OpenSSH 10.4/10.4p1 Released

https://www.openssh.org/txt/release-10.4

by throw0101a • 16 days ago

116 22 16 days ago

openssh.org

throw0101a3• 16 days ago

HTML version of release notes:

* https://www.openssh.org/releasenotes.html#10.4

atonse• 16 days ago

Still looks like ascii, doesn’t automatically wrap, nor is it responsive.

Anyone know if these projects accept PRs to improve these kinds of things, like legibility? Or is it a point of pride?

rovr138• 16 days ago

https://www.openssh.org/releasenotes.html#10.4

    <!--
        DO NOT EDIT MANUALLY!  This is generated from:
        www/build/openssh/releasenotes.html.head
        www/build/openssh/releasenotes.html.tail
        
        See comments in www/build/openssh/Makefile for details.
    -->

ninjin• 16 days ago

Well, you can have a look at the commit history to see what changes have been accepted in the past:

https://github.com/openbsd/www/commits/master

My experience is that minor improvements tend to get accepted if they come with a solid technical motivation and fits into the overall OpenBSD mindset and ecosystem. If the change is simply justified by "best practices" and is rather large, then the conservative choice of just leaving things as they are usually prevail.

For example, I think I have seen two proposals for major overhauls of the OpenBSD.org homepage by "outsiders" over the last three years or so and they were both rejected. However, as you can see by the commit log, minor improvements (including presentation ones) happen all the time.

liuchao-001• 16 days ago

It is vintage style. I actually love it a lot.

1over137• 16 days ago

What “responsive” mean here?

stinkbeetle• 16 days ago

I can almost guarantee it would not be an improvement.

PunchyHamster2• 15 days ago

To make it worse ? I hope they don't!

ktm5j• 15 days ago

It's not supposed to wrap or be responsive.. It's a tradition of making text legible on vintage terminals. I use `fill-paragragh` in emacs to format my commit messages like this 'cause I'm a dork hehe

saghm• 16 days ago

Honestly this just looks like RST markup to me. If you really wanted to format it, I feel like using a previewer for that would basically do the job

Panino• 16 days ago

Among other changes 10.4 adds post-quantum keys (composite ML-DSA 44 and Ed25519), not enabled by default.

When pq key agreement was added in 2019, it took almost 3 years for it to become enabled by default. This isn't criticism, just an observation. I don't have a pressing need for pq sigs. Always happy for new OpenSSH releases though!

throw0101a3• 16 days ago

Among other changes 10.4 adds post-quantum keys (composite ML-DSA 44 and Ed25519), not enabled by default.

The draft was only published a few months ago:

* https://datatracker.ietf.org/doc/draft-miller-sshm-mldsa44-e...

The draft is a 'personal document', so not associated with the IETF/WG.

ecesena• 16 days ago

I recently added ml-dsa-44 to solokeys, both piv and fido2. To my understanding ssh+fido2 doesn’t support pq yet, but if anybody’s reading and knows how to make it happen, I’d be really interested.

lousken3• 16 days ago

Is hmac-sha1 and umac-64 still enabled by default?

throw0101a3• 16 days ago

Yes:

* https://man.openbsd.org/ssh_config.5#MACs

* https://man.openbsd.org/sshd_config.5#MACs

ETM, encrypt-than-mac, variants are at the front of the preference list.

* https://en.wikipedia.org/wiki/UMAC_(cryptography)

lousken3• 15 days ago

That sucks, that means they will still appear in audits, they should remove them from the default.

OpenSSH 10.4/10.4p1 Released

Related Stories