Conversation

Notices

1. Embed this notice
   daniel:// stenberg:// (bagder@mastodon.social)'s status on Monday, 31-Aug-2026 20:25:24 JST daniel:// stenberg://

   So tell me. Do you think #curl should support plain SSH:// URLs to execute commands remotely?

   https://github.com/curl/curl/pull/22661

   • Embed this notice
     Rich Felker (dalias@hachyderm.io)'s status on Monday, 31-Aug-2026 20:25:23 JST Rich Felker

     in reply to

     @bagder Unless it requires command line arguments to indicate this is not a pure document request, no. Just like a GET should not act as a POST, buy 1000000x worse.

     Also where would it be getting the credentials? Would curl/libcurl snoop your .ssh??

   • Embed this notice
     Rich Felker (dalias@hachyderm.io)'s status on Monday, 31-Aug-2026 20:32:38 JST Rich Felker

     in reply to

     @bagder If the library is automatically harvesting credentials so that its behavior depends on the ambient environment and is potentially stealing credentials from a user who doesn't intend this, that seems bad.

   • Embed this notice
     daniel:// stenberg:// (bagder@mastodon.social)'s status on Monday, 31-Aug-2026 20:32:39 JST daniel:// stenberg://

     in reply to

     • Rich Felker

     @dalias curl already does SCP and SFTP with credentials, so that's not really a new problem. But yeah, I don't feel that SSH has a good story for curl.

   • Embed this notice
     Rich Felker (dalias@hachyderm.io)'s status on Monday, 31-Aug-2026 21:09:57 JST Rich Felker

     in reply to

     • KasTas

     @KasTasMykolas @bagder Right. The credentials problem is not new, and seems like an existing nightmare waiting to bite someone - like for example can you do SSRF to fetch a private key file your user account has access to?

     But indeed the direct "RPC" (I'd call it RCE) aspect is new vs SCP and SFTP.

   • Embed this notice
     KasTas (kastasmykolas@river.group.lt)'s status on Monday, 31-Aug-2026 21:09:58 JST KasTas

     in reply to

     • Rich Felker

     @bagder @dalias but none of those is RPC, in general sense :)