilities bundled in and called it Microsoft EnterpriseLinux, we'd probably be quite pissy about trademark infringement, but that's essentially what the OpenSSH people did.

Well, no. If you read the OpenSSH project history here and the original SSH license here, it is clear that OpenSSH is not infringing anything.

The licence used for the version on which OpenSSH was based states that it can be freely used for any purpose, that derived works must be clearly identified as derived works (OpenSSH is so identified), and that if they are incompatible with the RFC protocol, they may not be called SSH or Secure Shell. By implication, the OpenSSH team could have just called it "SSH" and they would still not be infringing, under the terms of the original license, which allows derivative works to be called simply "SSH" or "Secure Shell," as I read it.

Since those days, SSH has become a commercial, proprietary, and monetized product, and they may not like the fact that it was once under a free license that allowed projects like OpenSSH to happen, but instead of whining about "They did just what they were allowed to do, boohoohoo!" they should just get out there and compete on merits like everyone else. Price, too, is a merit, and if the higher cost and proprietary license of SSH is not, in the eye of the purchaser, justified by any superior technical merits it may have, that's tough.

Re:That's like saying...

[biryokumaru]

Google agrees that Klingon is a real language, but Elvish is pushing it.

Name recognition

[shudde]

I realise I'm displaying my ignorance here but it should hopefully prove a point. I've used OpenSSH for years and until now I had no idea they didn't develop the protocol or that a commercial variant existed.

Couple that with the sheer number of servers and distributions using OpenSSH and the statements by Byron Rashed seem to have the ring of sour grapes.

Re:Name recognition

[ninja_assault_kitten]

You're missing the point. Popularity doesn't exactly equate to 'enterprise class'. Look at nmap, everyone knows and uses it. Is it enterprise class? No. Enterprise class means it's designed to be deployed across an entire enterprise/organization with centralized management, out of the box.

Re:Name recognition

[Grishnakh]

The commercial variant is actually the original. That company was started by the guy who first invented the ssh protocol in 1995. The source was open, but apparently newer versions were released under successively more restrictive licenses. openssh was forked from one of the earlier versions and then modified for v2 compatibility and other fixes. You can read about the history of the protocol here and here. The first link is from O'Reilly and starts at the beginning with Tatu, and the second is written by the openssh developers, but curiously says very little about ssh before they forked it.

While I support anyone's attempt to operate a legal business, the statements by Rashed are mostly FUD and just sound like a company with lackluster sales trying to drum up business. Pathetic.

No, it's no

[winkydink]

Enterprise-class is management speak for "has a pretty GUI that a monkey can use". If one is managing thousands or tens of thousands of accounts, one doesn't want to pay somebody big bucks to do it using Open Source if said open source requires an $80k/yr person to administer it. It's a TCO calculation, nothing more.

Re:No, it's no

[Anonymous Coward]

Yeah - hate to spend $80k/yr on a person to administer it when we can spend $42k/yr on some ITT Tech flunky. And another $135k/yr on a "support" contract.

Re:No, it's no

[orasio]

Of course, but that would be something in te vicinity of 1 dollar per account.
And you would have a 80k/year person taking care of your accounts.
hmmm....
As opposed to having a 30k/year + some licensing money, and then having a less qualified admin.
I believe there is some value associated to having competent people that you can put in your TCO calculation.

Re:No, it's no

[winkydink]

No, an $80k/yr person costs a company a lot more than $80k/yr. Benefits, vacation, holdays, insurance, cost of the space you occupy and utilities you use, etc...

Re:No, it's no

[petermgreen]

does an $80k a year person really cost twice as much on costs like that as a $40k a year person and if so where do the big cost increases come from?

Re:No, it's no

[Col. Bloodnok]

Enterprise-class is management speak for "has a pretty GUI that a monkey can use".

Contrary to popular belief, Enterprise Class means 'supportable' in a large (enterprise) environment. Fancy going round 10,000 desktop PCs worldwide, applying 1 critical product patch personally? Or would you prefer to use some sort of 'enterprise-class' patch management software? Perhaps you'll be around to reset all those stalled PCs in that lights-out datacenter in the middle of nowhere, where you need to provide 48 hours notice just to enter the facility - or would you prefer to login to Sun boxes on the hardware console via an 'enterprise-class' LOM device?

Re:No, it's no

[winkydink]

Some costs are fixed, like facilities-related costs, medical insurance and the like. Some are directly proportional to salary, like vacation, holidays, and employer contribution to social security. It really depends on how many benefits the employer provides and whether they are fixed or variable wrt salary. In some cases, 2 * $40k/yr will be measurably cheaper.

Re:No, it's no

[Gojira Shipi-Taro]

Contrary to popular belief, Enterprise Class means 'supportable' in a large (enterprise) environment.

IOW, a GUI even a monkey can use.

I've worked support both internally to a company and for a major software publisher. Monkey is too kind a word for most of the lusers who called me for help. I helped 'em all though, and did it with enough of a virtual smile that they all praised me.

Another year or two of vodka and the experience should fade from my memory..

Re:No, it's no

[totallygeek]

No, an $80k/yr person costs a company a lot more than $80k/yr. Benefits, vacation, holdays, insurance, cost of the space you occupy and utilities you use, etc...

No, you have it wrong. For the $X/yr my employer pays, they benefit from someone that will work 65+ hours per week, never gets a vacation without work, holidays are opportune times for system change-outs, and works in the basement with a can of bug spray in one hand. As for the insurance, my wife will never get knocked up with the hours I work, so insurance costs are low.

Re:No, it's no

[tyler_larson]

if said open source requires an $80k/yr person...

Sounds like I need a raise.

Re:No, it's no

[Anonymous Coward]

'Going round 10,000 desktop PCs' and installing patches is never the option. Either you run Windows and each and every application has it's own 'Enterprise Buzzword Of The Day' GUI for software and config updates. Or you run UNIX and benefit from a single standard method for updating every application the same way. You see.. when the groundwork is solid (eg. with Debian) there's no need for some hodge-podge of 'Enterprise Class' hacks to fix fundamental flaws which should really be non-problems to begin with. We've got 4 full time admins that handle 6000 desktops and 10000 users. On top of that there's an extra 5 or so (don't now the number exactly here) persons whose job is only to replace broken harddisks, monitors etc.
It's all being administered with standard tools (netboot, software watchdogs etc).
By the way, nightly many of the computers are used for distributed computations (CFD actually).

Define enterprise

[russg]

Not that I'm defending SSH, but it really depends on what specifically you are speaking of when it comes to comparing the offering of OpenSSH and SSH Communications. The two products are fairly similiar for base installs and function about the same. The problems with OpenSSH come into play in the enterprise when you want to manage the SSH installs globally or integrate the SSH server with other products.

Two examples from my own experience. We attempted integration with RSA and OpenSSH had significant problems that we had to resolve and in the end we could not resolve the final problem which was a session would hang after exiting the shell if the session was authenticated using the RSA PAM module.

The other example is related to distribution and configuration managment. We have started using SSH communications central management center to distribute new versions of Tectia server as well as centrally manage the configuration for Tectia/ssh. This has reduced our management overhead considerably. This is an "enterprise" feature.

--russ

Re:Define enterprise

[Anonymous Coward]

If you can't upgrade arbitrary packages or centrally manage key configuration files for all or certain groups of machines your "enterprise" infrastructure sucks.

Re:Define enterprise

[Anonymous Coward]

Enterprise:

From http://wordnet.princeton.edu/perl/webwn?s=enterpri se

1. a purposeful or industrious undertaking (especially one that requires effort or boldness); "he had doubts about the whole enterprise"
2. an organization created for business ventures; "a growing enterprise must have a bold leader"

There you go, a purposeful undertaking that requires effort. Now try to imagine something done in business that does not fit that criteria. Or, an organization created for business. Hmm... ok, in other words, a company.

From http://www.cit.nih.gov/dnst/handbook/Main/glossary .htm

In the computer industry, an enterprise is an organization that uses computers.

Ha! There you go. PLEASE people, when you see this word, like others here have said, they are trying to shovel a load of shit directly down your throat, through the esophagus, into the stomach (possibly interacting with the spleen and/or liver), through both sets of intestines, and directly out your ass before recycling it back to your mouth.

That's exactly what they're trying to do, it means their product doesn't have any features that can be described in human readable language, so they need to say "well OUR product is specifically designed for organizations that require effort and use computers".

Well congratu-freakin-lations, get a patent, quick.

Re:Define enterprise

[roystgnr]

Two examples from my own experience. We attempted integration with RSA and OpenSSH had significant problems that we had to resolve and in the end we could not resolve the final problem which was a session would hang after exiting the shell if the session was authenticated using the RSA PAM module.

One example from my own experience: I ran ssh-keygen from OpenSSH, copied the RSA public keys around, and it just worked. I do believe you've had different luck, but I suspect my case is more typical.

The other example is related to distribution and configuration managment. We have started using SSH communications central management center to distribute new versions of Tectia server as well as centrally manage the configuration for Tectia/ssh. This has reduced our management overhead considerably. This is an "enterprise" feature.

Ironically, this "enterprise" feature is easily achieved by non-enterprises by putting ssh (Open or not) itself with a 3 line shell script. I install new versions of OpenSSH on a couple dozen computers with "ssh-all smart upgrade", for example.

That's just an example of my point, though: if this really is an enterprise feature, then any enterprise will already have some implementation of this feature, and will want to add new programs to their own central configuration management program rather than running a separate configuration management program for every single program they install. I suspect OpenSSH is easier to package for 3rd party management software - if only because you know you have a licence to redistribute derived versions without breaking copyright law.

Re:Define enterprise

[DaveCar]

Also no problem with OpenSSH here, fine product. But where is (and I mean this honestly, let me know if these exist) support for distributed (signed) public keys (LDAP?) and key revocation lists? Sure you can roll your own system, but ...

Not that I even know if SSH has this.

Re:Define enterprise

[Nexx]

Two examples from my own experience. We attempted integration with RSA and OpenSSH had significant problems that we had to resolve and in the end we could not resolve the final problem which was a session would hang after exiting the shell if the session was authenticated using the RSA PAM module.

One example from my own experience: I ran ssh-keygen from OpenSSH, copied the RSA public keys around, and it just worked. I do believe you've had different luck, but I suspect my case is more typical.

I don't think the GP was talking about RSA public/private keys, but instead about RSA SecurID. Having said that, I haven't implemented this for ssh authentication, so I don't know how it goes. If the GP was indeed talking about public/private key authentication, then yeah, they deserve to pay for everything.

Re:Define enterprise

[Dr. Evil]

Problems I've had:

• Sessions which never time out, and no option to time them out... requiring wrappers to create watchdogs for OpenSSH sessions.
• Non-expiring passwordless accounts forcing a password change on passwordless accounts because of OpenSSH's poor integration with Redhat PAM (get around it with some undocumented chage commands)
• SFTP not allowing you to cd into directories with execute only permissions.

Those are off the top of my head.

Re:Define enterprise

[russg]

RSA SecureID is the system that OpenSSH had problems with, and continues to have problems with.
We continue to evaluate new releases as they come out.

Re:Define enterprise

[Sinner]

Big spaceship. Bald captain.

Re:Define enterprise

[warrax_666]

The other example is related to distribution and configuration managment. We have started using SSH communications central management center to distribute new versions [...]

Um, PIKT (and others like it) will do that for you, and that'll work for any program configurations you need to manage centrally -- at least when the configuration is based on text files of some sort. It will also allow you to manage configuration differences centrally and in a controlled and documented way instead of just having "one configuration copy for server A", "one configuration copy for server B", "one configuration copy for all the other servers".

Adding "central management" to each individual program is a bloody stupid idea since each will work differently, have different bugs, etc. etc.

Re:Define enterprise

[Anonymous Coward]

Fuck you.

Love,
Cpt Kathryn "All My Own Hair" Janeway

Shades of McBride

[NoUse]

Did Darl finally move on to another project and change his name?

Site won't let me in without a cookie.

[Michael Woodhams]

If you block cookies, it just shows you the flash premercial page over and over. (Yes, I block flash also.) I've tested this by accepting the cookie to see the article. I've searched for friendly copies elsewhere on the net, but failed to find any.

Re:Site won't let me in without a cookie.

[HTH NE1]

Reprint.

Re:Site won't let me in without a cookie.

[i.r.id10t]

Why are you so afraid of cookies? Just mark the file read-only or immutable (via chattr). You get the benefit of the cookie while your browser is open, but close the browser and re-open it and your previous sessions cookies are all gone.

Re:Site won't let me in without a cookie.

[Dachannien]

Turn off Javascript.

Re:Site won't let me in without a cookie.

[usv]

Care to elaborate?

Theo for President!

[Anonymous Coward]

s/It comes on Linksys and D-Link wireless and security routers too/Don't forget about Poland

Obviously...

[Comatose51]

Byron Rashed, senior marketing communications manager of SSH Communications Security, claimed that SSH's product is better suited for enterprise-scale business applications than a similar open-source product from OpenSSH.

Come on. Stop feeding the troll. He's a marketing droid. He comes from a tradition of making outlandish claims or at best distortion of truth. It's his job to drive sales for SSH. We should treat what marketing people say the same way we treat any advertisement. Take it with a block of salt. Obviously an open source implementation of SSH competes, and have done so very successfuly, with SSH. This is their attempt to win back the market. It's not worth giving too much thought to.

Re:Obviously...

[cyburdine]

I wish I had a damn TIVO for this type of announcment!?!
I'll be glad to hit the CA button for everyone reading this article!

Re:Obviously...

[Grishnakh]

What's sad is that we have to be aware of this and can't take people at their word. How does this guy (or any other marketing person for that matter) sleep at night? Maybe I'm just weird, but I just couldn't look myself in the mirror every morning if I spent every day lying to people.

There *is* a license!

[DeafByBeheading]

Rashed acknowledged this but added, "Many vendors use it because it is free and they can use it without a license, so the number of users for remote access is quite large, but it does not provide very good SFTP or application connectivity usage."

No no no! You cannot use it without a license. It's released under the BSD license, and that license is just as important as a proprietary license. It just functions in a different way--to share the benefits of copyright rather than restrict them. Why do people keep saying that FOSS products don't have licenses?

Re:There *is* a license!

[Asgard]

FOSS programs generally don't have to connect to a 'license server' or have a paid-for 'license key' entered in a magic config file or dialog box. There is also not normally a hologram or fancy piece of paper that must be presented upon request.

Re:There *is* a license!

[DeafByBeheading]

Of course. But that doesn't mean that people should disrespect the license, or pretend it doesn't exist... Although it'd be pretty funny if it got so bad that the FSF did require little hologram thingies and license keys and what not, and required users to present them on request.

Re:There *is* a license!

[Bogtha]

You cannot use it without a license.

Of course you can.

It's released under the BSD license

That grants you permission to distribute copies. You already have the right to use it. Free Software licenses like the BSD-style licenses aren't EULAs, they only come into play when you want to distribute copies.

Re:There *is* a license!

[urlgrey]

Why do people keep saying that FOSS products don't have licenses?

I've got three letters for ya:

F
U
D

If a foggy haze can form over FOSS licensing being a scary question mark, it might just turn one PHB away from the FOSS and towards the proprietary and/or closed source.

Re:There *is* a license!

[dcapel]

Because that is effectivly a developer/distributer license.

End Users can do whatever the f*** they want with it.

Re:There *is* a license!

[Turf]

Because most OSS and Free (FSF definition of Free) software people can use without regard for the license. All OSS and Free software licenses I've examined govern copying/distribution, not actual use. In the Business/Corporate World, they are only failiar with licenses that govern use and distribution (EULAs).

Re:There *is* a license!

[DeafByBeheading]

Ah. Right... Touche... Well, I feel dumb. Mod parent up. And mod my original post down. I need to go back to software license school.

Re:There *is* a license!

[Anonymous Coward]

Why do people keep saying that FOSS products don't have licenses?

It gets worse than that; just the other day, I was half-asleep in one of my pseudo-computer university classes, when I thought I heard the prof say - among other gems:

• "Has anybody heard about Linux? It was developed by a group of people trying to create an opponent to Microsoft's Windows." and
• "Linux was created without a copyright so that anyone could use it."

After the class, I politely asked for clarification - but it seems she said exactly what she beleived. And I doubt my explainations changed her mind...

Althought what should I expect from this idiot? I mean - she also got 200 people believing that Tim Berners-Lee invented TCP/IP so that he would have a communications medium for HTML.

I guess what I'm trying to say is that people genuinely don't understand what the hell they're talking about when it comes to F/OSS, so they listen to whatever authority figure presents itself.

Re:There *is* a license!

[Trailer Trash]

Why do people keep saying that FOSS products don't have licenses?

I suppose because I can use most FOSS products without a license. The GPL is a license relating to copying the code, it has nothing to do with usage. I can use it any way that I want, the license specifically states that you don't have to accept it to use the software.

Re:There *is* a license!

[hackstraw]

FOSS programs generally don't have to connect to a 'license server' or have a paid-for 'license key' entered in a magic config file or dialog box. There is also not normally a hologram or fancy piece of paper that must be presented upon request.

