openssh unix dev - Aug 2021 - OpenSSH support for FIDO RSA keys

On 30/8/21 1:53 pm, Peter Moody wrote:
>> I bet this (once) expensive equipment still supports telnet, so
>> nothing is being broken.
> even if it doesn't, the idea that someone would assume support of this
> equipment is the responsibility of the openssh maintainers, rather
> than the_vendor_, blows my mind.
That's an absurd mis-characterisation of what I said.? Perhaps you sent 
your message in injudicious haste.

Damien said that he plans to remove support for DSS keys at some future 
time.? That will take effort and I bet leaving them in the code will 
take none.

I'm saying, don't put in that effort because it will needlessly break 
equipment.? Deprecate it to all hell, but don't remove it. In no 
possible way can that be conflated with me saying that openssh 
maintainers have to support anybody's equipment.

> That will take effort and I bet leaving them in the code will take none.
neither you nor I are maintainers of openssh, but with unit tests and
configure options, this strikes me as a weird assumption to make.

look, this comes up every time openssh removes support for some
horribly broken crypto. "you're making my devices inaccessible, how
could you!?" and the answer is always the same,

 1. you're free to maintain a copy of the ssh client that supports
your old devices.
 2. you should be complaining to your hardware vendor, to whom you
pay/paid actual money.

as a thought experiment, imagine asking the chrome devs to keep
supporting ssl v3 because some commercial appliance you run hasn't
been updated in a decade.

/rant