* Mikhail Gusarov <[EMAIL PROTECTED]> [20080321 12:52:41 +0600]
> > Unlessed I missed something, libssh2 gives the application no way to
> > get the hostkey, so even if an application wanted, it could not compare
> > with the ones stored in known_hosts files (but at most with a hash of
> > that) and no way at all to store it in that format somewhere.
> >
> > I considered making this a wishlist report, but not being able to check
> > host keys in a customary way undermines the whole point of ssh and makes
> > the library almost useless to write reasonable applications.
> >
> I suppose original author was satisfied by libssh2_hostkey_hash(3),
> hence closing the bug.
Please revisit that decision to close this bug. If you do not agree with
me that this is a severe limitation making any application using this
library a risk to security, at least reopen it an change the severity to
wishlist. (Unless you find a way a client using this library can be used
in a reasonably safe way. As you also have only found libssh2_hostkey_hash,
I guess this means my complaint was valid).
Hochachtungsvoll,
Bernhard R. Link
--
To UNSUBSCRIBE, email to [EMAIL PROTECTED]
with a subject of "unsubscribe". Trouble? Contact [EMAIL PROTECTED]
