From: Avery Pennarun <apenwarr@gmail.com>
Date: Thu, 14 Jan 2010 20:46:56 GMT
Subject: Re: [RFC 0/2] Git-over-TLS (gits://) client side support
Message-ID: <32541b131001141246o1f5ce816gc4a26b81343aaa2d@mail.gmail.com>
In-Reply-To: <20100114085124.GA10298@Knoppix>

On Thu, Jan 14, 2010 at 3:51 AM, Ilari Liusvaara
<ilari.liusvaara@elisanet.fi> wrote:
> The client tries only one auth method instead of potentially trying
> multiple. Witness the 'use verbose mode and check if it uses the key'
> type stuff.

I believe this is a limitation of the client, not of the protocol.  So
a patch to the ssh client could fix this.

> OpenSSH? With the level of paranoia in it, I'd say good luck. And
> it's not just client, its the server also (and especially the
> server).

But you could fork it if you wanted.  It's about as easy to convince
me to install a different version of ssh than to install
yet-another-security-server.  (In fact, it might be easier to get me
to put in a patched openssh; at least then I can trust that it's
mostly openssh, and examine just what's different in your version.)

> And if you host the repo system too, you would get second key anyway
> (and SSH is not too good at handling multiple keys).

I'm not really sure about this.  ssh-add seems pretty easy.

Have fun,

Avery