rniamat βπ½mijn bescheiden bijdrage aan het #libssh2 #CRA theater waar Daniel Stenberg mee te maken heeft
https://itchannelpro.nl/een-boeiende-draad-op-mastodon-over-libssh2-en-de-cra/
daniel:// stenberg://The "good" people at Emerson for some reason couldn't think for themselves when I responded to them on behalf of #curl and instead continue and send the same questions to the #libssh2 project with the same "demands".
"This is a gentle reminder regarding our earlier request for your input on the cybersecurity risk assessment of the software component βlibssh2β version 1.11.0, as part of our compliance efforts with the EU Cyber Resilience Act (CRA)."
I ran a quick SFTP performance test with #curl built to use #libssh 0.11.1 vs one built that uses #libssh2 1.11.1 over a 400ms latency connection.
One of them managed to perform this at 1049K/sec, the other reached only 249K/sec.
And the winner is...
libssh2
Funny detail: I sped it up for this kind of use case **fifteen years ago** and blogged about it: https://daniel.haxx.se/blog/2010/12/08/making-sftp-transfers-fast/
Making SFTP transfers fast
SFTP, the SSH File Transfer Protocol, is a misleading name. It gives you the impression that it might be something like a secure version of FTP, perhaps something like FTPS but modeled over SSH instead of SSL. But it isn't! I think a more suitable name would've been SNFS or FSSSH. That is: networked file β¦ Continue reading Making SFTP transfers fast β
Say hello to #libssh2 1.11.1, just released => https://github.com/libssh2/libssh2/releases/tag/libssh2-1.11.1
alipOn this day, fifteen years ago, we shipped #libssh2 1.0
Harry SintonenGlad to see that #libssh2 is on top of things adding #terrapinattack mitigation https://github.com/libssh2/libssh2/pull/1291
src: add 'strict KEX' to fix CVE-2023-48795 "Terrapin Attack" by vszakats Β· Pull Request #1291 Β· libssh2/libssh2
Refs: https://terrapin-attack.com/ https://seclists.org/oss-sec/2023/q4/292 https://osv.dev/list?ecosystem=&q=CVE-2023-48795 GHSA-45x7-px36-x8w8 https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2...
GateLinkerI realized that the new version 1.11 of #libssh2 was published 2 weeks ago: https://www.libssh2.org/
For v1.10 I commited some patches regarding #UWP, #WinCE and #BSD locally.
Some of those patches are obsolete now, but I guess I will find issues when I start builds for old target platforms.
The only disadvantage of crypto-libs is: They are complex and always need some extra attentions.
But I love them β€οΈ, because it's fun to write your own #SSH client by just a few lines of code.