That is one of the hidden benefits of _free_ software. That other software requires me to do things like have hardware dongles on my machine, license servers, typing in license keys, doing an online challenge and response. I hate it. I feel like a criminal for buying the software. Its easier to "do the right thing" and buy the software and then download a hacked pirated copy that is less demanding of me as a user of the software.

Re:There *is* a license!

[aaribaud]

I have not seen what part of the "Copyright" item on Wikipedia that the parent post refers to mentions any right to use software without a license from the owner -- and indeed, under French copyright law, one must have a license to use software, whatever the license may be (GPL, BSD, proprietary) unless of course the software is public domain, which amounts to a license to do whatever you want with it except claim it yours. Can someone (possibly the parent poster elaborate?

Re:There *is* a license!

[aaribaud]

The GPL is a license relating to copying the code, it has nothing to do with usage. I can use it any way that I want, the license specifically states that you don't have to accept it to use the software.

As far as I can read, the GPL does not say that one can run the program without accepting the GPL -- but of course, I welcome a detailed quote supporting the statement.

What the GPL says is that "the act of running the program is unrestricted" (quote), which is quite a different thing: the GPL affirmatively allows running the program. Without a licence, each use of the program would be be subject to the consent of the copyright owner.

BTW, concerning OpenSSH, the license explicitely allows running the software. Why bother mentioning that if it was allowed by default?

Re:There *is* a license!

[Bogtha]

I have not seen what part of the "Copyright" item on Wikipedia that the parent post refers to mentions any right to use software without a license from the owner

That's exactly what it was talking about. And it even linked to the law. I quote:

...it is not an infringement for the owner of a copy of a computer program to make or authorize the making of another copy or adaptation of that computer program provided: (1) that such a new copy or adaptation is created as an essential step in the utilization of the computer program...

In a little plainer English, it says "It's not copyright infringement to make a copy of software provided you need to do so in order to use it."

Essentially, copyright infringement was the only leverage software vendors had to forbid you from using software - as you copy it to your hard drive during installation and you copy it to main memory when running it. However, this part of the law makes it clear that this form of copying is not copyright infringement, so the idea that you need permission from the copyright holder in order to run software evaporates.

Granted, the law might be different in France, I wouldn't know about that, but at least in the USA, you don't need any special permission in order to run software.

Re:There *is* a license!

[mike2R]

5. You are not required to accept this License, since you have not signed it. However, nothing else grants you permission to modify or distribute the Program or its derivative works. These actions are prohibited by law if you do not accept this License. Therefore, by modifying or distributing the Program (or any work based on the Program), you indicate your acceptance of this License to do so, and all its terms and conditions for copying, distributing or modifying the Program or works based on it.

Re:There *is* a license!

[Anonymous Coward]

You do have a license, one that says you don't need a license to use the software but only to redistribute ;-)

Re:There *is* a license!

[aaribaud]

This excerpt says that one is not forced to accept the licence, and then goes about saying that accepting the licence is necessary for modifying or distributing the program (1). But the statement in the post I had replied to was not about copying, modifying and distributing, it was about running the program:

The GPL is a license relating to copying the code, it has nothing to do with usage. I can use it any way that I want, the license specifically states that you don't have to accept it to use the software.

And the excerpt quoted by the parent says nothing about running the program, which leaves us to the question : when nothing is agreed upon about running the program, can one run it? I don't think so, at least under French copyright law. Running a program is not a right per se and cannot be taken for granted jsut because the program happens to be available.

Re:There *is* a license!

[mike2R]

My understanding is that US copyright law has no method of restricting your right to use a program - it is copyright law and is only triggered by the act of making copys. Most software "licences" include a termination of usage rights clause, but most software licences are actually contracts, hence the requirment for a click-through signature.

The GPL is a true copyright licence and therefore is silent on usage rights - once you have received a copy of the program, you do not need any additonal permission to run it. I can choose not to accept the GPL, and that does not affect my rights to use the program, however without accepting the GPL I cannot modify or distribute it.

IANAL

Man, the universe loves me. :)

[Reality Master 101]

I was just looking at the source to OpenSSH yesterday, and wished we'd have a story about it so I could write a rant. :)

WHAT A PIECE OF F'ING CRAP.

I'm really not trying to post flamebait here, but GAH, the people who work on that thing should hang their heads in embarrassment. Spaghetti code, no comments -- I'm talking a total mess. I was actually just looking for the code that clears the screen when you log out of a session (because I actually hate the automatic clear screen, and was hoping there was an option for it). I finally gave up in disgust.

Now, I'm not saying that proprietary source is always golden (I mean, we know it isn't), but the worst code I've ever developed in my life is better than that rat's nest. I'd fire any programmer who dared to bring me such a horrible mess.

Any, a big "thank you" to the universe for getting this story posted. :)

Re:Man, the universe loves me. :)

[dmoore]

If you don't want to clear the screen at logout, look in your ~/.bash_logout on the remote machine. I suspect you'll find your culprit there.

Re:Man, the universe loves me. :)

[Anonymous Coward]

Your informed opinion has no place in a Slashdot discussion.

Re:Man, the universe loves me. :)

[Reality Master 101]

Thanks. :) I'll check it out.

Re:Man, the universe loves me. :)

[Anonymous Coward]

Are you kidding? OpenSSH (ssh client) doesn't clear the terminal when you log out, at least not on any of the 13,049 linux/bsd/solaris boxes I use.

Maybe you use some weaker OS, maybe you've got something in your .bash_logout to clear the screen, maybe you're just a troll, but one thing's for sure, you're way out of your league evaluating openssh code.

Re:Man, the universe loves me. :)

[Anonymous Coward]

could you give a more specific example? Could you provide a few snipits?

Re:Man, the universe loves me. :)

[Anonymous Coward]

You haven't looked at the keyboard device code for XFree86, have you? (hint: it's in almost every part of XFree86). It's REALLY hard to purge XFree86 of the notion that it should take over ALL keyboards on the system.

Re:Man, the universe loves me. :)

[pnatural]

You've been trolled. The openssh code base has plenty of comments, and it's a joy to read for most C programmers. It's nicely formatted, with plenty of consistency and thought put into the layout.

Re:Man, the universe loves me. :)

[Anonymous Coward]

Thats funny. I just looked at the source myself, and I saw plenty of comments. Not only that, but it was the furthest thing I could imagine from "spaghetti code". Very modular with a clean API.

But since this is slashdot I think concrete examples are in order. Lets say we want to find out about the buffer routines, where do we go? Oh, buffer.c. I wonder what is in that file?

Well, look at that! Its the buffer management API! WOW! Who would have thought it!

So, we want to add some data to an existing buffer. What function should we use? buffer_init() no...comment says /* Initializes the buffer structure. */ - clearly not what we want. Looking down we see buffer_append(). That sounds promising. But we can't expect people modifying the code to actually take the time to read and understand it, can we? So lets look at the comment to make certain sure. /* Appends data to the buffer, expanding it if necessary. */ I'm not sure, but I THINK that might just do what we wanted.

WOW that was SO hard, not helped one bit by all that blatant spaghetti code and total lack of comments!

Re:Man, the universe loves me. :)

[Nimrangul]

Gentlemen, behold! A troll being marked Insightful on Slashdot! OpenBSD are the ones with KNF, that's Kernel Normal Form, the style that all code in the base operating system (which includes OpenSSH) must conform to.

Re:Man, the universe loves me. :)

[jdunn14]

Clearing the screen when you logout is done (or at least was on my machines) by the .bash_logout.

Re:Man, the universe loves me. :)

[cyburdine]

So rather than, getting off your butt and fixing what you see as a problem. Instead you have chosen to just sit there waiting... waiting and waiting around for _someone else_ to _write an article_ so that _YOU_ can finally contribute to this world by ranting?

A: how sad
B: It's open source... you don't like it??? FIX IT!

Re:Man, the universe loves me. :)

[Reality Master 101]

I don't give a crap what style they're writing to, I actually looked at the source code. Either they're not following it or they're not doing it enough.

Have you actually looked at the code? Don't call me a troll unless you've actually looked at it.

Re:Man, the universe loves me. :)

[Reality Master 101]

WOW that was SO hard, not helped one bit by all that blatant spaghetti code and total lack of comments!

You've obviously never seen professionally documented source code. That it has a couple of useless comments doesn't make it well-documented.

Re:Man, the universe loves me. :)

[X.25]

I'm really not trying to post flamebait here, but GAH, the people who work on that thing should hang their heads in embarrassment. Spaghetti code, no comments -- I'm talking a total mess. I was actually just looking for the code that clears the screen when you log out of a session (because I actually hate the automatic clear screen, and was hoping there was an option for it). I finally gave up in disgust.

And this comes from a person who looks into OpenSSH source instead of .bash_logout.

It must be credible source review, really...

Re:Man, the universe loves me. :)

[stor]

Your informed opinion has no place in a Slashdot discussion.

Phew! Lucky it was actually a troll!

Cheers
Stor

Re:Man, the universe loves me. :)

[Suicyco]

What a dumbass.

If you can't figure out how to keep your screen from clearning (hint, NOT because of ssh) then what judge are you on the source code?

Ever seen the source code of the commercial SSH? Hmm. Is it even using the proper encryption algorithms? Is there a back door? We are talking heavy duty ENTERPRISE security here. You trust that level of security to a product that claims to protect your communications? Why not trust it to a product you KNOW protects your communications, because you can look right there in the source and then compile it yourself.

Re:Man, the universe loves me. :)

[Anonymous Coward]

Is it really any uglier or even more unreadable than the code John Carmack writes, though?

Re:Man, the universe loves me. :)

[Anonymous Coward]

Hm, now you've got me curious. I've only looked briefly, so I can't really say anything about it being spagetti or not, but it's certainly got comments. Yeah, they could be much better, but I wouldn't really complain. If you think those are useless comments... Where do you work again? Are they hiring?

Most open source code is far worse than this stuff, and I've been handed code from overseas at work that made that look professional.

Re:Man, the universe loves me. :)

[csirac]

Can you specify which source files you were looking at?

I'm curious.

Re:Man, the universe loves me. :)

[Anonymous Coward]

Because everybody knows that in professional software environments, programmers cannot be expected to be able to read code. Get a grip, haven't you ever heard of XP?

Re:Man, the universe loves me. :)

[Eivind Eklund]

I'm really not trying to post flamebait here, but GAH, the people who work on that thing [OpenSSH] should hang their heads in embarrassment. Spaghetti code, no comments -- I'm talking a total mess. I was actually just looking for the code that clears the screen when you log out of a session (because I actually hate the automatic clear screen, and was hoping there was an option for it). I finally gave up in disgust.

I've found the code reasonably easy navigate. Not as good as it could be, yet reasonably easy. And at least a LOT better than the commercial SSH code, which I have worked with before.

Oh, and as mentioned: The problem you are seeking is not in that code, it is a configuration error.

Eivind.

He Said, She Said

[Doc Ruby]

You can tell the difference between news and Public Relations fairly easily these days. Either can look at a controversy like "SSH is enterprise-class software" (whatever that means, exactly). PR publishes a story about how one party claims it isn't, and another party irately claims it is, without telling the story of whether, in fact (or even in reliable opinion), it is or not. Actual news reporters investigate what "enterprise-class software" is, compare SSH to that, and tell the story of the software. Even including the opinions of experts, and inexpert stakeholders in the debate.

We know that eWeek, like most IT press, is PR. But it's instructive to compare eWeek's obvious PR to "mainstream media", which is now mostly just PR. Real reporting keeps the "fairness and balance" in the process of determining the real story. Then tells the real story, with evidence and witnesses to back it up. PR, and most MSM, just spouts endless hourse of newscycle reiteration of "sources" promoting their versions of the story.

Bypassing-cookie-requirement reprint

[Anonymous Coward]

(Sites that will trap you in an infinite redirect loop if you refuse their cookies are intolerable. I'm reprinting article in the clear here to protest this behavior.)

SSH Claims for New Secure Shell Draw Open-Source Ire
By Steven J. Vaughan-Nichols
September 27, 2005

SSH Communications Security Corp., a provider of enterprise security solutions and end-to-end communications security and the original developer of the Secure Shell protocol, announced this week the availability of Version 5.0 of its SSH Tectia client/server solution and SSH Tectia Manager 2.0.

Secure Shell programs provide a transport-level protocol for administrators and remote users to securely log into remote servers for management, work and FTP (file transfer protocol) transfers. It's most often used for remote administration purposes.

The SSH Tectia is available on Windows, Unix, Linux and IBM mainframe z/OS environments. SSH Tectia can be centrally managed with SSH Tectia Manager.

Byron Rashed, senior marketing communications manager of SSH Communications Security, claimed that SSH's product is better suited for enterprise-scale business applications than a similar open-source product from OpenSSH.

"OpenSSH is not an enterprise-class product that is needed for the demands of a large-scale deployment. We do not compare OpenSSH to our SSH Tectia solution, since it's far from the same," Rashed said.

However, OpenSSH is very popular and is commonly deployed in almost all BSD, Unix and Linux systems. More than 87 percent of Internet-facing servers were using OpenSSH, according to an OpenSSH Internet scan in September 2004.

Rashed acknowledged this but added, "Many vendors use it because it is free and they can use it without a license, so the number of users for remote access is quite large, but it does not provide very good SFTP or application connectivity usage."

In any case, "OpenSSH certainly has its place, and we are not competing with them. We truly have a different class of product that is more suitable for business-critical applications" that customers ask about, said Rashed.

These comments raised the ire of Theo de Raadt, leader of the OpenBSD operating system and a member of the OpenSSH development team.

"OpenSSH is built into all Unix and Linux vendor operating systems, and is also built into almost all larger managed network switches, from Cisco through Foundry. It comes on Linksys and D-Link wireless and security routers too," said de Raadt.

"It is just the most commonly installed security software used anywhere in the world," he said. According to OpenSSH's numbers, the SSH product line is on less than 7 percent of servers, and most of that comes from SSH-1.5, with 5.38 percent.

"It is only when you get to their SSH-1.99 and SSH-2.0 versions, at 0.32 percent and 1.22 percent of the market, that you are talking about modern SSH commercial versions," said De Raadt.

Rashed contends that business customers are now looking for Secure Shell programs with support and liability protection "due to compliance regulations and security audits." Specifically, "we have heard lots about SOX 404 [Sarbanes-Oxley], CA SB 1386 [California Information Practice Act], HIPAA [Health Insurance Portability and Accountability Act] and others along with internal audits that are driving customers to SSH Tectia," Rashed said.

"Liability is also an issue that companies are worried about. Open-source software usually does not have any indemnity insurances associated with them."

This misses "the point that the two are not exclusive. You can go to any number of OS vendors [like Red Hat or Novell] and pay for accountability and support for an OS that includes OpenSSH," countered Mark Cox, a Red Hat Inc. consulting engineer and founding member of the OpenSSL group.

Re:Bypassing-cookie-requirement reprint

[ocelotbob]

Can someone tell me why sites which requires cookies are so intolerable? I mean, are you using a browser without a cookie manager or something? It takes all of 10 seconds to clear them, plus, you skew the marketing data even more by deleting cookies every once in a while. Or are you just a whiny bitch with nothing better to do than complain?

Re:Bypassing-cookie-requirement reprint

[Anonymous Coward]

I think the point was that it should send you to a "please accept cookies or go away" page, and not silently loop on the redirect that is trying to set the cookie. I certainly find websites repugnant which fail silently on my browser with my security settings because some web genius with a certificate out of a cracker-jack box didn't think accessibility mattered.

We define "Enterprise" ...

[ppz003]

as whatever our product has that the competition doesn't.

Re:That's like saying...

[Anonymous Coward]

Elivish ISN'T a real language. Elvish, on the other hand, is centuries old, and real. Like the Easter Bunny.

Makes sense to me

[eyeball]

...claims of OpenSSH not being an 'enterprise-class product' by SSH Communications...

That's because almost everything that's 'enterprise-class' is crap.

Sheesh. If I had a nickel for every time upper management was impressed into buying a 3-million dollar equivelent of syslog, I'd be back in the dot-com boom.

Re:Makes sense to me

[Anonymous Coward]

lolllllllll... that gotta be hilarious. I bet management buys MS Word for it's leetness productivity..Version 12->"We added tabs so now you get to pay 400 Dollars"..OpenOffice is the way to go.!!! woot woot....

Re:Makes sense to me

[meeotch]

I'd be back in the dot-com boom.

5-cent return on $3mil invested? Yes - yes, you would.

mitch

I've used both...

[LABarr]

for quite a number of years. In networks both big,(huge) and small. (just to the room next door) And to be honest the are both pretty much configure and forget. But if I were deploying a world class enterprise, I'd stick with OpenSSH. If for no other reason than it is an off-shoot of the OpenBSD project and using that has conviced me what a truly first class OS looks like. OpenSSH is enterprise ready enough for virtually anyone on this planet.

--
Simulated Sig

Well, what do you expect them to say?

[Bun]

"OpenSSH is an enterprise-class product that is needed for the demands of a large-scale deployment. We think OpenSSH compares very favourably to our SSH Tectia. In fact, there really is no reason for enterprise users, or any users for that matter, to purchase our SSH Tectia product."

Does anyone really expect Rashed to say that?

Re:clear screen

[TMacPhail]

I was actually just looking for the code that clears the screen when you log out of a session (because I actually hate the automatic clear screen, and was hoping there was an option for it). I finally gave up in disgust.

