Re: library/binding for sftp?

["Björn Persson" <bjorn@xn--rombobjrn-67a.se>]

Alan Jump wrote:
> On Wednesday, August 7, 2013 1:26:24 PM UTC-7, Dmitry A. Kazakov
> wrote:
> 
> > Yep, and obscurity means that others don't know the technique even
> > if the technique itself is stunningly simple.
> 
> It also means no one but you can implement it.

That's not true. Free software developers have reverse-engineered
several proprietary protocols and written compatible free
implementations. One prominent example is Samba, a free implementation
of Microsoft's proprietary file sharing protocol SMB.

Of course a public standard protocol is always preferable. I
reverse-engineered a protocol myself once. I was given a sample dump of
the communication between two programs, and wrote a filter that could
be inserted between them to modify the messages in transit. My code had
a lot of conditionals to allow for all the variation I saw in the dump.
A couple years later, when I got to see some source code, it turned out
that my code was unnecessarily complex. It allowed for combinations
that would never occur. So a protocol specification is better but
reverse-engineering is also possible when there is no specification.

Eavesdropping doesn't even require a complete protocol implementation.
It will certainly not be hard for spies to get the sensitive data out
of a simple but undocumented file transfer protocol, even if there are
some protocol details that they haven't quite figured out.

Björn Persson