Skip to content

Comment on Unauthenticated Remote Code Execution in Erlang/OTP SSHparent

Comments

Writing protocol code in Erlang is nice, because the parsing is so easy and clear. And if you want to do something that's not so easy by spawning a command, then you may as well build it in Erlang. And it's fun and symmetric to build both a server and a client... I've not looked at OTP SSH code, but I'd assume the ciphering is still calls to external c libraries, as it is in the OTP TLS code.

Of course, easy protocol parsing doesn't do the whole job; state management is required too (and was missed here, clearly).

AboutSource Built by g1lg1l

Hackerly is an independent reader for Hacker News, built on the public HN API. Not affiliated with Y Combinator.