Try looking in your .logout file. It isn't done by OpenSSH.

Don't forget...

[Spy der Mann]

Don't forget the poor documentation for the OpenSSL API. Last time I saw (and that was a couple of months ago), some functions were still "to be documented in the future". :-(

Re:That's like saying...

[Anonymous Coward]

Name one non-ficticious native speaker of either one, and we'll call it a day. They're creoles at best.

"Enterprise-class" is a trademark.

[Strolls]

At least that's what Google AdWords keeps telling me. By a curious coincidence with this article I got an email from them today, saying I'm not allowed to use that term when describing the quality of the Linux-support for the ADSL modems that I sell.

I believe that I applied for an exemption for this term when I originally set up the ad with AdWords, but it's been running for months quite happily without bothering anyone.

When I Google for "enterprise-level" I (of course) get loads of hits discussing enterprise-ready email, whether Linux is enterprise-ready, firewalls & stuff, but I see the only advertiser is Enterprise Rent-A-Car UK. That makes me extremely tempted to trademark the term in the context of ADSL modems & then file a complaint about the Ford-pimping bastards. At least that way I might get a dialogue going with Google - as it is I confidently expect any complaints or protests about the matter to be ignored or get auto-responses; if I create a new advert with the words it gets suspended within half an hour.

If there's anyone reading this who works at Google then I'd be extremely grateful if you could have a little word with your censorship department for me, or give me a direct email address for them. Having an advert claiming "Outstanding Linux-support" simply doesn't satisfy me the way "Enterprise-level Linux support" does. And hey! Linux is a trademark, so I guess they'll be censoring that next week!!

Thank you for ignoring this rant. Please moderate it "funny" because i surely won't be so miffed at Google next week.

I've had this same problem with Qualcomm

[grnchile]

I reported a problem with Eudora a couple of years ago that Qualcomm support eventually attributed to a "bug" in OpenSSH. While it's true that we'd recently installed a new version of OpenSSH to address a security exposure, pointing out the widespread use of OpenSSH and the fact that every other POP3 client that I used with it worked just fine seemed to have no impact on them. It was quite clear from their responses that they didn't think we should be using OpenSSH - or open anything, as far as I could tell.

That's when I discovered that Thunderbird was reaching the point where it was a quite competent replacement for Eudora. I've taken great delight in pointing that out to anyone who asks about Eudora upgrades.

Re:I've had this same problem with Qualcomm

[doon]

OpenSSH or OpenSSL? They are not the same..

Re:That's like saying...

[MightyMartian]

I'll wager you don't even know what a creole is. Quenya and Sindarin are certainly languages, though they have limited vocabularies. As to Klingon, my understanding is that it is a language as well. Just because they are artificial is no reflection on whether they are languages or not.

Gee

[thre5her]

Keeping OpenSSH environments secure requires constantly updating the environment with latest security patches. However, updating OpenSSH servers involves an extremely laborious and time-consuming process of source-code compilation, testing, installation, and configuration. In large-scale environments this leads to a heavy administrative burden and increased costs. As a result, during the times of constrained IT budgets many organizations have been forced to neglect frequent security patches and software updates making them vulnerable.

Hmm... if any of these corporations hire a moran who can't run make on one system and distribute the binary throughout a network, they deserve what they get. I doubt Tectia can make it simpler than that. Hell, one could write a friggin' perl script to do it for them.

It seems that SSH Communications assumes retarded sysadmins are the norm in IT.

Yeah, not enterprise class like Apache isn't...

[adam872]

This is just stupid. There are open source products out there that are clearly good enough to be used in "enterprise" settings and OpenSSH is one of them (Apache, Perl, Linux being some others). I've looked at what commercial SSH vs OpenSSH offers and I honestly can't think of a reason to use the commercial product. I agree (for once) with Theo and ask if it's not "enterprise class", why would O/S vendors include it in their products (Sun, Redhat etc)? For the record, all of my Solaris systems run OpenSSH supplied by Blastwave and the Linux machines have it already. It's all about the right tool for the job and open vs commercial is a secondary consideration (IMHO) over utility. In this case, the open source offering is at least as good as the commercial product.

What extra features do you need out of SSH anyway? I ask not to be a smart arse, but as a genuine inquiry.

Re:Yeah, not enterprise class like Apache isn't...

[rnews]

Take a look at the authorized_keys options, in particular the ability to specify which ports can be forwarded (permitopen="host:port").

It would be very useful to have that ability globally, not just when a user has authenticated with a public key.

Re:Yeah, not enterprise class like Apache isn't...

[adam872]

Yep, that would be handy, I agree...

I'd be curious to know . . .

[Dausha]

If SSH Comm. uses OpenSSH in their products. I mean, maybe all they're doing is slapping some lipstick on a pig and calling it Paris Hilton.

Re:I'd be curious to know . . .

[Anonymous Coward]

and??

Re:I'd be curious to know . . .

[lachlan76]

If I remember correctly, OpenSSH is actually a fork of their product (before it was closed).

Re:I'd be curious to know . . .

[mederjo]

That's an insult to pigs !

That's also insulting to OpenSSH, come to think of it. You're saying OpenSSH is a pig ? Perhaps you mean "just putting some gilding on the lily" or similar ?

Jo Meder

Re:I'd be curious to know . . .

[Jussi K. Kojootti]

Maybe you need to read up on SSH history... Tatu Ylönen designed the first SSH protocol and wrote the original programs as open source (1995 or 96 I think). Later he founded SSH Communications and started releasing the subsequent versions with proprietary licenses. OpenDSB took the last free version and started OpenSSH.

So I guess you mistook the pig for Paris and Paris for pig. Understandable.

It does not help...

[jd]

...that a number of patches exist for OpenSSH (speedups, code cleanups, extensions, etc) that aren't getting folded into the baseline. Even if the patches (as they stand) don't meet the coding standards for OpenSSH (there are some?), you really should be seeing efforts to either get the patch writers to reformat to standards OR have core developers recode them.

OpenSSH is limited to IPv4 and IPv6. Limited? Well, yes. Linux supports many non-IP stacks, as do other *nix OS'. So long as you have some component to handle the making of connections and the sending of packets, the rest of OpenSSH doesn't need to care what sort of network you're using or what the transport mechanism is.

I believe OpenSSH can take advantage of some crypto hardware, but I don't recall seeing any announcements that it could use crypto drivers (or crypto functions) in the OS. It links to OpenSSL, but I don't recall seeing any provision for GnuTLS.

Is it the best crypto package out there (SSL included)? Yes. Is it the best it could be? Not by a long shot. Is it the best that it should be, given the code available (both for OpenSSH and as related libraries)? Not even close.

OpenSSH is every bit as "enterprise" as SSH - in fact, for some things, I'd say more so. Does that give the OpenSSH team any excuse to slack off? No - they should be so far ahead, by now, that SSH seems as ancient as the Pyramids and as user-friendly as a unicycle NASCAR.

Of course, we could settle the dispute by bribing^H^H^H^H^H^H^Hlobbying to make IPSec a Federally-mandated standard for all Internet-based computers. Then application-level crypto would cease to be important and we could get onto something useful, like Microsoft-bashing.

Re:It does not help...

[Nimrangul]

And where's your patch pickledick?

You're here whining, perhaps you should be at a terminal putting OpenSSH so far ahead that SSH.com seems like the ancient pyramids instead of complaining that people are working hard to put together something like OpenSSH at all.

OpenSSH's developers refuse shitty patches until they are sent in a manner that conform to the code standards and goal's of the project, if the people sending patches are too stupid to read and code properly before hand, why should the developers then hold hands and recode every shittily cobbled patch for them?

If you have a bug, you submit a report, if you want a feature you submit the patch - it's that simple.

You people just don't understand how to put up or shut up.

Re:It does not help...

[statemachine]

You are completely correct. This is OpenSSH's problem. Patches not getting folded in, responses like "where's YOUR patch, pickledick?", and the utter lack of OpenSSH programmers taking the initiative to fix stupid problems like cross-platform compiling on a non-target CPU.

I don't doubt that OpenSSH is enterprise-class when compared with the likes of Microsoft's offerings or SSH Corp., but immature responses from the supposed "OpenSSH developers" that don't further to solve the problems really put people off.

If OpenSSH would clean house of the wannabes and show some initiative and maturity, the OpenSSH team might get more respect from the outsiders.

Re:It does not help...

[Anonymous Coward]

The OpenSSH developers have no obligation what so ever to waste their time dealing with other people's random garbage ideas.

Developers don't have to take the inititive to do jack shit.

If you want something special, you get to work.

The developers will keep doing what they want, because that's what they've always done. They aren't here for you, they're here for them. You just happen to be given free stuff because they're nice.

OpenSSH developers at least are developing, what the fuck are you doing pissant? Oh right, you're being a little bitch on Slashdot, I forgot.

Re:It does not help...

[Nimrangul]

And since when, pray tell, did I become a developer? I'm just someone with more brain cells in my left nut then either of you dicksticks have in your heads.

You don't seem to understand how software development works in an open source environment, so allow me to illuminate your ignorance.

First, you complain about a lack of cross compiling support, if you'd be bothered reading you know that OpenBSD does not support it by choice, they refuse. Therefore you will never see it happen in OpenSSH without a developer joining the project with that goal in mind or someone being hired to add such support, cause no developer has it in their mind to do it.

Furthermore a software developer that works completely in their own free time does not have to do anything, they are a philanthropist, giving to the community for the good of all. They have no obligations, not tasks to complete, what they desire to do they do and what they do not they do not.

In an open source project, those that supply code are the people that are respected - not the people that are kindly, not the people that are photogenic, not even the people who are sociopolitical philosophers - the developers are the people who code and the coders are the people that matter.

If you want some happy little nymph to help you in all ways and make your life wonderful, pick up a crack pipe - it's as close as you're going to get.

This is the real world and unless you are paying for something noone has any need to do anything for you.

It doesn't matter if what people say, it's what people do.

When someone submits a shitty, poorly made patch with code that is unreadable it is not the responsability of a volunteer to sort through the nonsense and make use of the patch, that's a waste of their extremely valuable time. If the person cannot be bothered to do it right, they are ignored because they obviously cannot read and are draining resources from the project with the time required to find out how useless their patch is.

A real project doesn't have "wannabe developers", those people are the ones that submit patches, the developers actually get things done.

OpenSSH has initiative; it's become the single biggest ssh suite in the world. It also has maturity, it's been around for years and has become a stable and useful suite. And OpenSSH doesn't want respect from outsiders, respect doesn't matter, the project isn't being done for the respect of others.

Do you understand now, pinprick?

Re:It does not help...

[Tuck]

OpenSSH programmers taking the initiative to fix stupid problems like cross-platform compiling on a non-target CPU.

Like I said last time, none of the developers has a cross-compile environment so we can't test this. Also, like last time please either provide either a bug report (with contact address, so you can test a patch) or a tested patch (mail it to either the devel list or my address from my /. URL) so it can get fixed.

A slashdot post does not consistute a usable bug report. Even If I were to make the changes you're after I can't a) test it or b) get it to you so you can. I shudder to think what you'd have to do to a patch to get it past the lameness filter :-)

Yes, unfortunately, sometimes it takes longer than it should for things to be dealt with. Do you expect that refusing to do the little that was asked of you will improve this?

Re:It does not help...

[shrykk]

And since when, pray tell, did I become a developer? I'm just someone with more brain cells in my left nut then either of you dicksticks have in your heads... Do you understand now, pinprick?

You have a terrible attitude problem.

Besides, "Show me your code" breaks down when you want everyone to use OSS. Not everyone is a developer. Even developers don't have time to jump in and fix every project they have problems with. And the primary users of many projects will not be developers at all. If the average user can't suggest improvements without being ranted at, then don't expect them to use free software.

Oh well, you, Nimrangul, are (a) not a developer, (b) drunk or trolling, and (c) a known idiot, so it doesn't matter.

Re:It does not help...

[m50d]

OpenSSH's developers refuse shitty patches until they are sent in a manner that conform to the code standards and goal's of the project, if the people sending patches are too stupid to read and code properly before hand, why should the developers then hold hands and recode every shittily cobbled patch for them?

K&R wrote the fucking language, I think they knew how to write code properly.

If the patch fixes a bug or adds a needed feature, the developers should accept or rewrite it. The code works, if you've got your head too far up your ass to accept it then rewrite it.

Re:It does not help...

[Nimrangul]

K&R didn't write the original language, Kernighan was the guy that helped make it popular, Richie is the father of C.

If the patch is so poorly written that the developers cannot easily understand it it is not worth accepting because it would make the codebase worse and it is not worth rewriting because it will take work to try and understand it. The programmer supplying the code should be able to read the code in the programme and follow the style within if nothing else.

The developers aren't being payed here, it's not their job to do things for you. If your head is so far up your ass that you cannot be bothered to do anything right, then why should anyone pay attention to what you send them?

Re:It does not help...

[Nimrangul]

Quite the contrary, I have an excellent attitude.

People that are demanding of people that are giving them free stuff are the people with the problem.

If I give a bim on the streets a 5 dollar bill I do not expect him to yell at me for not giving him a 20 and a handjob - infact, that would piss me right off. And guess what, that's what you people are doing.

You're complaining about people giving you a hand, but not giving you all you want.

"Shut up and hack" works no matter the situation, if you're not a contributing member of the community you have no say in the community - it's that simple. You don't even have to develope it yourself, you can hire someone to add what you want, then you're a contributing member.

Noone is forcing people to use free software, if you don't want to use it because people don't care about you that's fine, people still won't care. They are not running a popularity contest, they are developing software for themselves and letting you have it too.

I, Nimrangul, am not any of the above, I am (d) smarter than you.

Re:It does not help...

[shrykk]

"Shut up and hack" works no matter the situation, if you're not a contributing member of the community you have no say in the community - it's that simple.

Only if you want a userbase consisting entirely of hackers. Those who advocate free software for general use (whether they believe that it's morally or technically superior) have to accept that most users want to use software for a particular purpose (to interact with their friends, or to do their jobs, say) and not to develop software. While of course the coders deserve respect (and non-coders can still contribute - with money, hardware, documentation, advocacy, usability testing), if the requests of the users are ignored, the resulting project may be idiosyncratic, ill-designed and under-used.

I, Nimrangul, am not any of the above, I am (d) smarter than you.

There are certainly lots of smart people here on slashdot, but in my experience smart folks don't feel the need to post crap like you do. Perhaps I should be smart enough not to respond.

Re:It does not help...

[m50d]

If the patch is so poorly written that the developers cannot easily understand

But that's not normally the case. They're rejected because they don't quite conform to the developers' holy indent style, or don't fit in with some political idea about what the program is supposed to be, or, even worse, not favouring one thing over another.

The developers aren't being payed here, it's not their job to do things for you.

I'm not being payed, it's not my job to do things for them. If I've written and given them a working patch, and there are no real (non-political) problems with it, the least they could do is commit it. Not doing it is abusing their power to force their personal views on their users.

Re:It does not help...

[Nimrangul]

It's not an abuse of power to say, "no, that idea goes against the goals of this project." The goals are out there, read the mailing list, there are even a few on their website where you can read them.

If you have different goals, start your own project.

If you're unable to spend the time to know how to properly submit a patch then it's your problem, not theirs, it's their project.

If you are wanting something to be accepted into it, you have to make it work the way the developers want it to work.

Your attitude is completely asshat backwards, it's not up to them to help you get what you want, it's up to you to get them what you want. But if you want to add in support for an algorithm that is patened, too bad, it won't happen. If you want to start favouring PAM, too bad. If you want to have it support the GnuTLS, too bad.

How hard is it to conform to the KNF? Are you saying it's so hard to conform to good coding guidelines that it's not worth adding the functionality you want? Fine, the functionality won't be added.

This isn't forcing their personal view on anyone, it's enforcing their views on their own project. No one is forcing you to be a user, there is no knife held to your neck waiting for the second you download lsh.

Don't like it? Go cry to your mother, maybe she can make it all better.

Re:It does not help...

[statemachine]

And like last time, I told you that the problem is simply that OpenSSH wants to compile and run the binary during its tests. You do not need a cross-compile environment to fix this. There are too many "tests" that require running the binary for me to fix up into a nice package. They are easy to spot but tedious to correct/hack for each release.

And like last time, I gave you the necessary information for you to find it. I don't have the time to hold your hand, nor formulate a good looking patch for you. And I'm damned sure that I'm not going to give out my contact information when your team and its sympathizers are full of immature brats.

I've since recommended a different solution and moved on to a different project.

Re:It does not help...

[m50d]

It's not an abuse of power to say, "no, that idea goes against the goals of this project." The goals are out there, read the mailing list, there are even a few on their website where you can read them.

The goals should change in response to user, and developer, demand. The only goal that should matter is the goal of providing what the users want, or, at the very least, what the contributors want.

If you have different goals, start your own project.

That's what the people with outstanding non-accepted patches are doing. It's not a very nice situation for the users.

If you're unable to spend the time to know how to properly submit a patch then it's your problem, not theirs, it's their project.

It's not their project, it's everyone's, or at least everyone who contributed. They just happen to be running it.

If you are wanting something to be accepted into it, you have to make it work the way the developers want it to work.

