> > to do with it but you're going to break protocol specifications if you do this.
> >
> > Anyway that my personal (biased) opinion, something done in good faith vs
> > what it's supposed to be like.
> >
> >
>
> I agree with that...
> Time to move on though, rsh is a dead protocol IMHO (or at least it
> should be), but yes if you want to keep everyone happy as far as
> protocol specifications go, then you'll have to leave it the way it is.
>
> But, if it was my choice... I'd rather piss Theo and few others off
> then have users of mdk at risk of some root exploit via rsh or ssh (no
> there's not one out right now for the vers packaged in mdk, I'm speaking
> future wise).
>
> I'd actually want to not ship rsh at all, and just have tools that use
> rsh, use ssh instead (rsync, rdist, cvs, etc..).
>
I think ssh calls rsh when something can't be done (I'm quite sure with the
output from strings but need to verify)
So you want to use ssh but there are cvs servers who still use rsh out there.
>
> This brings me to another protocol : )
> (I know I'm a bastard ; p)
> I don't think mdk should ship a telnet server either (even if it uses
> krb, krb is f'n weak, and has had so many holes in the past, and who
> knows how many the future.)
> Among many other tools that I don't think mdk should ship.
> I also have a barrage of lot of other ideas, that I will bring up after
> 8.2 release (not proper for right now since so close).
>
That's correct. But you don't have to install it, and I don't think it's
installed by default either.
- G.
