Hacker News Reader

Hacker News

Comment by corbet | Hacker News Reader

Parent Full thread

corbet

I'm amazed that telnet still lives after all these years.

I wonder if anybody has audited telnetd implementations on other systems for the same problem?

View on HN

I'm amazed that telnet still lives after all these years.

I'm going to be asking if anyone objects to me axing it from FreeBSD soon.

I wonder if anybody has audited telnetd implementations on other systems for the same problem?

All BSD-derived telnetd implementations are likely to have this bug.

Only thing I know of that it gets used for in my work is to talk to certain routers that don't support ssh version 2 since the software I work with doesn't support ssh version 1 anymore.

Yeah, lots of switches use telnet too. Most of those are (hopefully!) on a backhaul private vlan though.

I'm pretty sure openbsd is fine, since they removed telnetd from the OS years ago. The big question is, why do other systems still have a telnetd?

same reason there are still Cobol jobs. Users, for various reasons (ranging from dubious to valid), refuse to update to a more modern solution.

Telnet is still quite common in the embedded world. Existing tool boxes have implementations, busybox has a telnet client and daemon built-in, etc... It's easy. If the box never goes beyond a development rack it's safe. And if it's what you've been doing for 15 years there's not a lot of value in change.

Nonsense. People stick with telnet because of ignorance. That is why you remove telnetd, and force them to update. There is no difficulty in switching, and thus no valid reason not to switch.

As an example, there are entire classes of embedded platforms that support networking but barely have enough RAM even for the IP stack. Is it really sensible to add $10 to the cost of a temperature sensor just so it has enough RAM and CPU to handle SSH?

This is the piece that allows you to telnet /into/ a new shiny FreeBSD box, for which there are no legitimate uses in 2011.

If they take this bit out, you can still telnet out to your embedded hardware, L2 switches, and the like.

Reply on news.ycombinator.com