I'm fine with that, though I'd prefer it to be the way the users want it to work. But it seems to be you have to make it work the way a few developers at the top want it to work.

Your attitude is completely asshat backwards, it's not up to them to help you get what you want, it's up to you to get them what you want. But if you want to add in support for an algorithm that is patened, too bad, it won't happen. If you want to start favouring PAM, too bad. If you want to have it support the GnuTLS, too bad.

It's them who have it asshat backwards. If the users want it, the contributors want it, the contributors want it badly enough to write the code for it, it should be in the project.

How hard is it to conform to the KNF? Are you saying it's so hard to conform to good coding guidelines that it's not worth adding the functionality you want? Fine, the functionality won't be added.

It's a significant amount of extra effort. When I'm coding I'm concentrating on what the code does, and just about keeping the language syntax in mind with the help of my editor. I don't need an extra layer of mostly arbitrary artificial syntax to conform to. Writing it and then editing it to conform is easier but still a lot of tedious, pointless work. By all means reject code that's unreadable. But the fact that there are so many layout flamewars shows there is no real better way to do indentation, spacing etc. If the code works and is readable enough to be maintainable that should be enough.

This isn't forcing their personal view on anyone, it's enforcing their views on their own project. No one is forcing you to be a user, there is no knife held to your neck waiting for the second you download lsh.

It's their project because they started it first. Probably less than 10% of the current code is what they wrote. They should do what the community as a whole wants. Otherwise, all they'll end up doing is forcing a fork. You might prefer that outcome, but it doesn't make it any easier for anyone. The users have to put up with an inferior product or spend hours hunting down patches in the run-up, and then decide when the time is right, and if a fork happens whether to go with it. Developers have to put more work into maintaining their patches separately, and then decide whether to jump onboard with the fork, and should they try and submit any improvements they can make to both? Those trying to use the code for other programs have to decide which branch they're going with or put in more work to have their code work with both, and if they make the wrong choice that can mean a whole lot of porting work as their branch dies off.

The X change is instructive here. What did the XF86 maintainers gain by keeping tight control of their project? All they did was lose control entirely as developers went to xorg, and make things much worse for the users until that happened. The speed of development and visible improvements make it very clear that users are much better off now that a fork has happened. Unfortunat

Re:It does not help...

[Anonymous Coward]

You seem confused, this isn't being done for the users, seriously , it's not.

What the users want is irrelevant.

If some people don't want to use this anymore, that's fine, because it was never made for them anyways. That they were being given it if they wanted it does not mean it was being made for them because they wanted it. This is a freely given thing that people can use if they want, it's not being made for them, really, it's not. That they like to use it is wonderful, but not the goal.

The goal was to kill telnet, it's pretty much worked. If a new and wonderful ssh implementation came along and took over it would be fine, because OpenSSH did it's job - telnet is a thing of the past.

Things like PAM aren't completely backed because PAM isn't a proper standard, every PAM implementation is different and not compatible. And things like patented algorithms aren't in at all because this is FREE, there will be no non-free things in the source.

You want to have a fork, fine, go make NetSSH - it'd be a lovely turn-about. Some people will stick to OpenSSH, because they want a free, functional and secure implementation.

It's sometimes a choice of bells and whistles or a bikelock, I'd prefer the bikelock.

Re:It does not help...

[Nimrangul]

Exactly, grandparent is completely nuts.

They think that adding stuff that random people want is more important that following the goals of the project. He's just wrong and wrongheaded about it.

You cannot go adding everything that people want when that defeats the purpose of the project; you cannot add non-free things when a goal is to be free, you cannot encumber it with patented goup when a goal is to be unencumbered and you cannot support every alternative version of every implementation of standards when a goal is to be clean and simple.

Though NetSSH would be great to see, since there is already a FreSSH.

Re:It does not help...

[m50d]

If some people don't want to use this anymore, that's fine, because it was never made for them anyways. That they were being given it if they wanted it does not mean it was being made for them because they wanted it. This is a freely given thing that people can use if they want, it's not being made for them, really, it's not. That they like to use it is wonderful, but not the goal.

OpenSSH has become the focal point for everyone who wants to use or work on a Free SSH. That may not have been their intention, but it's what they now are. They should accept that.

You want to have a fork, fine, go make NetSSH - it'd be a lovely turn-about. Some people will stick to OpenSSH, because they want a free, functional and secure implementation.

Such a fork wouldn't succeed, not because people don't want what it would produce, but because openssh is good enough. Good enough is a killer.

It's sometimes a choice of bells and whistles or a bikelock, I'd prefer the bikelock.

There's no choice between them. The patches have been written, so it's not even a question of diverting developer effort, it's just a choice between having the feature or not. And things like extra algorithm support are more like a second chain than a bell or whistle.

Re:It does not help...

[Anonymous Coward]

No, outside people may view it as a focal point, but the project itself isn't - because the people involved in the project have chosen for it not to be. If other people think otherwise, then they are delusional.

It's not trying to be the be all and end all implementation of SSH, it's the free and secure one.

Adding random extra algorithms that are patened would end that free part and adding people's random patches that do not conform to their coding guidelines would end that secure part. Is that so hard for you to understand?

You want bells and whistles, stuff that isn't needed and does nothing good for the project - all it does is make it seem nicer.

Re:It does not help...

[m50d]

No, outside people may view it as a focal point, but the project itself isn't - because the people involved in the project have chosen for it not to be. If other people think otherwise, then they are delusional.

You can't control whether you are something like that, it's something that happens to you. It's the openssh maintainers who are delusional for denying it.

It's not trying to be the be all and end all implementation of SSH, it's the free and secure one.

And yet it rejects patches written with this same aim in mind.

Adding random extra algorithms that are patened would end that free part

Not in many countries, and the free-software-hardline way of dealing with that situation is to say there's no sense trying to bring free software to unfree countries. Being more moderate, they could easily set up a nonus version for algorithms currently patented there.

and adding people's random patches that do not conform to their coding guidelines would end that secure part.

If the code's unreadable, yes. But if it's simply indented or spaced differently that doesn't affect any aspect of its security.

You want bells and whistles, stuff that isn't needed and does nothing good for the project - all it does is make it seem nicer.

If you take that view they should only support a single algorithm. After all, there'd be less code to audit that way.

Re:It does not help...

[Nimrangul]

You idea is stupid, why on earth should the OpenSSH developers waste their time keeping forks for a bunch of countries in that manner? Those codebases would have to be hosted and worked on only in those countries that do not uphold those patents and not allow for the download of it into countries which do upload the patents, simply to avoid litigation. Purely insane concept on your part to think it worth effort. It'd be the opposite of the old crypto export problem they had with the United States back in the day.

If you want something like that, you fork it - or go use the OpenSSH-FOLK fork.

Anyways, as I said, you're so far off your rocker that you've entered orbit.

Re:It does not help...

[m50d]

Purely insane concept on your part to think it worth effort. It'd be the opposite of the old crypto export problem they had with the United States back in the day.

I seem to remember that being handled reasonably well. Yes, it took some effort, but people did it.

OpenSSH not enterprise ready

[Anonymous Coward]

True, you can't buy it !

OpenSSH specifically supports enterprise admin

[Nailer]

I'm sure there's a way to enterprise-manage ssh other than passing keys around. But it doesn't seem to come out-of-the-box with OpenSSH just yet.

Kerberos. It's implementation in OpenSSH is a good example of how they specifically support enterprise admin. Kerberos is fairly poor security wise, using symmetric encryption and hence holding copies of user passwords on the server. It's poor security according to those with high standards, and inferior to PKI according to everybody. But OpenSSH supports it, because Kerberos is the most popular single sign on method used at corporates.

Interestingly, OpenSSH's market share is something like 76% of all SSH servers.

Re:OpenSSH specifically supports enterprise admin

[ArbitraryConstant]

"Interestingly, OpenSSH's market share is something like 76% of all SSH servers."

Isn't it 90+, not counting re-branded OpenSSH versions?

Re:OpenSSH specifically supports enterprise admin

[Cajal]

How can you claim that Kerberos is "fairly poor security wise" ? I would argue that it's vastly *more* secure than PKI. You don't need to send your password over the network to authenticate, and it's actually possible to lock user accounts (unlike PKI, where you'd need a working revocation system to do that). And Kerberos doesn't store copies of the users' passwords on the server - it stores hashes of them (specifically, the output of the string-to-key function for each enctype you have enabled).

As for OpenSSH's support for Kerberos, I'm less than impressed. It was an uphill battle several years ago to get it to support gssapi-with-mic, so that it could handle user authentication with a Kerberos ticket, rather than tunneling a username/password pair to it. And it still doesn't support the new gssapi-keyex host authentication mechanism (so that you don't need a known_hosts file and ssh server keys at all).

Re:OpenSSH specifically supports enterprise admin

[Nailer]

> How can you claim that Kerberos is "fairly poor security wise" ?

Very easily.

> I would argue that it's vastly *more* secure than PKI.

Then you'll need better arguments than those below. You clearly didn't understand my post. If you can prove Kerberos is more secure than PKI you clearly know more than the authors of Kerberos, who disagree with you.

> You don't need to send your password over the network to authenticate,

Er, PKI provides that. And doesn't keep secrets on the server.

> And it's actually possible to lock user accounts (unlike PKI, where you'd need a working revocation system to do that).

Do you know of any PKI implementation that doesmn't include certificate revocation?

> And Kerberos doesn't store copies of the users' passwords on the server - it stores hashes of them

I know. A derived version of the password is effectively a password - replay attacks are trivial. If someone comproses a KDC, the game ends, and you lose. If someone compromises a server storing public keys, they get, er, public keys.

As a user, do you trust the second party to adequately secure their system? As an authenticator, do you want to be held legally responsible for identity thefts that were based on credentials you should not have been storing in the first place?

Kerberos is like single DES or MD4 passwords. Common, convenient, and weak as piss.

Re:OpenSSH specifically supports enterprise admin

[Cajal]

Could you provide any citation indicating that the Kerberos developers claim that PKI is more secure than Kerberos? Just one would suffice.

As for PKI, you've failed to provide a single example of a common PKI that handles revocation or manages private keys usefully. Certainly SSL, the most widely depolyed example of PKI, is basically encryption for show, since I don't know of any browser that checks for revocation (and some of them even allow expired certs by default), and they ship with so many CAs trusted that you can't be sure of who you're talking to.

As for KDC host-based security, the same argument can be made against a CA. If a CA's private key is compromised, you're screwed. And since most CAs issue certs for multiple security domains, the potential damage is far greater than a KDC compromise.

It boils down to this. If someone cracks my Kerberos password, I can contact my sysadmin and have him change my password. If someone breaks into my system and steals my credential cache, there is a very narrow window of damage. Most KDCs issue tickets good for 8-10 hours, and renewable up to a week at most. On the other hand, most certificates are good for 1-2 years. And mos PKI systems don't bother with revocation, since no one's figured out how to make it scale. So if someone steals my private key, I'm pretty much screwed.

OpenSSH is an application not a library

[gcauthon]

Until someone reorganizes the code into a library that can be linked into other applications, then I'm not sure how useful it is for an "enterprise". Sure I can use OpenSSH to log in to other machines and run command-line apps, but that's all I can use it for. If I want to develop a client/server app that leverages SSH technology then OpenSSH doesn't help me very much. Even if they did make a shared library out of it, if I linked it into my app then would my whole app need to go open source?

Re:OpenSSH is an application not a library

[Mnemia]

You mean like OpenSSL?

Re:OpenSSH is an application not a library

[xouumalperxe]

no. openSSH is BSD-licensed. If you need further information regarding the issue of using BSD-licensed code in commercial, closed source software, ask the Apple Computers legal department. They should be able to explain it to you.

keynote

[Anonymous Coward]

a default openbsd install comes with keynote, a fully-fledged distributed trust management system, which is automatically used by eg. isakmpd and such.

I hope they fixed the licence

[gelfling]

Because when we looked at it a few years ago it said something that amounted to

"This may or may not contain someone else's code so if someone comes after you legally, you're on your own."

Our lawyers did not like that one bit.

Axe gets me laid (or at least helps)

[Nastjud]

Maybe you need to use a different scent, but it works for me.

Re:Axe gets me laid (or at least helps)

[Narchie Troll]

Translation: "I need to resort to wearing perfume to attract sex partners."

Re:Axe gets me laid (or at least helps)

[alman]

Another possible translation: I bathe

Re:Axe gets me laid (or at least helps)

[d3ac0n]

Spoken like someone who doesn't understand what it takes to attract a sex partner. Trust me. No matter HOW good looking you are, no matter how witty and personable, no matter how well read and intelligent, If your body funk wilts plants from across the room no-one will want to have sex with you. Most of human attraction is BASED on scent. We usually don't notice it because it comes in the form of pheremones that we can't always conciously smell. Commercial scents like Axe (I use Kilo scent) serve to enhance the naturally occuring pheremones you aready emit with a conciously detectable pleasant smell. This serves to increase your chances of ending up in the sack with that prospective member of the opposite sex. Nasty body funk does JUST the opposite.

Re:Axe gets me laid (or at least helps)

[Anonymous Coward]

Idiot. Show one credible source that claims humans emit pheremones and they play a roll in human mating.

Here's a clue, fool; Experimental studies have shown that the (very small) amount of pheremones emitted by human beings have absolutely no affect on arousal. That $10 bottle of body spray may cover up the funk, but it doesnt have any unconcious effect on the opposite sex. Keep dreaming.

(FYI some studies have shown a correlation between the scent of male sweat and female arousal, so covering up the funk may actually be detrimental to your chances, biologically speaking. The social endocrination against "dirty" smelling people is far stronger than this mild biological response, however.)

Re:Axe gets me laid (or at least helps)

[Anonymous Coward]

Yeah, daily bathing is a modern comfort. The Romans liked it a lot too (they saw it as a sign of their superiority over the barbarians), and then when European civilization fell to barbarians it was back to dirtiness. What gets you laid depends on the times.

Re:Axe gets me laid (or at least helps)

[Carewolf]

No. There is no way to "enhance" human pheromones, as they have yet to be identified. It is just marketing crap.

In fact deodorants in general will remove the sexually attractive scents by inhibiting sweat. The reason is that sweat usually also smells bad.

Re:Axe gets me laid (or at least helps)

[Anonymous Coward]

Watch him carefully, he's an eager little bugger: he'll go so far as to reply to every comment he can, and probably this one too,

Is that a new trick to deflect any criticism of your posts?

Re:Axe gets me laid (or at least helps)

[schon]

Show one credible source that claims humans emit pheremones and they play a roll in human mating.

http://www.globecorner.com/t/t29/14687.php

The book reports an experiment wherein men and women were asked to smell unwashed shirts of the opposite sex, and rate the attractiveness. They were then given (unlabeled) photos of the faces of people who wore the shirts, and asked to rate their attractiveness. There was a very high correlation between the ratings of "attractive"-smelling shirts and attractive looking photos.

Re:Axe gets me laid (or at least helps)

[Narchie Troll]

Actually, most women I know hate it when men stink of cologne. There's a medium between "stench of cologne" and "stench of BO", and it's called "bathing."

Marketing Manager to /dev/null

[NullProg]

Byron Rashed, senior marketing communications manager of SSH Communications Security, claimed that SSH's product is better suited for enterprise-scale business applications than a similar open-source product from OpenSSH.

Since when do we care what a Marketing manager says about anything.

Enjoy,

Re:Marketing Manager to /dev/null

[Sax Maniac]

The more syllables in the job title, the more likely the job is shoveling bullshit. This guy is 13.

One day I was at a gas statio, and the guy pumping the gas had a button that said "petroleum transfer engineer". At least he didn't take himself seriously.

Re:Marketing Manager to /dev/null

[NullProg]

One day I was at a gas statio, and the guy pumping the gas had a button that said "petroleum transfer engineer". At least he didn't take himself seriously.

Thats OK, when I was a kid I always wondered what the sceptic tank cleaners called themselves. I say shit sucker :)

Enjoy,

No one knows what Enterprise class is?

[CrackHappy]

It's:
a) The kids who graduated from the elementary school held on the ship.
b) The stiff upper lip kept by Picard and crew in the face of extreme danger.
c) The next class after Galaxy.
d) The schooling you get by the geek army if you think Picard could kick Kirk's arse.

sheesh - I thought there were actual nerds on /. - guess I was wrong...

Re:No one knows what Enterprise class is?

[Anonymous Coward]

Umm, the next class after Galaxy is Sovereign, of which NCC-1701-E is
an example.

Get it right, pseudo nerd.

Not too much toflip out about..

[N3WBI3]

"Rashed contends that business customers are now looking for Secure Shell programs with support and liability protection "due to compliance regulations and security audits." Specifically, "we have heard lots about SOX 404 [Sarbanes-Oxley], CA SB 1386 [California Information Practice Act], HIPAA [Health Insurance Portability and Accountability Act] and others along with internal audits that are driving customers to SSH Tectia," Rashed said."

I was ready to jump all over this until I RTFA. This paragraph is truth, anyone who works with enterprise level systems know SOX and HIPPA are taken so seriously by the C-level execs of companies that they are desperate for someone to provide liability protection. That and management are important, and nowhere in the article did I see them say that SSH is no secure. Those of us who work with C-level people know that SSH Tectia has a point in seperating themselves from openssh, I just hope my CIO does not see this ;)

Re:Not too much toflip out about..

