So tell me. Do you think #curl should support plain SSH:// URLs to execute commands remotely?
@bagder I don't sense a particular demand for this feature from users.
@bagder My concern is that I don't think libssh2 uses `~/.ssh/config`. There are things that don't seem to fit in a URI. Jump hosts, identity files and agent forwarding would be the big ones from my usage. I usually use the config file to do that, but it also works on the ssh command line.
But if scp/sftp URIs already exist, maybe this would be fine?
@bagder it'd certainly be convenient sometimes... I'm far from qualified to talk about the implications of the increased attack surface area, but it kinda fits in the sense that for any long-lived tool or lib one expects gradual scope growth and hegemonisation. If the scope of curl is URI resolution, adding support for ssh scheme doesn't sound mad at all, and if it's not, where are the natural boundaries? I say do it, why not.
@bagder no. at the moment I expect curl to fetch and put things, not execute things.
also..
Assisted-by: an actual person <human@skunkwerks.at>
@bagder Seems out of scope to me, but it's your project and I'd have already made a different decision with regards to AI-generated submissions.
@bagder It would be fair only if local execution `curl --exec example.com/install` would be supported as well.
@bagder heck no. security smell & pinata for hackers. curl attracts enough scrutiny by bad actors as it is
@bagder speaking of which, I'd love to see grpc:// :)
@bagder no, because I am a strong proponent of the UNIX principle. Curl does one thing great, let ssh do that other job.
can I also remind you all that curl already speaks SCP and SFTP, in command line tool and library...
@bagder my impression is that the main scope of cURL is to fetch remote files (and push files to remotes that supports it).
From that point of view:
- support the SCP and SFTP protocols makes totally sense
- support remote execution of arbitrary command would fall under scope creep (and open too mant new cans of worms) (and also increase attack surface by giving opportunity for new creative abuse of the feature)
@bagder Hm, ssh can already to it: https://malcontentcomics.com/systemsboy/2006/07/send-remote-commands-via-ssh.html why mis-use curl then for this?
@bagder IMHO no; we have ssh already for that.
@bagder throw in a TUI and vim bindings while you're at it /s
@bagder No, don't do it. We've got ssh for that.