openssh unix dev - May 2004 - Van Dyke's Public Key Assistant

Jeff Van Dyke's "Public Key Assistant subsystem" was previously
discussed
here: (end of a short thread)

http://marc.theaimsgroup.com/?l=openssh-unix-dev&m=103436908422003&w=2

I do see a few comments that seem to point out his arrogance and some
disgust about OpenBSD's RCSID, but has anybody found it to be unsecure or if
it was bug ridden. The subject sorta dies right there. If you follow the
links on www.vandyke.com, they still seem to be maintaining the patch...

Even if it was never going to be part of the RFC and might be only mildly
popular is there a technical reason the OpenSSH project's source should not
include his patch? Does it hamstring security? 

Anyone know if Van Dyke's license and/or copyrights would prevent a third
party SSH client, from utilizing this "feature"?

It looked find to me, but I have been known to do stupid things at times.
That usually happens right after I assume anything.



Regards,
R. Gordey

Randy Gordey wrote:
> Jeff Van Dyke's "Public Key Assistant subsystem" was
previously discussed
> here: (end of a short thread)
> 
>
http://marc.theaimsgroup.com/?l=openssh-unix-dev&m=103436908422003&w=2
> 
> I do see a few comments that seem to point out his arrogance and some
> disgust about OpenBSD's RCSID, but has anybody found it to be unsecure
or if
> it was bug ridden. The subject sorta dies right there. If you follow the
> links on www.vandyke.com, they still seem to be maintaining the patch...
Speaking personally, I haven't had time too look at it.
> Even if it was never going to be part of the RFC and might be only mildly
> popular is there a technical reason the OpenSSH project's source should
not
> include his patch? Does it hamstring security? 
Every patch has security implications, things that manipulate
authorisation databases (such as authorized_keys) require additional
scrutiny.

-d