[cant_get_a_good_nick]

Yeah but read the license agreement (available if you put in fake info for a trial download on http://www.ssh.com/support/downloads/tectia-client /evaluation.mpl). It clears them of pretty much everything. IANAL, but I don't think this is any more or less protection than what you get from most typical OSI licenses.

Depends

[Sycraft-fu]

Often it's "enterprise" because it makes managing your enterpirse easier. Not something home users would care much about, but in a large environtment it's valuable. Like we use Ghost Enterprise Server here for PC work. The way it works is you install a Ghost client on the computers (if they run a supported OS) or boot from a Ghost boot CD/USB key (if they don't) and then the server can start ghost tasks. It can pull and push images to many systems at one all remotely. So if someone screws up a system (which happens in student labs) we can get it back up quickly, if we need to switch a lab over for something (like switch a Windows lab to Linux for a presentation), no problem.

Now it's nothing we couldn't do by hand, of course, and something we could probably hack together from freely available software. However the advantage here is that it's ready to go as is. Given that we do not have the time to mess with this kind of thing, it's worth the money to us.

Now I'm sure some enterprise software is pure fluff, but often the "non-enterprise" solution is woefully short on capabilities. It'll have all the technical stuff it needs, but lack in the ease of configuration, use and management. If you are running one server for yourself, you can tinker with nit pickey shit as much as is required. However when you run 1000 systems that's just not the case. You don't have that kind of time. You need to be able to centrally deploy and manage shit easily.

That's the whole point of things like LDAP (or Microsoft's version of it, Active Directory). Sure, you could keep a local user DB on each computer, and just update it as needed. Works fine, needs no new software. However that gets to be a bitch if you are talking 500 computers and 3000 users. Much better to have a central system. In our case, we pay Sun for a product that synchs our Active Directory to our Sun LDAP database. Could we do it manually? Sure. Could something have been hacked to do it? Ya, but we lack the time, and the personel to do that. Better to just pay Sun for it.

Re:Depends

[Nexx]

Just adding to your post, but not only do you have to weigh paying the personnel to write the pieces to do all that, but you'll also have to estimate how much it will cost in maintaining it.

Re:Depends

[Korgan]

So whats wrong with a local repository and doing network installs of Linux? The repository already has the software configured the way you want it and the net installer just grabs the packages and installs the system. Redhat call it Kickstart. I roll my own based on Ubuntu simply because its easy.

Managing users is simple too. OpenLDAP is a lot more capable than Active Directory in my opinion. Sure, its a bit of a learning curve, but anyone familiar with the fundamentals isn't going to have a problem. On the other hand, my personal preference is for eDirectory combined with dir-xml (Novell Identity Manager). This allows not only all the disparate operating systems but also a huge number of applications to all use a single authentication store (AD, eDirectory, OpenDirectory, OpenLDAP, SunOne... even use a database instead of a directory if you want.)

Sure, if you haven't done it before and aren't familiar with doing it, it might take a bit more time to set up initially than Ghost, but once its setup it is just as easy. And if you really want, why not build images and do an install in a similar vein to the way Gentoo does.

I'm not saying the way you do it now is bad, I'm just saying that it is completely possible to put together something with the same (or close to it) functionality with negligable costs. Any experienced Unix/Linux admin should be able to build the backend quickly and once thats built, any user in the world could start off an install by putting even a crafted floppy disc in a drive (or a CD or a USB stick or any other media the machine can boot from).

Alternatively, make it even faster and keep the OS images on the server and mount them locally. Reboot the machine and any changes by the user outside their home directory (or other intended directory) are wiped clean and fresh immediately. Not hard, done every day in Internet Cafe's and Kiosks.

Re:Depends

[Sycraft-fu]

What's wrong is we don't do Linux, for the most part, we do Windows. We also go back and forth, we'll have a Windows lab that needs to become a Linux lab for a weekend, then back to Windows on Monday.

As for OpenLDAP, talk to the Solaris admin, not my jursdiction. However I think you'd have a hard sell convincing the department to replace all the Solaris hardware, espically considering the apps we need are Sparc only in a number of cases. Same thing with replacing the Windows workstations, until you can find Linux versions of all the important apps (I'd say 1 in 20 has a Linux version) that's right out.

Ghost is excellent because it's lower level than an OS. I can have any OS or combination of OSes I like on an image. The management of any of the PC workstations is the same, I just pick the image I want and push it out.

My point isn't that Ghost is the only way to do things, my point is this is the reason someone would pay for the Enterprise version. This is what it does that normal Ghost does not, and it's something that doesn't ahve any readily available equivalant I'm aware of, except for other commercial, enterprise products like it.

I know that the DIY mentality is really popular on Slashdot, my point is that it doesn't always work. I DIY my systems at home, including hardware. I don't care to have an OEM dictate to me what kind of parts I'll have, or what will come installed on my computer. However at work, we buy OEM. Why? Well we lack the time to build systems ourselves, and the time to deal with RMAs on broken parts. RMAs for peicemeal hardware is a pain, usually if something breaks at home I buy a replacement, and then put the replacement part in another box when I finally get it. Can't do that at work so we buy OEM and if something breaks, an e-mail is all it takes to have a replacement part there next day.

Basically I'm just trying to help people see the situations where things like better, easier management really does matter. When you work in a small environment, it's easy to scoff at the waste of money these things are. I mean who the hell would pay $750 for an SSH server when OpenSSH is really pretty easy to set up, all said and done? However when you work in a larger environment, you often discover that the "easy" task is taking up an amazing amount of your time, and automating it would take even more time. It ends up being better to pay for a product that already does it, and that you know works.

This goes double if you don't have programmers on staff. I'm not sure where the misunderstanding that all or even most admins are competent programmers. Actually I find the opposite to be true. Most of the competent admins I know are at best mediocre programmers and most of the competent programmers I know are at best mediocre admins. There are a couple exceptions, but it seems for the most part when you spend your time doing one well, you don't have as much time to be good at doing the other. So if you staff is all support, no programmers, it makes even more sense to use off the shelf solutions. Better to spend $10,000 on a product that works than have 2 of your staff have 3 very unproductive months hacking something together that only sort of works.

Re:Depends

[flatass]

Let me just say this to that. G4U. A great imaging tool. Boots from a netBSD boot CD, and can handle disk and partition imaging to and from any FTP server.

Re:Depends

[Anonymous Coward]

Now I'm sure some enterprise software is pure fluff, but often the "non-enterprise" solution is woefully short on capabilities. It'll have all the technical stuff it needs, but lack in the ease of configuration, use and management. If you are running one server for yourself, you can tinker with nit pickey shit as much as is required. However when you run 1000 systems that's just not the case. You don't have that kind of time. You need to be able to centrally deploy and manage shit easily.

Check out cfengine.

Re:Depends

[heson]

G4U is great value for money compared to Ghost. For cloning lots of 'puters its great. However, it isnt powerful enough to replace Ghost for computer fixing. (Or atleast I think so, how do you transfer the system to a diffrent sized partition?)

Re:Depends

[flatass]

Good question. AFAIK as long as the destination disk or partition is the same size or larger, you simply to the same as when cloning. I have only been using G4U for about a week, so I am not an expert.

Security?

[jcole]

What extra features do you need out of SSH anyway? I ask not to be a smart arse, but as a genuine inquiry.

Security?

Secunia Advisories:

SSH Communications
- SSH Secure Shell for Servers 2.x
- SSH Secure Shell for Servers 3.x
- SSH Secure Shell for Windows Servers 3.x
- SSH Secure Shell for Workstations 2.x
- SSH Secure Shell for Workstations 3.x
- SSH Sentinel 1.x
- SSH Tectia Client 4.x
- SSH Tectia Server 4.x

OpenBSD
- OpenSSH 3.x
- OpenSSH 4.x

OpenBSD has a pretty good reputation for being secure and I didn't see anything in the advisories above that made me worry. I don't think this pay-to-play ssh is going to give me more security. I think I'll stick with OpenSSH.

-Joe

Mod parent funny & overrated

[PeterBrett]

Mod parent funny & overrated -- this is an oft-repeated joke on /. that seems to be regurgitated in some form every day...

Well, they do have a point...

[erikvcl]

The OpenSSH developers don't have any problem pushing back enterprise features such as partial authentication. In fact, they aren't even SLIGHTLY interested in supporting it even though there are patches out there that implement such a feature.

Re:Well, they do have a point...

[Slashcrap]

The OpenSSH developers don't have any problem pushing back enterprise features such as partial authentication. In fact, they aren't even SLIGHTLY interested in supporting it even though there are patches out there that implement such a feature.

This is just a wild stab in the dark, but is it possible that they don't have a fucking clue what you're talking about because you didn't bother to explain it? You know, in the same way that nobody here has a clue what you're talking about because you didn't bother to explain it?

Anyway, if partial authentication is such an important feature for your "enterprise", how about your enterprise gets off its fat corporate ass and does something about it?

Actually, I've just done some research and it turns out that my employer has been asking the OpenSSH developers for a version with no authentication at all. And you're right - they're just not interested! They keep mumbling something about security. Fucking arrogant, lazy, self-interested open source bastards aren't they? What the fuck do they expect us to do? Get one of our programmers to do it? Do they not know how much that would cost us?

Re:Well, they do have a point...

[erikvcl]

I guess I should have been more clear... My company did "get off its corporate ass"!

I implemented partial authentication for the current SSH versions based on some patches that are already out there. The OpenSSH developers are well aware of what partial authentication is (which is the ability to require two or more authentication methods before the user is allowed to log on). They just didn't want the patch because it is "too complicated" (both myself and the original author of the patch tried to convince the OpenSSH team that it was worthy). Since partial authentication is a relatively complex feature and OpenSSH doesn't have the right "hooks" in place, the patch is necessarily complicated.

So you have all of these Slashdotters all up-in-arms because someone actually said the truth about the software that they love. Then you have the OpenSSH developers rejecting enterprise features when the work has already been done. Go figure.

ROFL @ MODS

[Lehk228]

to the clueless mod who modded this up: it is an old template Mac troll.

Re:hmmm... this sounds familiar...

[Chmarr]

Key-generation: there are TONS of ways to generate a key. All of them will give you a key in the end, but the process leading up to it can be done in different, and varying secure ways. Faster ones will use a Pseudo-RNG (insecure), while slower ones will use network events (semi-real-random, and far more secure), or something like mouse movements. Really, you can't compare the two.

File copying: again, it's MOSTLY a function of the encryption algorithm. If you're using a simpler, and less-secure algorithm, you'll get faster transfers, and less CPU utilisation doing those transfers.

It's this kind of thing that Microsoft uses when comparing, for example, IIS and Apache. Their comparisons using HTTPS were done with different hash and encryption algorithms, which make up a HUGE portion of the resource utilisation.

I don't buy the F.U.D.

[PacketScan]

Let me start out by saying i've used openssh more that ssh communications. I've NEVER had a problem with open ssh it always acts how i configure it. I will however attach ssh communication on there claim based on my experience with there windows client. It's down right horrid. The free version is buggy as all hell and tends to crash only once in a while. If the free version is crapware the paid version is crapware as well. I see how they stand to make money on this.. To bad it won't be as much as intisipated as they just don't have a superior product.

Re:I don't buy the F.U.D.

[alphapartic1e]

Are you referring to SSH Communications' *free* client? I am a user of both versions of OpenSSH (FreeBSD) and SSH Communications (Windows), and I've not have any problems with both. OpenSSH's version is command-line based and works great on Unix, while on Windows, it's preferable to use a GUI version, which is what SSH Communcations distributes for free. Their client (SshClient.exe) is easy to use and doesn't get in the way. I'm not sure what you are talking about, but SshClient.exe has never crashed on me. Plus, instead of command-line scp, they have a GUI version much like FileZilla, accessible through SshClient.exe /f. While I haven't used much server side SSH on both Open and Communications (besides some OpenSSH sshd configs on FreeBSD), I don't find your argument again buggy software on SSH Communications part justifiable. The only unfornate case is that it seems Communcations has stopped updating their free client version since March 2004 (it was updated pretty often before).

Re:hmmm... this sounds familiar...

[Chmarr]

I responded to a troll.... shame on me :)

Corporations are people ...!!

[pbhj]

They're groups of people. They get together and decide what to do. Usually the controlling body of shareholders says "do wtf you want as long as I make oodles of money".

People hide within the group and don't care if they have Nike shares and Nike abuses child labour (an example from the 90's). The people say "great, more money for me"; then when it becomes public they say "oh shame on Nike".

What is possibly worse is that we, as consumers, say "your doing great" by buying the mega-corps products. There are few markets where there isn't a _more_ ethical alternative.

If the corporations, the groups of people are soul-less ... that's because the individuals don't bring their souls into their finances. Spending power can change the world. Look at the Fair Trade movement (http://www.fairtrade.org.uk/) ... heck don't just look, do something about it.

Re:Corporations are people ...!!

[Mr. Slippery]

They're groups of people. They get together and decide what to do. Usually the controlling body of shareholders says "do wtf you want as long as I make oodles of money".

They're not just groups of people, they are legal entities created by the state in a way that makes them unable to do anything but seek profit.

A business corporation that fails to screw over anyone it can in the name of profit can be sued by investors. Since for large corporations, those investors are often other profit-seeking-monster corporations, such suits would be a given if the corporation didn't plunder to within an inch of what the law allows - and even beyond what the law allows, if the penalty is less than the profit.

The modern large for-profit corporation is a Frankenstein's monster constructed of law rather than of corpses; and it's only by changing the law that we can tame these beasts.

Re:Corporations are people ...!!

[killjoe]

"They're groups of people. They get together and decide what to do. Usually the controlling body of shareholders says "do wtf you want as long as I make oodles of money"."

You may have heard of a study done where it was shown that people are willing to deliver deadly amount of shocks to subjects if they can remain anonymous. Humans are like that. When relieved of responsibility and guaranteed anonymity they can be incredibly savage and cruel.

Corporations were invented to shirk responsiblity and to diffuse responsibility enough to maintain anonymity. Within the context of corporations human beings act in incredibly vile ways. This is why it's so easy to for a corporation to kill hundreds of people just to save 50 cents on a part.

Re:Corporations are people ...!!

[Anonymous Coward]

A business corporation that fails to screw over anyone it can in the name of profit can be sued by investors.

That is a Slashdot Myth. Often repeated. Completely untrue.

Shareholders dictate the rules of the company. If the shareholders decide that their company must be profit-maximizing no matter what cost, then what you say might be true. However such companies simply don't exist in the real world. More realistically the shareholders decide that there is a purpose for the company. Many companies have statutes in the foundation documents stating their primary purpose is to produce a best-of-breed product or to be the world leader in a particular niche. These companies aim to maximize value rather than profit. Value includes non-tangibles such as customer confidence, employee satisfaction, and the long-term sustainability of the company. If the managers of those companies "screwed anyone in the name of profit" like you say they should, then they could be sued by investors for destroying the company's value.

Re:Corporations are people ...!!

[Anonymous Coward]

The irony here is that everything you just said about corporations applies equally, if not more so, to government. Yet, nowhere in your comment did I see any mention of the widespread, ubiquitous corruption in government.

Perhaps that's because you blindly assume that more government is the solution, and not part of the problem? Whoops...

Re:Corporations are people ...!!

[mrjatsun]

A little off subject, but a subtle difference that folks don't usually pick up. It's not really a "for-profit" motivation. "for-growth" (with the promise of profit) is what motivates public corportations. The stock market rewards growth, not profit... e.g. Microsoft can make billions of $$ in profit in a year, but investors won't be happy if it's not a decent % more than last years billions of $$ in profit.

Re:Corporations are people ...!!

[Jesus_666]

Is there a difference between a corporation and a political party? The former is an organization entirely fixated on growth and profit and the latter behaves as if it was...

Re:Corporations are people ...!!

[Mr. Slippery]

It's not really a "for-profit" motivation. "for-growth" (with the promise of profit) is what motivates public corportations.

It's for-profit in the sense of profit for the stockholders. Since dividends are pretty much passe, that means higher price for the stock, and yes, in the bizarre cancer-like economics of Wall Street that means continual growth in corporate profits.

Re:Corporations are people ...!!

[Mr. Slippery]

More realistically the shareholders decide that there is a purpose for the company. Many companies have statutes in the foundation documents stating their primary purpose is to produce a best-of-breed product or to be the world leader in a particular niche.

Those documents have as much meaning as the "mission statements" you sometimes see on the walls of francise restaurants. The stockholders of a large corporations (I'm not talking about Mom And Pop Inc down the street with five shareholders here) are interested in "best-of-breed products" or whatever only because they see it as a path to profit. If there are two ways to produce that best-of-breed widget, and one involves pollution, resource depletion, screwing workers, and political corruption but results in higher profits for the corporation, that's the path the corporation will take.

Value includes non-tangibles such as customer confidence, employee satisfaction, and the long-term sustainability of the company. If the managers of those companies "screwed anyone in the name of profit" like you say they should, then they could be sued by investors for destroying the company's value.

Uh, I'm not saying they should. In a sensible system, they shouldn't. I'm saying they do, because we have a non-sensible system.

