> If a zero-day drops in OpenSSH... Realistically, fwknop is more likely to have...

mmh0000 · 2026-08-15T05:46:13.000000Z

Seriously. If a zero-day drops in OpenSSH, it's quite literally the end of the world.

notpushkin · 2026-08-15T05:54:22.000000Z

fwknop is a bit lower risk though. If all an attacker can do is open a port, they’ll still have to exploit OpenSSH.

akshayrajeshwar · 2026-08-15T06:10:00.000000Z

fwknop's default is to run as root, so there's that. Support for separation of privileges is still pending since 2013 (https://github.com/mrash/fwknop/issues/32)

notpushkin · 2026-08-15T06:29:38.000000Z

Good point, thanks.