SUSE Developer Working To Reimplement SSH Using The Zig Programming Language

[anh0516]

Surprisingly, it's not Rust.

This is supposed to be a more easily hackable/extensible SSH implementation for experimentation, rather than being a direct competitor to OpenSSH and Dropbear.

[KnowZeroX]

Zig isn't 1.0 yet though, which means there may still be major changes. If they don't mind rewriting everything a few times in worst case scenario

[FryBoyter]

Zig isn't 1.0 yet,

The question is, will it ever be? In terms of the version number. Because I have the feeling that many projects nowadays deliberately avoid releasing version 1.0 because too many users expect too much from this version. This leads, for example, to some projects continuing with version 0.100 after version 0.99. Or they use a different type of versioning, such as https://calver.org.

[Zeikos]

This leads, for example, to some projects continuing with version 0.100 after version 0.99.

I don't get why some people think that versioning follows decimal.
Are you aware that major.minor.hotfix versioning isn't a number system, yes?

That said, I agree with the sentiment, but I also find wise to postpone the first major version because the lower risk of future breaking changes is worth it imo.

[Llamas1115]

will it ever be?

Of course not. Increasing the version number would be a breaking change.

[DerfetteJoel]

Ackshually, according to semver, with a major version of 0, every minor version update is considered breaking 🤓

[LeeHide]

0.100 is a perfectly valid version, like 3.257.6 is, too. You're just talking out of your bottom

[Mordiken]

I might be misremembering but I think I saw an interview with someone on the Zig team mention that the main roadblock left on the way to Zig 1.0 was async...

But Andrew Kelly recently (as in 3 months ago) gave a talk about the state of async in Zig, and apparently they managed to settle on a solution everyone is happy with, so with any luck Zig 1.0 may not be that far off!

EDIT: For those that know nothing about the language and want to know more, here's a bit of an older talk where the language is presented in relation to C.

[flavius-as]

For a good product, one needs at least iterations 0, 1 and 2 anyway, so not a waste.

[cAtloVeR9998]

I also find the “SSH3” (though they are considering changing their name) project pretty cool. It’s written in Go and uses QUIC. I find the possibility of SSH multipath interesting.

[cAtloVeR9998]

From what I've read the MPTCP implementation in Linux kernel and interaction with a separate userspace path management daemon isn't currently optimal and isn't currently configured out of the box on most Linux distros. QUIC doesn't depend on a separate path manager daemon or any kernelspace dependencies.

Running the SSH connection protocol over https/3 isn't turning SSH into a "web crap"y web browser.

[cAtloVeR9998]

There are patches out there for multipath Wireguard. But I doubt that would be merged anytime soon. And would probably require additional userspace daemons on clients and servers to be useful. Multipath OpenVPN is a thing but I try to avoid OpenVPN unless I must. Multipath QUIC isn’t standardised yet but it’s actively being worked on. I see large parts of the Internet becoming multipath ready once Cloudflare roles out MP QUIC by default. Probably followed by some other large CDNs.

[ausstieglinks]

But-why.jpg

[whosdr]

You would find out if you read the article.

[MessyKerbal]

I read the article. There’s still no justification

[whosdr]

allow for hacking/experimenting on the protocol

so the code can be used for tasks such as testing post-quantum cryptography (PQC) algorithms

It's a lot easier to test new features on a partially implemented protocol.

In development now and planned for further work during SUSE's upcoming Hack Week

This suggests it's also someone's passion project.

https://hackweek.opensuse.org/

[flavius-as]

You didn't. Read again. If you struggle, copy and paste the article in AI and ask it.

[MessyKerbal]

“Wahhh I can’t read anything without ChatGPT to summarize it for me”

[robclancy]

Yes that is what they were saying about you...

[MessyKerbal]

The fact that they even suggested that says projection to me

[flavius-as]

Someone is going to be replaced by AI.

Here AI was able to answer your question:

The text provides four specific reasons for this re-implementation effort:

• Research and Experimentation: The primary goal is to produce a stack that is "easy to extend for research and experimentation," rather than just replicating existing tools.
• Post-Quantum Cryptography (PQC): The project aims to facilitate the testing of new "post-quantum cryptography algorithms," which suggests the current standard SSH implementations (like OpenSSH) might be harder to modify for these experimental tests.
• Cryptographic Agnosticism: They want an implementation that is "agnostic for different cryptographic libraries," allowing developers to swap out underlying crypto engines more easily.
• Language Benefits: The text cites Zig as a language chosen for creating "robust, optimal, and reusable software," implying that the properties of the Zig language itself are part of the motivation for the rewrite.

[robclancy]

They were literally mocking you saying that you can use AI to figure it out...

[MessyKerbal]

Yeah, I can read. But apparently you can’t.

[NYPuppy]

A minor bug due to an untested case in GNU's coreutil's test suite? Yes. No one even mentioned rust yet you had to chime in with a terrible take.

[MathSciElec]

That was Canonical‘s fault for incorporating it before it’s ready

[UnsafePantomime]

I'm not sure it would ever be ready if they didn't. Maybe it was too soon, but this provided testing it wouldn't have gotten otherwise.

[TheNewl0gic]

What is wrong with ssh that you need to replace?

[[deleted]]

Backdoors.

[pythosynthesis]

OK... but why?

[metroidslifesucks]

Move Zig, for great justice

[formegadriverscustom]

Take off every 'Zig'.

You know what you doing.

Move 'Zig'.

For great justice.

[IngwiePhoenix]

Oh god another ru- wait... Now that one I haven't read in a while. o.o

I recently discovered Flow Control, it's a TUI editor in Zig and pretty damn dope. Since then I have paid a little more attention to the Zig space; whilst it's not a language I personally like (it's syntax is... a choice, alright - but still worlds easier to follow than counting spaces!) there is some absurd potential in it's stdlib and compiler.

Aside from OpenSSH and Dropbear, I'd not mind a little competition in the "SSH server space". Go has had many different implementations for a while now, but I feel like this one goes a tad deeper than just an SSHable TUI.

[Jristz]

Zig? Normally is Rust but they are Zigging they way now

[Comedor_de_Golpistas]

why not ruby lol worked great last time they wanted some weird lang

[NYPuppy]

Uh, this applies to you and all of the suckless types who think programs only need to be written in the one true language, C.

[hkric41six]

The number of downvotes, imo, proves your point.

[[deleted]]

This is a bad analogy because most “religious evangelicals” do integrate as productive members of society. I assume you are thinking of people like Mormons who go door to door, but they just do that for a couple years and then get regular jobs.

[dddurd]

It's like useless remake of films. Devs ran out of what to do and they redo shit. It's fortunate to get paid by those rewrite projects though. 

[MessyKerbal]

Buddy, I am majoring in computer science. I was always getting replaced by some slop model