Obviously these things you name are factors in the profitability of the shareholder's investment. But as the race to the bottom we are experiencing shows, they are very very tiny factors. Stockholders want their stock to go up, and the street rewards short-term growth rather than long-term sustainability. Employee satisfaction? Screw 'em, there's cheaper labor overseas. Customer confidence? If anyone complains, SLAPP their ass. And always externalize, externalize, externalize costs.

Re:Corporations are people ...!!

[Clod9]

I think it's obvious that changes in law are what's required. Ideally, the overall size of the law would go down. But it has little to do with the size of government. In fact, I believe that if the law were changed, many government regulators could be laid off.

What kinds of changes?
1. Corporations should lose their status as "persons", and to the extent they need to exist at all, have a vastly-reduced set of rights established.
2. Corporations should never, under any circumstances, be allowed to give money or goods or favors to politicians, their political parties, and their election campaigns.
3. Corporations should have publicly-viewable by-laws that specify precisely what business activities they are allowed to engage in.
4. Corporations should have different rules under which they are allowed to bring suit against individuals, depending on how big they are. The idea of a team of corporate lawyers descending on a private individual for years, blasting away at them, needs to stop (among other things).

I can think of several more, but I don't know how far to go. I think we need drastic changes to start off with, though.

Re:Corporations are people ...!!

[s20451]

The obvious counter-argument is that, in spite of its apparent flaws, no system has ever been demonstrated to produce greater general prosperity or efficiency than free market capitalism.

I like to say that the free market is the worst system ever invented, except for all the alternatives.

Re:Corporations are people ...!!

[pbhj]

>>> "Corporations should never, under any circumstances, be allowed to give money or goods or favors to politicians"

You're right (I think, but perhaps I'll think some more about that one). However, such rules are unenforceable in practice. How do you determine the line between proper business and favours? Also it's not right that a company director can't favour a friend just because their friend is a politician. Or is it?!

Re:Corporations are people ...!!

[marcello_dl]

...no system has ever been demonstrated to produce greater general prosperity or efficiency than free market capitalism.

Well let's leave alone the "free market" utopia. I can think of another system who produces more prosperity and efficiency than capitalism: slavery in ancient Greece. The Greek citizens had a better lifestyle than ours. Slave labour is more cost-efficient, too.

Of course, the price of slavery is unacceptable to the civilized man. But the current incarnation of capitalism built itself upon the squandering of resources and pollution should be unacceptable too. You can free a slave, you cannot tell a depleted uranium shell not to poison the land. And, what will happen to capitalism when natural resources are scarce? when pollution will have took from us the freedom to drink (gone), sunbathe(almost gone), breath naturally?

Re:Corporations are people ...!!

[s20451]

"General" prosperity by definition must include the slaves. I doubt they would agree that ancient Greece was such a great place.

What?

[93 Escort Wagon]

This guy has a short memory. Wasn't it SSH version 3.0 that let you authenticate under an existing user account, just by typing any two-character string for the password?

Re:What?

[typical]

Wasn't it SSH version 3.0 that let you authenticate under an existing user account, just by typing any two-character string for the password?

But it did so in an enterprise-class fashion.

RSA PAM

[chowbok]

We attempted integration with RSA and OpenSSH had significant problems that we had to resolve and in the end we could not resolve the final problem which was a session would hang after exiting the shell if the session was authenticated using the RSA PAM module.

I had that problem too... we fixed it by turning on PrivilegeSeparation (I know the RSA docs say to turn it off, but ignore that).

In any event, that's a problem with RSA's buggy PAM module, not OpenSSH.

Use DenyHosts to protect your SSH server

[Anonymous Coward]

If you're running an SSH server you'll want to use DenyHosts. It will help keep script kiddies and evil doers from having a party on your server. http://denyhosts.sourceforge.net/.

Re:That's like saying...

[WilliamSChips]

I can't for those two, but there are native Esperanto speakers. Like George Soros.

Any PR is Good PR for the Underdog...

[sednet]

the commercial ssh.com site appears to draw a bigger audience (and thus, a better alexa ranking) than the free openssh.com site. if the more popular, better-known software (ssh, commercial) wants to call attention to a free competitor (openssh, free), that's their mistake, and i hope the openssh community benefits from it!

Re:Any PR is Good PR for the Underdog...

[Anonymous Coward]

Alexa gathers their data from people using the Alexa Toolbar that works in Internet Explorer on Windows only. (more info)

Somehow I think that that fact may be playing a role there..

But they failed misserably

[twitter]

I'm sure SSH Communications stands to make more money if they can discredit a free, opensource product.

That might work if the free software was not as good as the commercial competitor. As it is, they just made themselves look like morons and I'll never consider anything they have worth the money because of it. OpenBSD is always ahead of commercial software in terms of actual security.

No, it's not the reporter. There's no way you can cover up babbling stupidity about "Enterprise" solutions and dissing OpenBSD.

Re:But they failed misserably

[thc69]

No, it's not the reporter.

One part is -- translating this from TFA:

These comments raised the ire of Theo de Raadt, leader of the OpenBSD operating system and a member of the OpenSSH development team.

into this headline from TFA and the /. post:

SSH Claims Draw Open Source Ire

Drawing Theo's ire and drawing "Open Source Ire" are very different things; everything draws Theo's ire. As a whole, the OSS community is much more tolerant.

Re:But they failed misserably

[Anonymous Coward]

Read this and educate yourself. Nice troll.

Re:But they failed misserably

[Lucractius]

"OpenBSD is always ahead of commercial software in terms of actual security."
I point you to a commercial Closed source operating system called OpenVMS, known for being THE most secure OS your money can pay for the privilege to run. As well as being known for 99.999% reliable in real world enviroments.

Funnily enough... its not widely know... cause its owned by HP... and well we all know HP suck, buying their seats on the Itanic 3 years in advance...

I am sorely tempted...

[jd]

...to fork OpenSSH, get those patches in and do some decent testing. Hell, why not? You're absolutely right that there is a serious attitude problem going on with the development team - which, IIRC, was the reason OpenSSH was started in the first place. A shitty attitude from SSH.

If OpenSSH's team are worthy enough, then people will stay with them and the fork will fade into history. If, as I suspect, OpenSSH is mostly popular because there are no serious competitors (the rest are infinitely worse), then the moment serious alternatives exist, those alternatives will supplant OpenSSH as the secure system to use.

Anyone can be on top of the heap, when there's no meaningful heap to speak of.

Re:I am sorely tempted...

[Secret Rabbit]

You speak such strong words, you may incurr the wrath of the Theo.

So, I'll just stand out of the way and ask you to put your money where your mouth is. I expect to see a report of a fork of OpenSSH in the morning featuring jd.

Then we'll see who's the better.

Re:I am sorely tempted...

[Anonymous Coward]

Go for it, be sure to have blackjack, and hookers... Infact, forget the secure shell.

Re:I am sorely tempted...

[Anonymous Coward]

I eagerly await jdssh, the project that doesn't like hackers and prefers whiners. Hey, maybe you can get the support of someone who knows how to code, so it can be your army of do-nothing idiots and one guy getting frustrated by your constant bitching about irrelevant bullshit. Yeah, that'd rock.

Re:I am sorely tempted...

[jd]

I respect Theo as someone who gets things done, as someone who is great on the frontier of computer security, and as someone who is absolutely essential if software security is to be done right.

I neither respect him OR those who follow him for their attitudes, however. I don't know how long Theo's been in programming, but I believe it likely that I've hacked for longer, better and over a wider range of architectures and programming languages. I've probably worked on a wider range of networking infrastructures, a wider range of Operating Systems and in far more countries than most of the OpenBSD and OpenSSH folk.

Does that give me airs? No. Does that give me the right to question tactice? Oh, certainly. What use is having breadth of knowledge if you never employ it to correct those with depth of specialised knowledge? Specialists are great, nothing wrong with them and you often NEED them, but specialists need generalists in order to make the best use of their skills. Too limited a horizon can make for bad decisions that simply aren't visible to specialists.

A broad horizon, on its own, is equally useless, as you don't get the depth of vision. The ideal is for generalists and specialists to work together, each complimenting the other's skill sets. When that does not happen, the specialist needs to go first, the generalist can then make adjustments, but eventually you'll need to go back to a specialist to progress beyond a certain point.

The FOLK version of OpenSSH is the generalist stage. It will work towards making a more generalized OpenSSH, with a greater range of features, but sooner or later it will need to either re-merge with the classical OpenSSH -or- have a Theo-like person to take over, to drive it to where it needs to go. This is merely a course correction fork.

Re:I am sorely tempted...

[Anonymous Coward]

Theo's been quoted as saying, "I started programming [on] the Vic 20," he also worked on a Commodore and Amiga after that. From there he hacked on some PCs during highschool and then got involved in BSD during the 4.2 days when he was in university. He's worked on Sun's Sparc machines using various versions of SunOS and Irix on some SGI boxes. For more than 25 years he's been programming, which isn't too shabby considering he is only 37.

Re:I am sorely tempted...

[jd]

Newcomers! Honest. My first computer was a Commodore PET 3032. Not too long after, I started coding on the Apple II. Moved on to the BBC Micro, Vic 20, Commodore 64, Acorn Electron, Prime 350, Prime 750 and DEC PDP-11. Next up was the Ferranti PC, the Viglen PC, the Master 512 and the Acorn Archimedes. For the PC OS, around that time, I used MS-DOS, DR-DOS, Windows (starting with version 2), GEM and DesqView. A few years later, I added the Sun Sparcstation, the Motorola 68040 + VxWorks, 386BSD, Linux and the DEC VAX. Hmmm, after that I went through FreeBSD, NetBSD and OpenBSD, Solaris (x86 and Sparc), OSF/1, HP-UX and a little AIX. More recently, I've added Inferno, Plan9, ExoPC, EROS, HURD and the Linux variants of L4Linux and MOSIX/OpenMOSIX.

Not too shabby, either, given I turned 36 yesterday!

OpenSSH comes on Linksys products?

[user32.ExitWindowsEx]

Would someone please tell me what D-Link and Linksys products come with OpenSSH *by default*?

The best I've ever seen is that *some* can have a telnet server enabled by trickery.

Re:OpenSSH comes on Linksys products?

[Anonymous Coward]

Can you tell me which ones don't?

What do they run?

Re:OpenSSH comes on Linksys products?

[Anonymous Coward]

Linksys and d-link make managed switches not aimed at the consumer market, he isnt talking about the horrid piece of crap routers that you can buy at bestbuy.

I might be off here, however...

[Anonymous Coward]

The article states:
Keeping OpenSSH environments secure requires constantly updating the environment with latest security patches. However, updating OpenSSH servers involves an extremely laborious and time-consuming process of source-code compilation, testing, installation, and configuration. In large-scale environments this leads to a heavy administrative burden and increased costs. As a result, during the times of constrained IT budgets many organizations have been forced to neglect frequent security patches and software updates making them vulnerable.

Even if organizations are willing to go through the costly process of manually maintaining the software on a regular basis, lack of centralized management can still present a risk.

In my case, I don't see where the rocket science is in:
gentoo# emerge -u
or in
gentoo# emerge --update --world

Now, our production boxes are running gentoo, but most of the other package systems (with the exception of RPM) are equally adept at managing upgrade etc very easily. Seems to me like the fine folks at SSH are getting a little desperate?

The only reason they're still in business is...

[Secret Rabbit]

... the pointy haired boss who's knows jack about security and dictates policy that (s)he know nothing about.

Security through obscurity just doesn't work.

I'll take the quality I know I'll get from the OpenBSD/SSH guys over profiteering gluttons any day.

I will probably be modded down for this but

[einhverfr]

I figure I have to say it. SSH has its uses, but some people try to use it as a substitute for kerberized, encrypted telnet. IME, kerberized, encrypted telnet is far more flexible in a corporate environment (and it can be configured to require both kerberized authentication and session encryption if you know what you are doing).

Telnet is not insecure. It is usually just implimented that way.

IMO, SSH in general is handy as a light-weight VPN, and it is handy for certain ad-hoc network tunneling, but it is really a jack of all trades and master of none. Personally I don't consider any version of SSH by any vendor (including SSH.com) to be a heavy-duty component of a network infrastructure (for tunneling, use IPSec, or GRE through IPSec, for remote access use encrypted telnet with kerberized authentication, as it is often a bit more scriptable).

Re:I will probably be modded down for this but

[Vengie]

So far it is the best way I've found of slamming x11 connections through ANYTHING. Previously I used to have to port-forward 6000-6004 manually... But I agree with you 100%. SSH != Kerberized Telnet...

Re:I will probably be modded down for this but

[einhverfr]

So far it is the best way I've found of slamming x11 connections through ANYTHING.

As I said, for a lightweight VPN, it is great. But for anything really complex you are better off with a IPSEC tunnel, maybe with GRE running through it (if you need non-TCP/IP protocols).

On the topic of RSA PAM, and security in general

[Nailer]

Out of every company in the world, what's the last you would expect to not provide a crytographically signed package?

RSA's own PAM modules for RHEL are distributed as an unsigned tarball. Along with the stuff you're telling me above, I don't really have much trust in RSA as a security company (and hence any trust in RSA at all).

Theo doesn't want to fix brute force attack probs

[Anonymous Coward]

Theo and OpenSSH have a problem, brute force attacks. When asked about it he doesn't want to do the extra work to make OpenSSH more secure. Yea, it's a multi threading problem and he says just go use some other software that will mask his problem by putting up a firewall rule in front of his OpenSSH code.

Then try talking to him about passphrases. This guy is a danger to everyone's security. OpenSSH should be replaced or forked as soon as possible (open source only please).

Try asking him, watch what you get back.

http://www.openssh.com/list.html

Google!

[the_flyswatter]

Their marketing guy may claim their stuff is enterprise level and all, but Google ranks openssh.com higher than ssh.com! http://www.google.ca/search?hl=en&q=ssh&btnG=Googl e+Search&meta=

So there!

a few facts

[rsilverman]

There's a lot of exaggeration and vagueness on both sides of this little
tempest. What suffices for one enterprise may not for another, so it is
certainly silly for ssh.com to claim that OpenSSH is not
"enterprise-class" -- as Theo and others rightly point out, OpenSSH is
used successfully in many large contexts. On the other hand, it is a fact
that Tectia has a number of features OpenSSH lacks, some of which are
particularly relevant to large organizations (which is not the same as
simple widespread use). Here are a few of them:

* PKI support

Tectia can use X.509 certificates for both client and server
authentication. To add a new SSH server or change an existing one's host
key, all you need do is issue a certificate for it. Clients need only
have a copy of a single public key: the issuing CA certificate. No
constantly shifting mess of per-user and per-host known-host files to try
to keep in sync, no spurious "unknown host" or "host key changed messages"
confusing users and teaching them to ignore security warnings. It just
works.

For client authentication, there are no burgeoning copies of
authorized_keys files lying around, unmanaged, needing to be individually
tracked down whenever you want to turn off someone's access: instead, you
can simply revoke the user's certificate. And flexible rules can grant
access based on certificate attributes, like "anyone in the Foo Department
can log into this host."

The distributed-trust problem has been addressed abstractly by systems
like PKI and Kerberos. In a large (or even medium) scale environment, you
want to tie applications such as SSH into these systems, not have each one
use its own ad-hoc mechanism.

Note that both OpenSSH and Tectia support Kerberos. There is some
variation in how well they use it to address the above problems, though,
and I won't get into that here.

* Greater configuration flexibility

With the Tectia SSH server you can:

+ Modify almost all server parameters based on the client hostname and
address, or properties of the requested account (username and group
membership). Thus you can arrange that, accounts in one group permit
password authentication, while those in another group require
public-key -- or that connections coming from your internal network
allow a wide range of ciphers, while those coming from the outside
require a smaller, stronger set. You can accomplish some of this type
of thing with OpenSSH, but generally you have to run multiple
instances of the server on different ports.

+ Exert finer-grained control over what kinds of SSH services you
provide. You can forbid terminal access while still allowing sftp,
for example, by simply rejecting the corresponding SSH protocol
requests (shell and exec channels), rather than resorting to custom
shells or other hacks that have unwanted side effects.

+ Control port forwarding with ACLs that include permit/deny statements
and patterns matching user, target hostname, IP address, etc.

+ Require multiple forms of authentication for access (e.g. password and
public-key).

* SOCKS support for outgoing SSH connections (note this is different from
the OpenSSH -D feature, which Tectia has also).

* "chroot"-ed logins

* integrated support for RADIUS authentication

* Support for Windows-native Kerberos. Although OpenSSH can be built with
Kerberos support on Windows (with Cygwin), it does not

Re:a few facts

[aok]

According to the developers, OpenSSH will probably never have native chroot support.

Re:a few facts

[typical]

Control port forwarding with ACLs that include permit/deny statements and patterns matching...target hostname

And you're saying that you consider this a feature, not a bug? In an security system?

Re:a few facts

[csirac]

Indeed.

I was able to get around a restriction on a university machine's SSH server policy of "only allow the client to forward ports to server's localhost" by running another ssh client on the server and forwarding the localhost port via another box on the outside... and all so I could get around the stupid firewall not allowing CVS :-(

Re:a few facts

[sysadmn]

You can't post facts and reasoned analysis here! This is Slashdot, for heaven's sake!
PS - Congrats on writing a "definitive guide" that lives up to the claim!

Re:a few facts

[rsilverman]

If you allow shell access, then of course such restrictions are ineffective, since people can install/use their own forwarders, as you did. To make them effective, you restrict the relevant accounts to port forwarding only.

Everyone in IT knows...

[FellowConspirator]

... that "Enterprise Class Product" refers to the license cost, not quality or features. SSH Communications is right. OpenSSH doesn't cost enough to be "Enterprise Class".

Re: Hamsters

[stoicio]

Actually hamsters have more dark meat. Guinea pigs have more white meat.

eWeek's article is just simply dumb!

[Anonymous Coward]

eWeek's article is just simply dumb! Every single Agency/Department on the US Federal government and every single small, mid and large company in the world with an actual network uses it at one level or another. If this is not enterprise level, I don't know what is it!

wanna sell ssh? Then make it better!

[Danathar]

If they want people to buy a commercial version of SSH then they should provide something of value that OpenSSH does not provide!

Ideas...

1. How bout a hardware based SSH accelerator for fast SFTP/SCP transfers?

2. GUI configuration in X/QT/GTK...ect...

3. Performance monitoring tools

I pulled these out of my ass in 3 seconds. None of them may be worth the time but you get the idea!

Re:wanna sell ssh? Then make it better!

[csirac]

Ideas...
Ahh, well, they're already one step ahead of you on these things :-)

1. How bout a hardware based SSH accelerator for fast SFTP/SCP transfers?

http://www.openbsd.org/cgi-bin/man.cgi?query=ubsec &sektion=4 (as far as I know, hardware crypto accelerators are automatically taken advantage of for OpenSSH/OpenSSL applications)

2. GUI configuration in X/QT/GTK...ect...
http://www.webmin.com/standard.html webmin - has all the pretty check-boxes and drop-down combo lists you need. There are probably other solutions besides webmin that you can use.

3. Performance monitoring tools
Erm... top? I don't know what performance parameter you need to monitor. The OpenSSH scp client already gives you a transfer rate.

Moral of the story: Like many other unix things that are Good (tm), OpenSSH doesn't have to be all things to all people... one app that does one thing and does something well is the "unix" way. It's quite trivial in most cases to expand functionality by taking advantage of the modularity of these things.

Having said that, OpenSSH really does quite a lot of stuff.

Re:wanna sell ssh? Then make it better!

[m50d]

If they want people to buy a commercial version of SSH then they should provide something of value that OpenSSH does not provide!

They're claiming they do just that, by providing tools for centrally managing your installation, and better SFTP support, things that openssh lacks.

Re: Hamsters

[kcarlin]

Actually hamsters have more dark meat. Guinea pigs have more white meat.

I'm sorry, I didn't quite catch the name of your kabob place?

Mod story troll.

[Anonymous Coward]

That's the whole thing about Linux/Unix. SSH isn't meant to have those types of tools. Just like grep shouldn't have a field separator (awk) or a line counter (though it now does:)). My configs are handled by rdist, rsync or cfengine.

So yeah, that's why the SSH guy is saying, "We do not compare OpenSSH to our SSH Tectia solution, since it's far from the same." In other words, here you have OpenSSH. It secures the wire. Here you have our commercial product. It secures the wire and lets you manage things centrally. Naturally, this is a better fit for your centrally managed enterprise. I don't think they are saying "OpenSSH is shit." I believe they are saying, "We're easier to use." And for an IT dept. staffed with the finest MCSEs money can buy, that can be a strong selling tool.

The "We're everywhere therefore we're better" response is just retarded. Windows is everywhere too. Is it better? I'm guessing these guys were misquoted or their quote was taken out of context.

The commercial company isn't selling the SSH part so much as they are selling the central management aspect of it, which to my knowledge is not part of OpenSSH because that is the way it is supposed to be. Unix tools in general are supposed to be that way. You do not allow feature creep to dilute the value of a tool. Want a new feature? Write a new tool that provides that feature and that feature only, and does it well. Then string the two together with a shell script or a little C app. OpenSSH does one thing well and one thing only. Secure Shells. If you want a central management app, you write one that makes use of OpenSSH libraries or you find one being offered by someone else.

The discussion should be, "What open source SSH management solutions are available and how do they stack up against this commercial solution?" The whole article should be modded troll. It seems whoever submitted the article is the same kid who instigated fights on the playground when I was a wee lad.

Re:clear screen

[adric]

He should check for signal traps as well. Some of the SAs I work with like to add "trap clear 0" (or similar) to /etc/profile.

$ trap
trap -- 'clear' EXIT

Retarded sysadmins

[HermanAB]

Well, considering how many compromised Linux machines are running SSH password crackers looking for other badly configured setups, incompetent sysadmins are the norm.

Ford Claims Japanese Cars....

[chef_raekwon]

In other news, Ford claims Japanese automobiles aren't real automobiles... "They weren't here in the 50's when we had some bad ass cars -- and our powerful mustang is the real deal" cites the CEO of Ford. He continued with "How can we even put those cars in the same class? I mean, damn, they last longer, are better built, but their engine light comes on when the gas cap isn't screwed on tightly enough. What kind of car does that? Doesn't sound like a real automobile to me."

sheesh.
yes, sounds like a troll. never thought i'd stoop...

Not much more protection than OpenSource

[cant_get_a_good_nick]

Though TFA mentions extra protection for rule sets like SOX and others, actually checking the license shows them pretty fairly lacking. Like most EULAs, you give up pretty much everything. This is what you get from: http://www.ssh.com/support/downloads/tectia-client /evaluation.mpl It looks like it is their normal license, plus an amendment for the temporary license period. I extracted some parts on liability, yadda yadda.

8. WARRANTY

LICENSOR EXPRESSLY DISCLAIMS, TO THE EXTENT PERMITTED BY APPLICABLE LAW, ALL WARRANTIES, WHETHER EXPRESS, IMPLIED OR STATUTORY, INCLUDING, WITHOUT LIMITATION, ANY IMPLIED WARRANTIES OF MERCHANTABILITY, OF FITNESS FOR A PARTICULAR PURPOSE, NONINFRINGEMENT OF THIRD PARTY INTELLECTUAL PROPERTY RIGHTS, AND ANY WARRANTY THAT MAY ARISE BY REASON OF TRADE USAGE, CUSTOM OR COURSE OF DEALING. LICENSOR DOES NOT WARRANT THAT THE SOFTWARE WILL BE FREE FROM BUGS OR THAT ITS USE WILL BE UNINTERRUPTED NOR THAT THE SOFTWARE WILL OPERATE WITH ANY HARDWARE AND/OR OTHER SOFTWARE OR REGARDING THE USE, OR THE RESULTS OF THE USE, OF THE SOFTWARE OR DOCUMENTATION IN TERMS OF CORRECTNESS, ACCURACY, RELIABILITY OR OTHERWISE. WITHOUT LIMITING THE FOREGOING, YOU ACKNOWLEDGE THAT THE SOFTWARE IS PROVIDED "AS IS," WITHOUT WARRANTY OF ANY KIND.

9. LIMITATION OF LIABILITY

THE ENTIRE RISK AS TO RESULTS AND PERFORMANCE OF THE SOFTWARE IS ASSUMED BY YOU. ANY LIABILITY OF LICENSOR WITH RESPECT TO THE SOFTWARE, THE PERFORMANCE THEREOF OR DEFECTS THEREIN, OR UNDER THIS AGREEMENT, UNDER ANY WARRANTY, NEGLIGENCE, STRICT LIABILITY OR OTHER LEGAL THEORY SHALL BE LIMITED EXCLUSIVELY TO PRODUCT REPLACEMENT OR, IF REPLACEMENT IS INADEQUATE AS A REMEDY, OR, IN LICENSOR'S SOLE OPINION, IMPRACTICAL, TO A REFUND OF THE ACTUAL AMOUNT PAID BY YOU TO LICENSOR, IF ANY, FOR THE SOFTWARE OR SERVICES GIVING RISE TO THE CLAIM.

10. DISCLAIMER OF DAMAGES

UNDER NO CIRCUMSTANCES WILL LICENSOR OR ITS LICENSORS BE LIABLE FOR ANY SPECIAL, INDIRECT, INCIDENTAL, EXEMPLARY OR CONSEQUENTIAL DAMAGES OF ANY KIND OR NATURE WHATSOEVER, WHETHER BASED ON CONTRACT, WARRANTY, TORT (INCLUDING NEGLIGENCE), STRICT LIABILITY OR OTHERWISE, ARISING OUT OF OR IN ANY WAY RELATED TO THE SOFTWARE, THIS AGREEMENT, WHETHER DUE TO A BREACH OF LICENSOR'S OBLIGATIONS HEREUNDER OR OTHERWISE, EVEN IF LICENSOR OR ITS LICENSORS HAVE BEEN ADVISED OF THE POSSIBILITY OF SUCH DAMAGE OR IF SUCH DAMAGE COULD HAVE BEEN REASONABLY FORESEEN, AND NOTWITHSTANDING ANY FAILURE OF ESSENTIAL PURPOSE OF ANY EXCLUSIVE REMEDY PROVIDED IN THIS AGREEMENT. SUCH LIMITATION ON DAMAGES INCLUDES, BUT IS NOT LIMITED TO, DAMAGES FOR LOSS OF GOODWILL, LOST PROFITS, LOSS OF DATA OR SOFTWARE, WORK STOPPAGE, COMPUTER FAILURE OR MALFUNCTION OR IMPAIRMENT OF OTHER GOODS. IN NO EVENT WILL LICENSOR OR ITS LICENSORS BE LIABLE FOR THE COSTS OF PROCUREMENT OF SUBSTITUTE SOFTWARE OR SERVICES.

YOU ACKNOWLEDGE THAT THIS SOFTWARE IS NOT DESIGNED OR LICENSED FOR USE IN ON-LINE EQUIPMENT IN HAZARDOUS ENVIRONMENTS SUCH AS OPERATION OF NUCLEAR FACILITIES, AIRCRAFT NAVIGATION OR CONTROL, OR LIFE-CRITICAL APPLICATIONS. LICENSOR EXPRESSLY DISCLAIMS ANY LIABILITY RESULTING FROM USE OF THE SOFTWARE IN ANY SUCH ON-LINE EQUIPMENT IN HAZARDOUS ENVIRONMENTS AND ACCEPTS NO LIABILITY IN RESPECT OF ANY ACTIONS OR CLAIMS BASED ON THE USE OF THE SOFTWARE IN ANY SUCH ON-LINE EQUIPMENT IN HAZARDOUS ENVIRONMENTS BY YOU. FOR PURPOSES OF THIS PARAGRAPH, THE TERM "LIFE-CRITICAL APPLICATION" MEANS AN APPLICATION IN WHICH THE FUNCTIONING OR MALFUNCTIONING OF THE SOFTWARE MAY RESULT DIRECTLY OR INDIRECTLY IN PHYSICAL INJURY OR LOSS OF HUMAN LIFE.

Not sure what Online in Hazardous environments means. There's only a partial explanation; one additional interpretaion would have all of the Internet hazardous because of crackers. I like how some companies beat you over the head with "you can't sue anybody" then neglect to meantion you can't really sue them either. It's a true statement of most OSI licenses, but it's no worse than theirs in that regard.

Re:Not much more protection than OpenSource

[thsths]

Interesting. It says:

> THE SOFTWARE IS PROVIDED "AS IS," WITHOUT WARRANTY OF ANY KIND.

Of course in most legal system this phrase is completely voided as soon as you pay for this software. Pay = contract = responsibility. So if SSH has a bug, a hacker gets in and you can proove negligence on the part of TFA, they have to pay for it.

Funny enough, that has nothing to do with the software itself. They could sell you OpenSSH, and they would be in the same situation.

The other marketing BS keyword

[typical]

Whenever you hear enterprise you can be assured someone in marketing is trying to BS you. It's really a keyword to denote that there is no good reason why something is better or bigger, merely that someone is trying to con you. It's almost as bad as synergy.

The other marketing BS keyword is "technology", when used in the form "foo technology". An engineer would never say "HTML technology". He's familiar with HTML, he says "HTML" every day, so he has no reason to tack on the entirely useless "technology" on the end. Marketroids, on the other hand, know that "technology" has positive connotations, so they ram it on the end of every tech-related thing. I find that the "technology" filter, along with the "enterprise" filter, work pretty well in reducing the amount of useless things I need to read.

The abuses of "enterprise class"

[typical]

Enterprise class means it's designed to be deployed across an entire enterprise/organization with centralized management, out of the box.

You're awfully generous to the vendors out there. Let's take a look:

Seagate sells "enterprise class" Cheetah hard drives. How one would deploy a hard drive across an entire organization with centralized management does not immediately jump to mind.

Intel makes "enterprise class" chipsets.

Logitech's V500 Cordless Notebook Mouse is apparently a true enterprise-class wireless solution.

I just chose three companies at random and plonked in "site:companyname.com enterprise-class" into Google.

OpenSSH Availble and Supported on the Mainframe

[Anonymous Coward]

IBM zSeries Mainframes come with and support the use of OpenSSH under Unix System Services.

You cannot get any more "enterprise" than Big Blue's Big Iron.

End of Discussion.

Your user info

[Anonymous Coward]

Your "homepage" points at http://localhost/. For most normal network devices, the hostname "localhost" will resolve to the same device, typically using IP address 127.0.0.1. That means that if anyone clicks on your link, they'll be connecting to themselves!

Do you see how explaining at length a readily apparent joke is neither funny nor insightful? That indeed it is scarcely worth the time it takes to type and certainly contributes nothing to the signal-to-noise ratio here? You have a five digit uid, you can do better than this.

You're welcome

Wha???

[mr_burns]

SSH Communications still exitsts!?!?!?

For as long as I've used SSH, OpenSSH was the SSH server. I didn't even know there was another until a few years after. On the client side there's PuTTY if your're stuck on windows but it's OpenSSH shipping on everything else... especially MacOS X, Linux and BSD.

That there are proprietary software SSH solutions out there making money comes as a surprise to me.

And why would anybody with half a brain trust encryption software they can't audit if need be? C'mon: the cryptosystem has to mathematically so whoopass that wether or not an attacker has the source makes no difference. Proprietary is talking the talk. FOSS is walking the walk.

It doesn't surprise me that these guys would use FUD to sell their wares. Have they any other choice?

Re:Wha???

[PHPfanboy]

just wondering really how many companies really give a shit about auditing the code of these really peripheral tools.

Enterprise = support, GUI, proper QA and release procedures, decent documentation and a company you can talk to if you need special stuff done, something that many FOSS lack.

FOSS is great, but it's not the only way, nor will it ever be.

Re:Wha???

[csirac]

Enterprise = support

How is this unlike FLOSS? If you paid money for your Linux distro, you can get support there. Additionally, there are plenty of alternative FLOSS software consultants out there.

On the other hand, if I had a dollar for every time a small/mid-size company client at my old shop was left out in the cold with zero options even if they wanted to sponsor a solution, by a proprietry software vendor - well, I'd be almost a hundred dollars richer...

Granted, these vendors (despite calling themselves as such) are probably not the same "enterprise-class" that you're discussing: but I fail to see how FLOSS has any less support options. If anything, it has more.

GUI,

There are several "GUI" OpenSSH configurators. One of them is http://www.webmin.com/.

proper QA and release procedures

This is a highly subjective and personal taste thing.

I will agree that the manner in which new FLOSS apps are initially developed leaves something to be desired.

However, this style of development is far more effective than typical proprietry methods in my (worthless) humble opinion once a product matures and is mostly in "maintenence" mode, which is the case with OpenSSH.

More to the point, after providing low-level hardware, networking and OS support for companies running proprietry ERP/CRM/Accounting apps I'm thinking of starting my own company to provide my own software.

Propreitry vendors don't magically have "proper QA and release procdures", have you even seen the typical level of quality of proprietry software that isn't MS/IBM/Peoplesoft? It's pathetic! Medical software running hospitals and surgeries that no longer print invoices after a patch release (I actually stood there while a support tech instructed the user how to do a screen-cap, paste to mspaint.exe and print that!), accounting/stock managment packages with worse-than-useless reporting (to the point that they hire someone specifically to manually transcribe data by hand into MYOB!), CRM apps that take up to 30 seconds to bring up client details, ERP apps that are impossible to back up...

The vast majority of software companies suck. It's hard for FLOSS to suck worse compared to these guys...

Re:Wha???

[csirac]

just wondering really how many companies really give a shit about auditing the code of these really peripheral tools.

I realise now you weren't attacking FLOSS, so for what it's worth, I've found the ability to run apps in gdb with debugging symbols compiled-in quite useful. But then I've still missed your point about the "audit"... I guess I don't have any experience that has led to a situation where a code audit of any kind was required (I've audited PBX configurations to ensure emergency number dial-outs work but that's not the same).

The point is you have the option to "audit" the software... not to mention that due to its very nature the likelihood of there being backdoors in open source is quite low whereas with proprietry software it's almost impossible to know for sure.

Re:Wha???

[cant_get_a_good_nick]

And why would anybody with half a brain trust encryption software they can't audit if need be? C'mon: the cryptosystem has to mathematically so whoopass that wether or not an attacker has the source makes no difference. Proprietary is talking the talk. FOSS is walking the walk.
How many IT departments have that level of skill to perform an audit for algorithm holes in FOSS? the fact that real cryptographers are still finding (occasional) bugs in openssl code that's been out for years doesn't give me a lot of confidence a server admin would be able to find any. Cryptography in particular has very subtle bugs. Where would you look to find subtle timing bugs that give off info that don't blast the algorithm wide open, but cut down keyspace? Auditing source is a cool thing to have, but I doubt it has that much use in the real world. There's always going to be the assumption that someone else has done it.

Centralised management is not necessarily good

[grahammm]

As far as security is concerned, is centralised (update and configuration) management not an additional vulnerability? If an attacker can attack the centralised control then they have just subverted all the systems managed by it.

+5 Informative!

[Anonymous Coward]

Of course, I haven't RTFA yet, so I could be completely wrong about this.

You must be not new here

Twaddle

[Anonymous Coward]

That 10x price increase is there for a reason...24x7 support 365 days...flying out...hand hold through every upgrade...

And that's why the software costs ten times as much is it, because all the services you describe are included, at no extra charge?

/*rolls eyes*/

Re:Twaddle

[syncomm]

No, the software cost is usually a function of the number of users. So obviously when you have 120,000 users the license cost gets very high. Plus, you get to pay for the enterprise services! ;)

They're right!

[kilauea]

Sorry but they are correct in what they say. I wouldn't dream of using anything other than SSH myself, but in the large enterprises I have worked in - the commercial product would be more suited. It is more user friendly - MUCH - more user friendly to begin with, which reduces training costs.
There is a commerical entity behind it, which is simply required in a lot of large organisations in certain contracts and interal policies. I worked for a bank that in some policies it stated that any product used must have an accountable supplier. And I'm sure that isn't the only place that does that.

I wouldn't question the quality of OpenSSH, but this guy isn't saying anything a lot of people don't already know. I just get the feeling sometimes that a lot (although not all) of the supporters of free software have little experience of how large organisations work...

Re:They're right!

[cant_get_a_good_nick]

We're a large'ish organization, at least in our field. We don't have any SSH.com software around, we use openssh on the servers, and putty on the Windows clients, openssh on the servers. We integrated RSA SecureID into the system, then we scotched that initiative. We're in finance, and in general we shy away from OpenSource, preferring someone to partner with for support, but there's never been any plans to replace OpenSSH. It just works.

Though i agree with you in that a lot of people don't understand that getting software into an enterprise is a complex process, and simply saying "this roxx0rz!" won't cut it, OpenSSH does fit a lot of organizations. It just works.

What are you talking about?

[Anonymous Coward]

What are you talking about? Red Hat has had auto-updates for ages. Debian, which is totally free, has had auto-updates for even longer. Windows was a latecomer to this. Why should every single applications update themselves, when it should be a sub-system (daemon/service) on the OS doing this?

On MY setup, auto-updates are performed every night, with everything taken care of without my supervision. With errors mailed to me, I sleep well at night. Yes, this is a Debian system. When finally set up, which is what the vendor/supplier should do properly, it is much less hassle than Windows XP.

Your post didn't make sense, at all.

And what excactly is "Enterprise Ready" anyways?

If you want to block out old protocols, you can do so in OpenSSH, by editing the configuration. The protocol is probably logged to a log-file too, if you're really interested.

But I don't think you really are. Either you're trolling, or a company whore. Because your post doesn't really have any useful statements that I can find.

Re:What are you talking about?

[bogado]

Not counting that if every one of your applications have a different auto-update feature this can only mean that you have n ways to corrupt your system. With the auto-update being done by the base-system you have just one auto-update system to take care (worry).

Auto-update is a very dangerous operation, but nowadays it is unfortunately a necessity of the day to day computer life. And every application should be auto-updated, remember that many applications that do not connect directly to the net can be used indirectly to own a system.

I use the imipak handle on Sourceforge

[jd]

But the initial drop is indeed there. It's nothing extensive, at the moment - the last snapshot of OpenSSH, with a bunch of patches thrown in, but the fork does exist and it is more than just baseline. I'm calling it openssh-folk, as the FOLK project is specifically for the purpose of severely overloaded software (which is the direction I intend to take this fork).

Re:I use the imipak handle on Sourceforge

[Anonymous Coward]

Sounds like a worse idea then the actual FOLK project, good luck with your bloated crappile though. Maybe you can get enough people to go to it to turn it into a replacement for that crappy lsh, you could even GPL it.

Re:That's like saying...

[cp.tar]

*ahem*

Creoles are contact languages (pidgins, to be more precise) that have become native to at least some of their speakers.
Therefore, if they are creoles - which they most certainly are not - they have native speakers. Q.E.D.

The are not pidgins, either - they are actually not contact languages at all.

OK, so Klingon can serve as a lingua franca at Star Trek conventions, but that's beside the point ;)

(Yeah, I know this is offtopic, but I just can't let this kind of thing go unpunished.)

Indemnity. Indeed.

[Mr.Surly]

From TFA: [Byron Rashed, senior marketing communications manager of SSH Communications Security said] "Liability is also an issue that companies are worried about. Open-source software usually does not have any indemnity insurances associated with them." (emphasis mine)

Google search: indemnity site:www.ssh.com

Your search - indemnity site:www.ssh.com - did not match any documents.

Re:Indemnity. Indeed.

[atomic-penguin]

While that is an interesting thought. SSH communications owns ssh.com, they are in no way affiliated with OpenSSH.

Re:Indemnity. Indeed.

[Mr.Surly]

Exactly my point. They bash Open Source about lack of indemnity without offering any themselves.

Source code *is* available

[UnapprovedThought]

You might be surprised to discover that the source code for SSH.com's SSH server and client software is available to anyone who wants to examine it

Thank you, I didn't know that. Maybe the story title should have said it draws Theo's ire, not open source ire, if they are just as open (of course it depends on the other specific license restrictions, etc.)

Then again, reporting that something draws Theo's ire wouldn't be big news :)

Re:Source code *is* available

[linuxfanatic1024]

Source available != open-source. Remember, having the source available is not very useful if you can't do anything with it!

Who got up on the wrong side, this morning?

[jd]

It's a fairly normal Software Engineering practice to make a product feature-complete, then refactor it to produce something that is of higher quality. Optimise too soon and you end up with unmaintainable code that you can only extend to do what you want with extreme difficulty.

My purpose is to do this the Right Way (by Software Engineering standards), which means getting the code feature-complete FIRST. The purpose of software engineering principles is not to have "neat" code, it is to have complete code. And, yes, that likely means the codebase will be larger. Is this bloat? No - bloat is unnecessary code. If it is necessary, it cannot be bloat, no matter how large the sourcefile becomes.

Once the codebase is complete, THEN you can worry about refactoring, optimising, cleaning out redundancy, etc. You can't decide what is unnecessary, though, until you know what IS necessary. If you cannot define one, you cannot define either.

Seeing bloat where none exists is a common form of myopia amongst certain groups of hackers. You can tell who suffers from it, because their skill-sets don't grow as quickly. You can't learn new technologies or new approaches when you're convinced that they're useless by definition. Such hackers are absolutely brilliant at their specialist fields, precisely because they're undistractable, but they're like a fish in hard vaccuum when confronted with anything they're unfamiliar with.

This is exactly why you need generalists. These are people who know how to link ideas together, know what ideas you should even TRY to link together, and are willing to explore the fringes of possibility in an effort to squeeze even one more drop of usefulness out of something.

If you want the absolute best design, you get a generalist. If you want the absolute best implementation of that design, you get a specialist. Specialists can't design to save their life (which is why the Shuttle is a piece of crap), generalists without specialist knowledge are too distractible to produce a good implementation (which is why you don't see many top Software Engineers in industry) and generalists WITH specialist knowledge tend to be the legends of the industry.

The ideal is to have teams with both types of people, so you can get the benefit of both types of skill without having to rely on having any legends around. Legends are too rare to rely on and impossible to replace if they quit or die. This isn't just true of computing - look at the music industry. A good 90% of all the top composers were in partnerships (Lennon/McCartney, for example) where the extreme gifts complemented each other rather than competed. The other 10% were gifted ENOUGH that they could cover both the breadth and depth at the same time.

If a partnership is impossible (as is blatantly obvious to anyone reading the AC replies to my posts!) then you have to apply the approach in layers. Use specialist and generalist skills alternately, to gain the maximum functionality, the minimum footprint, the maximum usability and the minimum risk. The OpenSSH team, as it stands, isn't capable of this. They're specialists, with a specialist mindset, and the egos you invariably get with specialist thinking. They're good coders, but they are intrinsically incapable of recognising the worth of others or the worth of avenues outside of their own fields.

When Theo was interviewed on Slashdot, I asked him about OpenBSD as a distributed kernel. He had no idea what that was and was clearly not about to find out.

For those interested, a distributed kernel is an OS kernel that runs on a cluster as a single kernel, not as a collection of independent kernels. If you want maximum performance on the cluster, you absolutely don't want the overheads of running code you don't want. This means you absolutely don't want the full OS on each node, you only want the bits that are actually needed on a local basis. (If a node is running a single program, you wouldn't even want

Re:Who got up on the wrong side, this morning?

[Anonymous Coward]

I disagree, you shouldn't add every god damn thing in the world and you shouldn't do it all at once.

You're off your rocker.

You should add each needed part and smooth it out and make sure it works one at a time, so as not to have a giant clusterfuck of a programme, but instead a clear and easy to understand one where you are only dealing with the problems in one area at a time, not the entire thing being broken.

You are looking at adding in umpteen random things to the code base from all sorts of people that code in completely different styles of C - that's a terrible idea, the result will be a giant mess that is hard to navigate. That is why huge chunks of GNOME and KDE are being rewritten over and over, because it's so hard to know what's going on that it's easier just to do all the work over instead of trying to decypher it all.

That you think that is a good way to make software is a sign that you are bad at making software. You start small and proper and add to it, properly all the way - that is how you make good softare.

What you talk about, your distributed operating system, is a concept that Matt Dillon cares about, you may want to go talk to him.

Re:Who got up on the wrong side, this morning?

[Secret Rabbit]

Wow, did you ever type a lot without saying a damn thing. After all that, what was your point?

And did you ever ask yourself if a distributed kernel was part of OBSD's goals? It would only not be feature complete if that were the case. ie Just because you can generalize things, doesn't mean you should nor does it mean you want to. Clearly having a distributed kernel would have serious security implications which I would think that the OBSD team would not want.

And as you say, it's useful on a cluster. Since I'm not aware of OBSD wanting to be a clustering OS, why would they go in a direction that is contrary to there current goals?

But, you should ask Theo if you really want to know. I'm sure you'll get a definit answer.

Re:Who got up on the wrong side, this morning?

[jd]

Humbug. Humbug, I say. If indefinitely expanding on a proven design was workable in the long-run, we'd all be programming in PL/I on machines with magnetic core memory using punch cards. You know that the Ramjet was designed in 1907 - trust me, it wasn't done by testing the pieces out first. Thrust-SSC was designed by through modelling the full system on computer then physically, before being built full-scale. The full system, not one wheel at a time.

A partial specification is impossible to prove, as is a partial program. You design from the top down, you implement from the bottom up, you NEVER, EVER do either from side to side. If you want to lay a railway track, it is of absolutely no value if you implement one rail first. You cannot test a single rail under real conditions. You do not implement it half a sleeper at a time. You certainly do not implement the rails first and then come back to do the sleepers later.

The "Extreme Programming" methodology you are talking about is very fashionable and is superb for producing single modules of very high quality. Single, focussed modules. OpenSSH, as the OpenBSDers have it, is indeed a remarkably well-polished single module of indisputable quality. A positive gem, in many respects. No doubt about it. I would never question that. And to polish a gem, you go to a specialist. That is no work for someone who has not honed their skills to the limit.

But could that specialist turn that gem into a fully-functional radio? Probably not, but virtually any electronics amateur who has played with radios has scratch-built a crystal set by turning a lump of rock into a functioning crystal oscillator. If you go further, and use leads that are fine enough and well-enough placed, you can build a functional transistor.

Specialists had been building machines that could follow a sequence of operations for years - one of the earliest such machines was the Jaquard Loom, in the Industrial Revolution. It took two generalists (Alan Turing and John von Neumann) who were skilled not only in mathematics but also biology and philosophy, to actually turn these specialized devices into general computing machines. Once generalist machines were built, it then took specialists to find a way to use them, but once that was established, it took generalists (usually garage developers) to turn them into machines people could actually use.

If you were to compare someone who had passed with a First from Oxford or Cambridge in England with the best MIT or Harvard could turn out, you'd consider them pretty equal. Different, but equal. But how can they be so different? Oxford and Cambridge are considered "Classical Education", with a high emphasis on producing people who are multi-disciplinarians. MIT and Harvard generally produce specialists within a very narrow subset of a single discipline.

Neither is better, and if you were to look to trying to gather the best of the best, you'd want people from both backgrounds. Nothing less would be even halfway decent, however bright the people were. You need both.

I don't have a problem with Theo, his methods or his beliefs. In fact, I consider them essential. It seems a pity to me that neither he, nor those who code alongside him, are quite so willing to consider others in the same light, but I also don't see it as my problem that they don't. If they're right, then Darwinism means they'll be the only ones left in the field. If I'm right, then both they AND the more classical programmers will be. They have nothing to lose either way, and I only have something to lose if I'm wrong, regardless of their opinions in the matter.

Free market capitalism ..? Where?

[pbhj]

Where is this "free market capitalism" of which you speak? It seems mega-corporations won't even set up factories in UK without substantial government funding; then they expect to be bailed out when they're failing, even though they continue to give money to the shareholders. So part of my tax $currencyUnit goes to make someone who is hugely rich a bit richer whilst I can't afford to eat anything but mince and pasta.

These businesses that pay out to shareholders when they can't afford to should go out of business but they get held up by government for fear of global labour markets.

Ultimately it seems all systems however good get brought down by greedy people. But then if you're an evolutionist that's what should happen - screw the weakling poor and prosper the strong rich.

"There is no other definition of communism valid for us than that of the abolition of the exploitation of man by man." - Che Guevara

In contrast capitalism is all about increased exploitation (ad absurdum). I think the reason capitalistic societies prosper fiscally is that everyone expects everyone else to be a lying scoundrel hell-bent on screwing them over - that way your guard is up. If everyone is expecting benevolence and human-kind-ness then it's easy for someone to sweep in and grab what they wish.

I'm impressed.

[jd]

You managed to look through a whole reply without reading it. A distributed kernel cannot be one of OpenBSD's goals, because Theo didn't know what a distributed kernel was. You cannot seek to do something you don't know about.

And THAT, my dear, has been my point all along. You CANNOT seek to do something you know nothing about. THAT is why generalists are essential, because only a generalist knows enough subjects to be able to expand the horizons of a project to the logical conclusion. It is ALSO why specialists are essential, because only a specialist knows enough about a given element to see it to completion and to do it right.

"But what if a project doesn't want to expand?"

If that is the correct approach, then the new variant will die off. "Survival of the fittest" applies to computer programs, just as much as it does to biological entities. If it is the wrong approach, the more restrictive original branch will die off. You will also get situations where BOTH variants can survive, and often this is the preferred result, particularly if the variants coexist peaceably. Actually, this is how you tell if something IS feature-complete - if a variant dies, then it is either too restrictive OR too extensive. Feature-complete variants will always be preferred by natural selection. When two variants have different domains, provided BOTH are feature-complete within their domains, they will both survive. If one is feature-complete and the other not, then the one that is not will be selected against.

(There is one, and only one, exception to this. Arrogantly assuming you are the be-all and end-all. There will ALWAYS be someone that little bit smarter, that little bit quicker and/or that little bit more flexible in their thinking. If they are welcomed as a friend - however alien their thoughts - then your pool of talent will always grow and you will never stagnate and rot in thought. If they are cast aside as though they were inferior, then at best you WILL stagnate. At worst, they'll take the best of what you have, build something so far beyond anything you've ever imagined that you will never seriously compete, and your project will be doomed to the dustbins of history.)

"We can't do one -and- the other! Don't be stupid!"

Let us use the example of a distributed kernel, because that's a nice, extreme example and it's not something anyone is doing right now so isn't politically hot. The lowest levels of the OS would need to be the same - the hardware hasn't changed. The uppermost layers of the OS would need to remain the same - distribution done right is going to be transparent to the applications. Only the middle would need changing, then.

CVS supports branches, but it's not so hot on branches of only a subset of a project. What we're wanting here is to make use of all development, avoiding unnecessary duplication of effort. The initial effort in producing a distributed kernel would be in allowing the whole of that middle layer of the kernel to be executed in parallel. That would probably be best maintained as a patch set, relative to the baseline OS.

Once that is done, you'd create a second fork. This second fork would be a patch-set relative to the initial parallelization effort, and would be concerned with efficient communication between parallel threads within the kernel. If threads are on the same physical machine, you want to use memory. That is fast and efficient. If the threads are on DIFFERENT machines, you want to be able to pass data as efficiently as physically possible.

Once that is done, you'd create a third fork. The third fork would allow the communications to take place between different kernels as if they were the same kernel. You now have transparent clustering, but you're still not truly distributed as these are still different kernels. You'd need a fourth fork, where redundancy could be eliminated on-the-fly and where you could have multiple instances of a single component - some local,